Sandbox-first · discipline

Source · Dan, 2026-05-27

"Every vendor integration gets its own sandbox surface first. If the round-trip isn't proven there — OAuth, API call, callback, response — it doesn't go near a production credential. That's the discipline."

The problem

Wiring production vendor credentials into a customer-facing surface before the integration is proven is how secrets leak, callback paths misfire, and the integration's true edge-cases ambush the live order path. The opposing risk — building a sandbox surface that no one ever wires up — wastes the dry-run.

The shape

Every vendor integration (Prodigi / Pwinty, Resend, Twilio, Stripe, Canva Connect) gets a self-contained surface at sandbox.gf.cx/<vendor>/ first. That surface holds the sandbox credential, does the full round-trip (OAuth, API call, callback, response inspection), and proves the path end-to-end. Only then does the same code path get promoted to the production surface with the production credential swapped in.

Why a dedicated subdomain

Credential blast radius: sandbox creds live in sandbox.gf.cx's Worker secrets — they never enter the production surface's env.
Experimental wiring is contained: half-built endpoints, debug routes, raw API response dumps — none of it bleeds into the surface a customer sees.
Multi-account ready: the same sandbox can be reused when adding a second account (Dogwood / audreyinc / xlab-co) without rebuilding the dry-run substrate.

Reference implementations

sandbox.gf.cx/print — Prodigi sandbox cockpit. Validated the print-on-demand pipeline (quote → order → fulfillment callback) before print.gf.cx wired production creds. Shipped MVP 2026-05-27.
sandbox.gf.cx/canva — Canva Connect OAuth round-trip cockpit. print.gf.cx's "Design in Canva ↗" button calls into this surface for the design-create → editor → return-to-app → PNG-export flow. Shipped 2026-05-28.

Reusable elements

The named, copyable pieces — lift any rule without the others:

Sandbox subdomain convention — sandbox.gf.cx/<vendor>/ as the canonical address for every dry-run surface; never a path on the production subdomain.
Credential blast-radius isolation — sandbox creds bound to the sandbox Worker's secret store only; the production surface's env is never touched until promotion.
Round-trip proof gate — the full vendor flow (OAuth handshake, API call, webhook/callback, response inspection) must complete successfully in sandbox before any production wiring begins.
Code-path promotion — the same handler code moves from sandbox to production; the only delta is the credential swap (SANDBOX_KEY → PROD_KEY, base URL flip where the vendor requires it).
Multi-account substrate reuse — the sandbox surface doubles as the dry-run for a second account (audreyinc, xlab-co) without rebuilding; accounts share the substrate, secrets are per-account env vars.

Reference

Source: Dan, 2026-05-27 · first applied to the Prodigi print-on-demand integration before shipping print.gf.cx.
In use / example: sandbox.gf.cx — the live subdomain. Each /<vendor>/ path is an independent cockpit proving one integration; view source for the Worker + secret-binding scaffold to copy.
Reusable elements: Sandbox subdomain convention · credential blast-radius isolation · round-trip proof gate · code-path promotion · multi-account substrate reuse (listed above).
Origin: Print-on-demand integration discipline, 2026-05-27 — applied because the Prodigi sandbox and production APIs share an identical surface but use different keys and different fulfillment pipelines.