---
title: "Test API requests safely"
description: "Learn how to test API operations with your account and which requests reach production."
canonical: https://docs.ordering.co/docs/developers/api-reference-sandbox-testing/
---

# Test API requests safely

**Test Request** sends requests to the production API at `https://api.ordering.co`. Without a connected account, three public `GET` operations are available. After connecting an account, you can test the operations in this API Reference using your session or an API key for the connected project. The API still decides which actions that credential may perform. No remote sandbox is currently configured.

Do not place an API key, session token, customer identifier, or response body in documentation examples or browser diagnostics.

## Try live-read mode

When the documentation is served from `docs.ordering.co`, `127.0.0.1`, or `localhost`, the embedded Scalar panel enables **Test Request** directly inside Docusaurus. Without a connection, it sends only the three public GET requests below. The project is editable and defaults to `orderingv1`. The real response appears under **Response → Body**.

Start with [`GET /configs`](https://docs.ordering.co/api-reference/#tag/configs/GET/configs), [`GET /countries`](https://docs.ordering.co/api-reference/#tag/countries/GET/countries), or [`GET /ai/agents/{agent_id}/templates`](https://docs.ordering.co/api-reference/#tag/ai/GET/ai/agents/%7Bagent_id%7D/templates). To test the other documented operations on `docs.ordering.co`, use **Try the API with your account**, choose your project, and use the connected Bearer session or an API key. The selected project is fixed for those requests; changing it requires changing the connection. POST, PUT, PATCH, and DELETE show a confirmation with the method, path, and project before sending. These requests can create, change, or delete real production data. The browser may also be unable to send some requests that Postman supports, and the API can return an authorization, validation, CORS, or rate-limit error. Use only a project and credential you are authorized to use.

The gray text shown in the credential field is an OpenAPI placeholder, not a stored key. Leave the field empty when the endpoint does not require one.

An API key entered in Scalar stays in the current document memory because `persistAuth` remains disabled. Reloading, navigating away, or selecting **Clear credentials** removes it.

## Why a CORS error is not a safety control

CORS controls whether browser JavaScript can read a response; it does not prove that the API did not receive or process a request. Never rely on a browser CORS error to prevent an API effect. A remote sandbox is unavailable, so API Reference does not send sandbox requests.