Sandbox

A free public test key that runs the whole API and MCP server against a simulator. No account, no signup, nothing real ever sent.

The sandbox is the full Blue Reacher API answered by a simulator. Requests are validated exactly like production and replies have the production shape, but no message is sent, no contact is touched and no line is used.

You do not need an account to use it. This key is public and works right now:

Public sandbox key

brk_test_Dc815ar0WQChF5odYSeB8k2ovmVf1zG2

Every curl in the API reference already carries this key, so any example you copy runs as-is.

Try it in 30 seconds

Paste this into a terminal:

curl -X POST https://api.bluereacher.com/v1/messages \
  -H "Authorization: Bearer brk_test_Dc815ar0WQChF5odYSeB8k2ovmVf1zG2" \
  -H "Content-Type: application/json" \
  -d '{ "to": "+13035550101", "message": "hello sandbox", "send_mode": "instant" }'

{
  "success": true,
  "message_id": "sim_i_1790520003126_ej41en",
  "mode": "instant",
  "status": "dispatched",
  "device_id": "00000000-0000-4000-a000-00000000s1m1",
  "sandbox": true
}

Then track it with the id you got back:

curl https://api.bluereacher.com/v1/status/sim_i_1790520003126_ej41en \
  -H "Authorization: Bearer brk_test_Dc815ar0WQChF5odYSeB8k2ovmVf1zG2"

The quickstart walks the rest of the loop: conversations, lines, the instant lane and webhooks.

How to tell you are in the sandbox

Every response body carries "sandbox": true.
Every response carries the header X-BlueReacher-Sandbox: true.
Message ids start with sim_.
The line on every reply is named "Sandbox line (simulated)".

A live key returns none of these, so simulated traffic can never be mistaken for real traffic.

What the simulator covers

Surface	In the sandbox
Sending, both lanes, groups, voice memos	Simulated with production shapes
`GET /v1/status/{id}`	Progresses on a timer: drip goes `pending` then `sent` after about 5 seconds, instant goes `sent` then `delivered` after about 10 seconds
Conversations, lines, contacts, capability, opt-outs, signals	Simulated with realistic data
`/v1/usage`	A fixed sample
Calling (`/v1/calling-lines`, `/v1/calls`)	Simulated, never dials
MCP server	Every tool, simulated
Conversation history (`GET /v1/conversations/{contact_id}/messages`)	Needs a live key: `403 sandbox_key_not_supported_here`
Call settings	Needs a live key: `403 live_key_required`

Validation is faithful. A number that is not E.164, a tapback longer than one character, or a missing field fails in the sandbox exactly as it would live:

{ "error": "to must be E.164 format e.g. +13035550101", "error_code": "invalid_phone", "sandbox": true }

Test webhooks

A test key can register a webhook and fire a simulated inbound reply at it. Blue Reacher signs the message.received event with your secret and delivers it the way production does. The steps are in Webhooks.

The public key works for this. Each URL you register gets its own slot and its own secret for 30 days, identified by the webhook_id the registration returns, so another reader registering their own URL never touches yours. Pass that webhook_id when you fire the simulated reply.

Try it from an AI assistant

The sandbox key works on the MCP server too. One command connects Claude Code to a simulated account you can talk to:

claude mcp add --transport http bluereacher https://api.bluereacher.com/v1/mcp \
  --header "Authorization: Bearer brk_test_Dc815ar0WQChF5odYSeB8k2ovmVf1zG2"

Then ask it to check whether a number takes iMessage, send a test message, or read a thread. Setup for Cursor, Claude Desktop and other clients is on the MCP server page.

Limits of the shared key

Rate limits are per key, so everyone using the public key shares them: 60 requests a minute across /v1, 10 a minute for instant sends. The X-RateLimit-Remaining header shows what is left.
A test key is bound to no workspace, so it can never read or write real data.

Going live

Swap the brk_test_ key for your brk_live_ key. Routes, bodies and error codes stay the same. Your live key and a private test key are issued during onboarding; see Authentication.