Get sandbox access

Request sandbox client credentials and a synthetic company/scenario from [email protected]. Create a company key under Settings → API Keys in the appropriate company portal after API access is enabled. Confirm the company, role and environment with your account administrator.

Request	Bearer token	Company key
Token exchange	Not required	Not required
External shipper operations	Shipper scope and environment access	Shipper key (`oway_sk_...`)
External carrier operations	Carrier scope and environment access	Carrier key (`oway_ck_...`)

SDK per-request key arguments are optional because the key may be configured once on the client. External API authorization still requires the company key. The client ID/secret and company key are different credentials.

Environment	Base URL
Sandbox	`https://api.sandbox.oway.io`
Production	`https://api.oway.io`

Set the sandbox URL explicitly. Keep secrets in environment variables, never source control or screenshots. The token exchange request uses clientId and clientSecret; its response uses accessToken, tokenType, and expiresIn. Send the token as Authorization: Bearer ... and the company key as x-oway-api-key on subsequent calls. Cache tokens and refresh before expiry. The SDK does this automatically.

For 401, inspect credentials and token expiry. For 403, inspect role, company-key validity, API enablement and environment access. Repeating the unchanged request will not resolve either error.

Repeatable sandbox setup

For shippers, request a serviceable lane with valid synthetic addresses, a confirmation-ready account and document availability instructions. For carriers, request a pending offer assigned to the test company and permission to progress it through delivery. Obtain a fresh offer for each run. An empty list is not evidence that authentication failed.

Run only against your assigned scenario. Contact support to reset your scenario or request a fresh one. Use a fresh reference and idempotency key for each new shipment. A retry of the same creation must retain its original key and body.