API Sandbox
An API integration training platform by NEXUS MOTIVUS LTD. Learners work through guided phases (0–8) with live demos covering REST, auth, webhooks and subscriptions, and can call a versioned learner API with personal tokens.
Live: https://apisandbox-coral.vercel.app
Stack
- Next.js 16 (App Router), React 19, TypeScript, Tailwind CSS 4
- PostgreSQL (Neon) via Prisma; Auth.js (NextAuth v5)
- Stripe (test mode) for subscriptions
- Vitest (unit) and Playwright (E2E, smoke, visual); CI on GitHub Actions, previews on Vercel
Developers
Start here: docs/AGENT_ONBOARDING.md
Quick start
npm install
npm run env:local
npm run dev:db:up
npm run db:migrate
npm run db:ensure-test-users
npm run dev
Open http://localhost:4000. Or: npm run local-lite.
Public API (personal tokens)
Create a token on /settings, then call the versioned learner API:
curl -sS -H "Authorization: Bearer apisb_…" http://localhost:4000/api/v1/me
See docs/API_V1.md and GET /api/v1/openapi.json.
Commands
| Command | Description |
|---|
npm run dev | Dev server (port 4000) |
npm run build | Production build |
npm run verify:ci | Local CI parity before PR |
npm run test:unit | Vitest unit tests |
npm test | Playwright E2E tests |
npm run typecheck | TypeScript |
npm run lint | ESLint |
npm run openai:key:test | Safely validate an OpenAI API key |
Test an OpenAI API key
Run the project tool:
npm run openai:key:test
Paste the key at the hidden prompt and press Enter. Pasted characters are intentionally not displayed. The tool calls OpenAI's read-only model-list endpoint, prints only the HTTP result category, removes the key from the process environment, and never writes it to disk.
The normal command always prompts, even if OPENAI_API_KEY already exists. For CI or another automated environment, explicitly select the environment variable:
npm run openai:key:test -- --env
Use npm run openai:key:test -- --help to print the available modes.
Results:
HTTP 200: accepted;HTTP 401: invalid, revoked, or malformed;HTTP 403: recognized but missing permission;HTTP 429: recognized but rate-limited or out of quota.
Do not put a literal key in the command, source code, .env files committed to Git, screenshots, chat, or logs. A key that has been exposed must be revoked and replaced.
In-app content
Learning material is in the UI: /dashboard, /phase-0 … /phase-8, /docs/java, /docs/architecture.
Security
Please report vulnerabilities privately. See SECURITY.md.
License
Proprietary. Copyright NEXUS MOTIVUS LTD, all rights reserved. See LICENSE.
