Build against a sandbox

An agency builds a client’s site in a sandbox organization before the client is a customer. Everything a sandbox serves is real, and every response says so. Your pages are the part ebitex never renders, so they need to say it too: a crawler that finds a preview address will otherwise index it.

The signal

Every response from a sandbox’s Delivery, Forms and Data APIs carries two headers.

Header	Value
X-Ebitex-Sandbox	development while the agency builds, cutover during the short window to test the real domain
X-Robots-Tag	noindex

For an ordinary organization, and for a sandbox that has gone live, neither header is sent. A value this version of a client does not know is read as “not a sandbox”.

In the content SDK

import { createContentClient, sandboxRobots } from '@ebitex/content-sdk'

const client = createContentClient({
  baseUrl,
  apiKey,
  onSandbox: (mode) => console.info('Organization mode:', mode ?? 'live'),
})

const page = await client.resolveLocation('/about')
const robots = sandboxRobots(client.sandbox) // null when there is nothing to add

client.sandbox is the mode the most recent response reported. sandboxRobots returns the <meta> tag and the header your own page should carry, or null. buildSitemapDocuments takes a sandbox option and answers a robots document that disallows everything while it is set, so a sandbox’s sitemap is not offered to crawlers.

The forms SDK exposes the same sandbox property and onSandbox callback. The .NET content client reads the header into Sandbox, and its sitemap builder takes the same option.

What a sandbox does differently

• Marked delivery. The headers above, on every response.
• Held effects. Emails and messages go only to verified addresses of the sandbox’s own people and the agency’s. Webhooks are recorded, with their payloads, and not sent.
• Lower limits and an expiry. A sandbox is time-boxed. When it expires its apps answer 402 with the reason sandbox_expired and nothing is deleted.
• Mapped hosts. A development sandbox may map only preview domains from an allowed list. The real domain can be mapped during the cutover window.

When it goes live

The client takes ownership of the same organization. Ids, keys and content do not change, the headers disappear, and the same code serves a normal site. Keys you created in the sandbox keep working.