A2A InstaPay Sandbox data sheet
Tenant API v1.1. Generated 2026-10-16. A2A InstaPay (Fintechnology Asia Pacific Lanka Ltd, licensed to FINAP USA LLC).
Addresses
| API base URL | https://sandbox.a2ainstapay.com |
|---|---|
| Access tokens | POST https://sandbox.a2ainstapay.com/oauth/token |
| Web SDK | https://sandbox.a2ainstapay.com/v1/a2a-link.js |
| Bank-linking simulator | https://sandbox.a2ainstapay.com/plaid-sim/link-initialize.js |
| Developer portal | https://sandbox.a2ainstapay.com/portal/ |
| Status | https://sandbox.a2ainstapay.com/status |
Content security policy for your web app
Allow the sandbox domain https://sandbox.a2ainstapay.com in script-src and connect-src, and in frame-src for the bank-linking simulator. In production, use the A2A InstaPay domains issued with your production credentials, and Plaid's domains.
Credentials
Issued in the developer portal for each workspace: client ID (cli_sbx_), client secret (sk_sbx_), SDK key (pk_sbx_) and webhook signing secrets (whsec_). Keep the client secret and signing secrets on your servers only.
Webhook source addresses
Webhooks are sent from the sandbox's hosting network. Contact developer support if your firewall needs the addresses.
Codes and PINs
| One-time code | 123456 |
|---|---|
| PIN rule | Six digits, not a repeated or simple sequence such as 111111 or 123456. |
| PIN lockout | 10 incorrect attempts in one hour lock the PIN for one hour. |
| PIN after automatic completion | 135790 |
Consumer identity
| SSN or ITIN ending 2222 | in_review: Identity needs manual review |
|---|---|
| SSN or ITIN ending 3333 | rejected: Identity not verified |
| SSN or ITIN ending 4444 | in_review: Potential sanctions match |
| Mobile number ending 0199 | in_review: Recent SIM swap; the new-device check is also refused |
| Any other SSN | approved: Identity verified |
Business identity
| EIN ending 9999 | rejected |
|---|---|
| EIN ending 0000 | in_review |
| Industry in the enhanced review list | in_review |
| Industry in the prohibited list | rejected at once |
| An owner with an SSN ending 3333 | rejected |
| Any other EIN | approved |
Test banks
Credentials: user_good / pass_good.
| First Community Bank | Passes every check |
|---|---|
| Summit National Bank | Uses its own sign-in (OAuth); passes every check |
| Harbor Savings Bank | Account holder name does not match; held for ownership review |
| Prairie Credit Union | Cannot receive a Request for Payment; withdrawals only |
| Old Mill Bank | Not reachable by RTP; link fails |
| Lakeside Bank | Account already linked by another customer; link fails |
Amounts
| Cents ending 01 | Loads and pay by bank: failed: declined_by_customer. Withdrawals: settled. |
|---|---|
| Cents ending 02 | Loads and pay by bank: failed: request_expired. Withdrawals: settled. |
| Cents ending 03 | Loads and pay by bank: failed: rejected_by_bank. Withdrawals: failed: rejected_by_bank. |
| Cents ending 04 | Loads and pay by bank: no answer: rail exception after 24 hours. Withdrawals: no answer: rail exception after 24 hours. |
| Cents ending any other | Loads and pay by bank: settled or completed. Withdrawals: settled. |
The sandbox simulates money movement, banks and identity checks. Never enter real personal information.