Sandbox and certification
You do not wait for approval to start building. An application enters sandbox before anyone reviews it, and sandbox runs the real API.
What sandbox is
A client in SANDBOX completes the full OAuth flow, receives real tokens, and calls every endpoint its scopes allow. The only difference is which account it reaches: a seeded test account with listings, calendars, reservations, guests and conversations, rather than a real host's portfolio.
Nothing is mocked and there is no second code path. The seeded account simply has no channel manager connected, no payment processor and no phone number, so the fan-out that a real write would trigger has nowhere to go. You exercise the same handlers a production call does.
Sandbox access tokens live twenty-four hours rather than one, because re-authenticating hourly at a REPL is a bad way to spend an afternoon.
What to build against it
Everything. The authorization flow including refresh and rotation. Every read your product needs. Every write, including the ones that would be expensive to get wrong. Webhook delivery and signature verification. Your error handling, particularly the 429 and insufficient_scope paths, which are the two most integrations get wrong and the two easiest to exercise deliberately.
The seeded account is yours to modify. Break it.
Certification
Moving to production is a short technical review rather than a second queue. Haven checks five things, all of which you can verify yourself against sandbox first.
Signature verification. Your endpoint rejects a delivery with a tampered body and accepts one carrying two valid signatures. Send a test event, then send yourself a modified copy, and confirm the second is refused.
Retry-After. A 429 results in a wait of at least the given interval, plus jitter. Drive yourself into a limit deliberately and watch what your client does.
User-Agent. Every request names your product and a contact address.
Idempotency. Every write carries a key, and the key survives a retry rather than being regenerated inside the loop.
Re-read after webhook. Your handler treats the event as a signal and fetches the resource, rather than writing the payload into your database.
Each of these is a support ticket that will not be filed. That is the whole reason the list is short and specific rather than a general assurance of quality.
Going live
On certification your client moves to APPROVED and real hosts can authorize it.
Sandbox grants do not become production grants. A grant records whether it was created in sandbox, so promoting your client never silently repoints an existing token at real data. Your first production connection is a real host completing the flow.
Roll out gradually. A week with a handful of consenting hosts surfaces the problems that only appear against real portfolios: a listing with sixty photos, a calendar with a linked group, a host whose channel manager owns availability on half their listings. All of these exist in production and none are convenient to seed.
Requesting sandbox
Sandbox credentials are issued when your application is approved for development. Write to info@bookwithhaven.com; see Getting access for what to include.