docs: document Global Account sandbox magic values

[pengying]

Adds a new shared snippet listing the four sandbox magic values that
unblock the embedded-wallet auth flows without real Turnkey/WebAuthn/
OIDC plumbing, and wires it into the four product-area sandbox-testing
pages (payouts-and-b2b, ramps, rewards, global-p2p):

Value	Where it goes	Used by
000000	request body otp	POST /auth/credentials/{id}/verify (EMAIL_OTP)
sandbox-valid-oidc-token	request body oidcToken	POST /auth/credentials (OAUTH create) and verify (OAUTH)
sandbox-valid-passkey-signature	request body assertion.signature	POST /auth/credentials/{id}/verify (PASSKEY)
sandbox-valid-signature	HTTP header Grid-Wallet-Signature	All signed-retry flows + /quotes/{id}/execute on EMBEDDED_WALLET

Includes integrator notes on JWT-shape requirement for OAUTH create,
the 401 error responses on a wrong magic value, that these are
sandbox-only, and that clientPublicKey is still required on every
verify (magic values bypass credential checks, not HPKE plumbing).

Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
Grid	🟢 Ready	View Preview	Apr 28, 2026, 12:43 AM

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
grid-flow-builder	Ready	Preview, Comment	Apr 28, 2026 0:58am

[pengying]

• docs: document Global Account sandbox magic values #405 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

Greptile Summary

This PR adds a new shared Mintlify snippet (sandbox-global-account-magic.mdx) documenting four magic values that bypass credential checks in the sandbox, and wires it into the five sandbox-testing pages via imports. The structure and placement are consistent with other sandbox snippets, and the coverage of all four auth flows (EMAIL_OTP, PASSKEY, OAUTH, wallet signature) is accurate — with one exception:

• OAUTH create contradiction: line 48 of the snippet says sandbox-valid-oidc-token works on "both" POST /auth/credentials (create) and verify, but the Note directly below states it does not work for create and requires a properly JWT-shaped token. A developer following the first sentence will hit an unexplained 401 on the create call.

Confidence Score: 3/5

The P1 contradiction in the OAUTH section will cause integrators to get a 401 error if they follow the opening sentence for OAUTH create; should be fixed before publishing.

One P1 finding (contradictory statement about which endpoint sandbox-valid-oidc-token is valid for) that will actively mislead developers, plus one P2 style note. The five consumer pages are all clean.

mintlify/snippets/sandbox-global-account-magic.mdx — specifically the OAuth (OIDC) token section around line 48.

Important Files Changed

Filename	Overview
mintlify/snippets/sandbox-global-account-magic.mdx	New shared snippet documenting four sandbox magic values; the OAUTH section has a direct contradiction — the opening sentence claims the magic value works for both create and verify, while the inline Note correctly states it only works for verify.
mintlify/api-reference/sandbox-testing.mdx	Adds import and section for the new Global Account magic values snippet; change is minimal and correct.
mintlify/payouts-and-b2b/platform-tools/sandbox-testing.mdx	Adds import and section for the magic values snippet; placement before "Sandbox Limitations" is appropriate.
mintlify/ramps/platform-tools/sandbox-testing.mdx	Adds import and section for the magic values snippet; placement before "Moving to Production" is appropriate.
mintlify/rewards/platform-tools/sandbox-testing.mdx	Adds import and section for the magic values snippet; placement before "Sandbox Limitations" is appropriate.
mintlify/global-p2p/platform-tools/sandbox-testing.mdx	Adds import and section for the magic values snippet; placement before "Production vs Sandbox" is appropriate.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Sandbox Auth Request] --> B{Credential Type}
    B -- EMAIL_OTP --> C[body otp - magic OTP code]
    B -- PASSKEY --> D[assertion.signature - magic passkey value]
    B -- OAUTH create --> E[body oidcToken - must be JWT-shaped]
    B -- OAUTH verify --> F[body oidcToken - magic OIDC value]
    B -- Signed retry --> G[Grid-Wallet-Signature header - magic sig value]
    C --> H[Skips OTP delivery check]
    D --> I[Skips WebAuthn signature check]
    E --> J[Skips OIDC signature verification]
    F --> J
    G --> K[Skips wallet signature check]

Loading

Prompt To Fix All With AI

This is a comment left during a code review.
Path: mintlify/snippets/sandbox-global-account-magic.mdx
Line: 48

Comment:
**Contradictory claim about OAUTH create magic value**

The opening sentence says `sandbox-valid-oidc-token` works on **both** `POST /auth/credentials` (OAUTH create) and verify, but the Note immediately below corrects this and states it does **not** work for create — a properly structured JWT is required there. A developer reading the first sentence and using the magic value for the create call will get a `401 UNAUTHORIZED` without any obvious reason until they read the Note carefully.

Consider updating the opening sentence to be accurate upfront, for example:
```suggestion
Pass `sandbox-valid-oidc-token` as the body `oidcToken` on `POST /auth/credentials/{id}/verify` (OAUTH). For `POST /auth/credentials` (OAUTH create), you must supply a JWT-shaped token — see the note below.
```

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: mintlify/snippets/sandbox-global-account-magic.mdx
Line: 50-60

Comment:
**Missing curl example for OAUTH create flow**

The section states the magic value applies to both `POST /auth/credentials` (OAUTH create) and verify, but only provides a curl example for the verify endpoint. Given that the Note flags a meaningful gotcha for the create path (requiring a JWT-shaped token), a companion example showing how to construct the dummy JWT for create would substantially help developers avoid confusion.

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "docs: restructure Global Account magic v..." | Re-trigger Greptile}

[greptile-apps]

Contradictory claim about OAUTH create magic value

The opening sentence says sandbox-valid-oidc-token works on both POST /auth/credentials (OAUTH create) and verify, but the Note immediately below corrects this and states it does not work for create — a properly structured JWT is required there. A developer reading the first sentence and using the magic value for the create call will get a 401 UNAUTHORIZED without any obvious reason until they read the Note carefully.

Consider updating the opening sentence to be accurate upfront, for example:

Suggested change

	Pass `sandbox-valid-oidc-token` as the body `oidcToken` on both `POST /auth/credentials` (OAUTH create) and `POST /auth/credentials/{id}/verify` (OAUTH).
	Pass `sandbox-valid-oidc-token` as the body `oidcToken` on `POST /auth/credentials/{id}/verify` (OAUTH). For `POST /auth/credentials` (OAUTH create), you must supply a JWT-shaped token — see the note below.

Prompt To Fix With AI

This is a comment left during a code review.
Path: mintlify/snippets/sandbox-global-account-magic.mdx
Line: 48

Comment:
**Contradictory claim about OAUTH create magic value**

The opening sentence says `sandbox-valid-oidc-token` works on **both** `POST /auth/credentials` (OAUTH create) and verify, but the Note immediately below corrects this and states it does **not** work for create — a properly structured JWT is required there. A developer reading the first sentence and using the magic value for the create call will get a `401 UNAUTHORIZED` without any obvious reason until they read the Note carefully.

Consider updating the opening sentence to be accurate upfront, for example:
```suggestion
Pass `sandbox-valid-oidc-token` as the body `oidcToken` on `POST /auth/credentials/{id}/verify` (OAUTH). For `POST /auth/credentials` (OAUTH create), you must supply a JWT-shaped token — see the note below.
```

How can I resolve this? If you propose a fix, please make it concise.

[greptile-apps]

Missing curl example for OAUTH create flow

The section states the magic value applies to both POST /auth/credentials (OAUTH create) and verify, but only provides a curl example for the verify endpoint. Given that the Note flags a meaningful gotcha for the create path (requiring a JWT-shaped token), a companion example showing how to construct the dummy JWT for create would substantially help developers avoid confusion.

Prompt To Fix With AI

This is a comment left during a code review.
Path: mintlify/snippets/sandbox-global-account-magic.mdx
Line: 50-60

Comment:
**Missing curl example for OAUTH create flow**

The section states the magic value applies to both `POST /auth/credentials` (OAUTH create) and verify, but only provides a curl example for the verify endpoint. Given that the Note flags a meaningful gotcha for the create path (requiring a JWT-shaped token), a companion example showing how to construct the dummy JWT for create would substantially help developers avoid confusion.

How can I resolve this? If you propose a fix, please make it concise.