Prerequisites
Developer account, project, and a test API key with scope sandbox:invoke. The full key is shown once in the portal.
PHASE 3B gateway is sandbox-ready and metered. It does not call the main Arbebus backend, AI assistant, route planning, navigation, Family, weather, or live transit providers.
Authorization
Send the API key only in the header:
Authorization: Bearer YOUR_API_KEY
Store keys only in server-side environment variables. Never in query strings, cookies, request bodies, or browser storage.
curl example
POST/api/v1/sandbox/ping
curl -X POST https://developer.arbebus.com/api/v1/sandbox/ping \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: demo-client-key-001" \
-d "{}"
Response headers
X-Arbebus-Request-Id— unique per request (new ID on idempotent replays)X-RateLimit-Limit/Remaining/Reset— per-minute abuse protection (RPM)X-Arbebus-Quota-Limit/Remaining/Reset/Metric— cumulative technical sandbox quotaX-Arbebus-Idempotency-Replayed—truewhen a stored successful response is replayed
Optional Idempotency-Key
For POST /api/v1/sandbox/ping, send an opaque client key. Same key + same request replays safely without consuming a second request unit. Same key + different body returns IDEMPOTENCY_CONFLICT.
Security
- Keep keys in server env only.
- Separate test and live keys.
- Revoked keys are rejected immediately.
Next
See authentication, errors, rate limits and quotas, idempotency, usage, and sandbox API reference.