Getting test tokens

Sandbox tokens are static

The flow mirrors the production scenario, but the response always returns the same token pair for your session. Lifetimes: access_token and id_token — 24 hours; refresh_token — 30 days.

Start authorization

GET /authorize checks Code Flow parameters and returns 303 with the /signin form address in the Location header.

client_id

redirect_uri

state

code_challenge (S256)

Derived from the session's code_verifier.

The sign-in form URL will appear here after authorization.

Open the sign-in form

GET /signin returns the test online-bank HTML form and a CSRF token for submitting credentials.

The CSRF token will appear here after receiving the sign-in form.

Sign in using the test online banking form

POST /login submits login, password, and CSRF token. On success, returns 303 with code and state parameters at the Redirect URI.

The authorization code will appear after signing in to the test online bank.

Test account: test_user / sandbox.

Exchange the code parameter for tokens

POST /token. Authorization: Basic from client_id:client_secret.

Tokens will appear here after a successful code exchange.

The code is single-use: a repeated exchange will return invalid_grant.

Refresh tokens with refresh_token

When access_token expires, requests will return 401. Refresh does not require re-authentication.

Refreshed tokens will appear here after the refresh_token request.

All authentication endpoints

Each endpoint is available for independent calls. Click a card to expand request parameters.

Check error handling

These actions add expected errors to the request console.

Next: send ruble payments in ISO 20022 format