Test with sandboxes
Use Sandbox workspaces, sample patients, and sandbox sources before production.
Use sandboxes to build and operate Medblocks without real patient data. A Sandbox workspace has its own API keys, source catalog, sample patients, webhooks, exports, and dashboard history.
Create a Sandbox workspace
Create a workspace and choose Sandbox as the environment. Sandbox workspaces generate API keys with the mb_sk_sbx_ prefix and only see sandbox-scoped sources.
Use a separate Production workspace when you are ready for live credentials, live patients, and production export destinations.
Load test patients
Open the dashboard Patients page and click Import FHIR data in the header. From the dialog, click Load on the “Seed 10 synthetic patients” row to import a pre-generated Synthea cohort into the active workspace. Or drop your own FHIR bundles into the same dialog for targeted test data. See Load test patient data for the two paths and how to generate your own bundles.
Test dashboard workflows
Use synthetic patients when you need realistic records without PHI. Synthetic records are useful for UI states, mapping logic, exports, and webhook handlers. They should not be used to infer source coverage or production data quality.
Good sandbox checks include:
- Patient lists and patient detail pages.
- Record status and pull history.
- Export destination setup and retry behavior.
- Webhook endpoint setup, event delivery, retries, and redelivery.
- Support workflows such as auth event history.
Test source-specific flows
Some EHR vendors provide public or partner sandbox portals. Their behavior is close enough to test OAuth and SMART on FHIR, but they may not match every production quirk.
When a guide has vendor-specific sandbox details, use that guide:
Prepare for Production
Before switching to production, confirm:
- Your Production workspace exists.
- Production credentials are configured from Configure connections.
- Your return URLs are HTTPS and match the configured apps.
- Webhook signature verification uses the raw request body.
- API keys and webhook secrets live in server-side secret storage.
- Your UI or dashboard workflow handles failed authorization and reconnect prompts.
- Export destinations have been tested with non-production data.