API Sandbox

An API integration training platform by NEXUS MOTIVUS LTD. Learners work through guided phases (0–8) with live demos covering REST, auth, webhooks and subscriptions, and can call a versioned learner API with personal tokens.

Live: https://apisandbox-coral.vercel.app

Stack

• Next.js 16 (App Router), React 19, TypeScript, Tailwind CSS 4
• PostgreSQL (Neon) via Prisma; Auth.js (NextAuth v5)
• Stripe (test mode) for subscriptions
• Vitest (unit) and Playwright (E2E, smoke, visual); CI on GitHub Actions, previews on Vercel

Developers

Start here: docs/AGENT_ONBOARDING.md

Doc	Purpose
docs/AGENT_ONBOARDING.md	Setup, verify, project links
docs/NEXUS_ENGINEERING_PRINCIPLES.md	Nexus/MotivusLabs engineering principles and reusable-resource standard
docs/GITFLOW.md	Branching and releases
docs/AGENT_PR_CHECKLIST.md	Pre-PR checks
docs/TEST_USERS.md	Local test credentials
docs/DEPLOYMENT.md	Vercel, env, OAuth, public-schema RLS
infra/self-hosted-ai-runner/README.md	Provision the isolated Linux AI runner

Quick start

npm install
npm run env:local
npm run dev:db:up
npm run db:migrate
npm run db:ensure-test-users
npm run dev

Open http://localhost:4000. Or: npm run local-lite.

Public API (personal tokens)

Create a token on /settings, then call the versioned learner API:

curl -sS -H "Authorization: Bearer apisb_…" http://localhost:4000/api/v1/me

See docs/API_V1.md and GET /api/v1/openapi.json.

Commands

Command	Description
npm run dev	Dev server (port 4000)
npm run build	Production build
npm run verify:ci	Local CI parity before PR
npm run test:unit	Vitest unit tests
npm test	Playwright E2E tests
npm run typecheck	TypeScript
npm run lint	ESLint
npm run openai:key:test	Safely validate an OpenAI API key

Test an OpenAI API key

Run the project tool:

npm run openai:key:test

Paste the key at the hidden prompt and press Enter. Pasted characters are intentionally not displayed. The tool calls OpenAI's read-only model-list endpoint, prints only the HTTP result category, removes the key from the process environment, and never writes it to disk.

The normal command always prompts, even if OPENAI_API_KEY already exists. For CI or another automated environment, explicitly select the environment variable:

npm run openai:key:test -- --env

Use npm run openai:key:test -- --help to print the available modes.

Results:

• HTTP 200: accepted;
• HTTP 401: invalid, revoked, or malformed;
• HTTP 403: recognized but missing permission;
• HTTP 429: recognized but rate-limited or out of quota.

Do not put a literal key in the command, source code, .env files committed to Git, screenshots, chat, or logs. A key that has been exposed must be revoked and replaced.

In-app content

Learning material is in the UI: /dashboard, /phase-0 … /phase-8, /docs/java, /docs/architecture.

Security

Please report vulnerabilities privately. See SECURITY.md.

License

Proprietary. Copyright NEXUS MOTIVUS LTD, all rights reserved. See LICENSE.