---
title: "Get a sandbox key"
description: "Flume issues sandbox keys by request. Email Flume your company, your page origins and your image hosts, and you get back a key for the sandbox."
url: https://docs.tryflume.ai/get-a-key
updated: 2026-11-11
---

# Get a sandbox key

> Flume issues sandbox keys by request. Email Flume your company, your page origins and your image hosts, and you get back a key for the sandbox.

Flume issues sandbox keys by request. Send one email with the details below. There is no sign-up form and no dashboard today.

## Ask for a key

Email support@tryflume.ai with:

```text
Subject: Sandbox key request

Company name:

Your name and work email:

What you are building (iframe, API, or both):

Page origins that will frame the iframe (for example https://app.yourcompany.com, http://localhost:3000):

Image hosts your item photos are served from (for example cdn.yourcompany.com):

Redirect hosts for deep links, if any:
```

## What should you send?

| Detail | Why Flume needs it | Example |
|---|---|---|
| Company name | To name your platform | Acme Design |
| Your name and work email | To send the key | |
| What you are building | Iframe, API, or both | Iframe |
| Page origins | Only these pages may frame the iframe | `https://app.acme.example`, `http://localhost:3000` |
| Image hosts | Flume fetches item photos only from these hosts | `cdn.acme.example` |
| Redirect hosts | A deep link may return the user only to these hosts | `app.acme.example` |

- An origin is a scheme, a host and a port. It has no path and no trailing slash.
- A local origin such as `http://localhost:3000` can be an allowed origin in the sandbox. Ask for it. The port must match exactly.

## What do you get back?

| You get | Notes |
|---|---|
| A sandbox partner key | It starts with `sk_dev_`. Flume cannot show it again. Store it in a secret manager |
| Your partner slug | The short name inside your key and your links |
| The origins and hosts Flume set for you | Check them against what you asked for |

## What happens next?

**Diagram: From a key to live, step by step.** The order to build in. Each step has a page.

```mermaid
flowchart LR
  r1["1. Get a sandbox key / and an allowed origin"]
  r2["2. Start a session / your backend"]
  r3["3. Mount the iframe / tag and host snippet"]
  r4["4. Exchange the code / store the user token"]
  r5["5. Write the saved item / once per save_uuid"]
  r6["6. Close, expiry, errors / every message handled"]
  r7["7. Go-live checklist / in the sandbox"]
  r8["8. Ask for live access / then switch URL and key"]
  r1 --> r2
  r2 --> r3
  r3 --> r4
  r4 --> r5
  r5 --> r6
  r6 --> r7
  r7 --> r8
```

1. Get a sandbox key, and have Flume set your page origin as an allowed origin.
2. Start a session from your backend with POST /start-iframe-session.
3. Mount the iframe on your page: the iframe tag and the host snippet.
4. Exchange the connect code on your backend and store the user access token.
5. Write the saved item, once per save_uuid, and reply to the iframe.
6. Handle close, expiry, the ready timer and errors.
7. Finish the go-live checklist in the sandbox.
8. Ask Flume for live access, then switch the base URL and the key.

1. Flume reads your request and replies by email.
2. You store the key and run the [quickstart](https://docs.tryflume.ai/quickstart/embed.md).
3. After that you rotate and revoke keys yourself. See [Rotate your key](https://docs.tryflume.ai/guides/rotate-keys.md).
4. When your integration works in the sandbox, follow the [go-live checklist](https://docs.tryflume.ai/go-live.md) to ask for live access.

Flume does not publish a response time for key requests.

## What a sandbox key cannot do

- It does not work on live. See [Environments](https://docs.tryflume.ai/concepts/environments.md).
- It cannot change your allowed origins, image hosts or redirect hosts. [Ask Flume](https://docs.tryflume.ai/support.md).