Skip to main content
Question

sandbox grant entitlement via REST - secret v sandbox keys?

  • February 23, 2026
  • 1 reply
  • 13 views
L
Forum|alt.badge.img+8

I am trying to grant an entitlement - by testing in dev from my server, expecting the Sandbox to be granted the entitlement.  However, nothing seems to achieve this:

  • communicate with customer records & items via Secret API keys - starts with sk_***
  • use the Sandbox API key to make the purchase - starts with rcb_sb_***
  • if I use the Sandbox key as Bearer for REST api, like customer look ups it fails.  OK, use the Secret key for everything except purchase.  But then using the Sandbox key to purchase it fails.
  • RevenueCat webhook received:
{

  eventId: '***-***',
  eventType: 'NON_RENEWING_PURCHASE',
  appUserId: '***-***',
  environment: 'PRODUCTION',
  productId: 'rc_promo_entitlement_custom'
}

 

What do I need to do to grant an entitlement in a sandbox?

 

 

1 reply

erik-macinnis
RevenueCat Staff
Forum|alt.badge.img+1
  • erik-macinnis
  • RevenueCat Staff
  • February 25, 2026

Hi there,

I’m Erik, happy to help.

For our REST APIs (v1 and v2), you should always use your Secret API key. The same secret key works for both sandbox and production. Some endpoints include an environment parameter if you need to specify sandbox explicitly.

The rcb_sb_ key is a Web Billing sandbox key and is meant to be used with the Web SDK. It cannot be used as a Bearer token for REST API calls, which is why those requests fail.

To grant an entitlement in sandbox, this is typically done by making a sandbox purchase through either:

  • A dev build on iOS or Android, or

  • The Web SDK using the rcb_sb_ key

If you can share how you’re triggering the purchase, that will help narrow down why the webhook environment is showing as Production.

Thanks,

Erik - Developer Support Engineer

Erik MacInnis
Terms & ConditionsCookie settingsAccessibility statement