Sandbox

The sandbox is a full copy of the tastytrade API backed by simulated money. Use it to build and test order flow before pointing anything at a real account.

Orders placed in the sandbox never reach a real market. They stay inside the sandbox system.

Base URLs

Everything else about a request is identical: same paths, same payloads, same Authorization and User-Agent header rules. See Auth patterns.

How fills are decided

Sandbox orders are routed to a market simulator, not to a real venue.

Of the fill behaviour described here, only two things were exercised in the sandbox, both by testing: the destination venue on equity fills, and the observations (the AAPL orders below, and the quote-token request under "What the sandbox cannot do"), each dated where it appears. Every rule in the list further down is read from source and was not run.

• Equity fills in orders placed on 2026-08-28 and 2026-10-16 came back with a destination venue of MARKET_SIMULATOR_A. The sandbox is also configured with a second simulator router, MARKET_SIMULATOR_CME; which orders go to it has not been checked.
• The old fixed table (market orders at $1, limit orders filling under or over $3) did not match those AAPL orders. Two market buys filled at prices in the hundreds of dollars, and two limit buys at $1.00 placed on 2026-08-28 while the equity market was open did not fill in the 24 and 56 seconds each was watched.

The rules below are read from the source of tastyworks/market-simulator version 1.20.0, the version the sandbox deployment configuration pins. The version actually running was not confirmed, so check the rules against your own orders. The simulator's README says it does not replicate the venue-specific behaviour of each destination venue.

For symbols outside the scripted list below, the simulator prices an order from the quote it receives for the instrument:

• Orders that fill. The simulator takes the quote's mid price and rounds it to the tick: up for a buy, down for a sell. A limit order is compared with that rounded price, not the raw mid: a buy limit at or above it, or a sell limit at or below it, fills. A market order is priced to meet it. A filled order gets the rounded mid, not your limit price. With a spread of one tick, rounding puts a buy at the ask and a sell at the bid.
• When an order is checked. At 1.20.0 an equity-based order is tried against the current quote when it arrives only inside market hours (or extended hours for an extended-hours order). An order with no equity-based leg, or one that arrives outside those hours, does not fill on arrival.
• Orders that do not fill on arrival. An order with a time in force of immediate-or-cancel or fill-or-kill is cancelled. An order with any other time in force goes to the book, and the book is evaluated when a quote arrives for the instrument. If there is no quote, nothing fills. Day orders are expired at the close.
• Size. The quoted size is the smaller of the bid size and the ask size (the smallest across the legs of a multi-leg order). An order larger than that fills in steps, each priced one tick worse than the last, and reports the average price. A limit order stops stepping at its limit.
• Multi-leg orders. Each leg is priced from its own mid, and the net price is compared with the order's limit.

The source has code for equity-based and futures-based instruments and for multi-leg orders. Only equity fills have been seen in the sandbox. Cryptocurrency orders have not been tested, so do not rely on them filling.

A fixed set of tickers does not use the quote. They follow scripted outcomes (reject, rest, fill, partial fill, cancel) instead, and their fills are priced by a fixed rule: a limit order fills at its own limit price, and a market order fills at a constant price from the simulator's configuration. The configuration lists the equities NAT (reject), TK (rest forever), SWBI (immediate fill), CCRN, GSL, CRON, TPVG, DC, FLGT, NEOG, WGO, PENG, MUX, BGS, IDR and ASTL, and the futures ZZZZZ1 to ZZZZZ11. If you place an order in one of these and the result looks unrelated to the market, this is why.

This page makes no claim about how current the simulator's quotes are. Do not assume they match the live market.

Credentials are separate

Sandbox credentials are a different OAuth application from production, and the two are not interchangeable. A sandbox refresh token cannot mint an access token against production, and a production one cannot against the sandbox.

The failure is uninformative when you get this wrong: every call returns invalid_credentials with nothing indicating the environment is the problem. If you are getting auth errors that make no sense, check which base URL your token was issued for first.

What the sandbox cannot do

• REST market data is not served. /market-data and /market-metrics return HTTP 502 on every route, so quote snapshots, market metrics, historical dividends and earnings reports all fail. Everything else works: instruments, option chains, futures, accounts, balances, positions, transactions, orders, and the dry-run and submission paths.
• Streaming quotes: one observation. On 2026-10-28, for one sandbox account that had a customer record, GET /api-quote-tokens returned a demo-level token and a dxlink-url ending in /delayed, and that feed streamed AAPL quotes. How old those quotes were was not measured. A user without a customer record was not tested. See Streaming market data.
• Net liquidating value history is production-only.
• The environment resets every 24 hours, clearing trades, transactions and positions while leaving users and accounts intact. Do not build a test that depends on state surviving overnight.

Because the REST quote routes do not work in the sandbox, a common pattern is to read market data from production and submit orders to the sandbox, using two sets of credentials.

Getting a sandbox account

Use the sandbox account tool to create a sandbox user and sign in, in your browser. It talks to api.cert.tastyworks.com directly and cannot reach production.

It also creates the customer record and funded account most endpoints need, manages OAuth applications and grants, and carries live account-streamer and market-data demos.

Related

• OAuth2 — creating an application, grants and access tokens.
• Quickstart — first call, end to end.
• Place an equity order — the order path to exercise here.
• Order lifecycle — what the statuses mean.