Testing

Test in Sandbox

Verify functional behavior, failure handling, and security controls before submitting an application for Production review.

Happy path

1. 1Create a Sandbox application
2. 2Register an exact localhost or HTTPS test callback
3. 3Enable minimum scopes
4. 4Authorize a verified test identity
5. 5Validate state and exchange the code once
6. 6Validate the ID token
7. 7Call UserInfo
8. 8Verify a signed webhook test

Required negative tests

• Modified or missing state is rejected.
• An unregistered redirect URI is rejected.
• An unsupported or disabled scope is rejected.
• An expired or reused code is rejected.
• A wrong PKCE verifier is rejected.
• Denied or revoked consent does not return data.
• An unavailable claim is omitted.
• A duplicate webhook event produces no duplicate side effect.

Document testing

Configure the exact country and document types in Identity access. Confirm the collection contains only eligible documents, references cannot cross applications, and disabled documents stop resolving.

Sandbox boundary

Request Production

Complete website, support, terms, privacy, redirect, credential, and webhook requirements. Production applications—especially those requesting full document numbers—must be approved by UnifyID administrators.