> This is the Markdown version of the page. For the complete Lattice Developers documentation index, fetch https://developer.anduril.com/llms.txt. Append .md to any page URL for its clean Markdown.

# Lattice Sandboxes

> Setting up an environment in Lattice Sandboxes

Lattice Sandboxes is a secure, isolated platform for creating environments with simulated data to develop and
test your Lattice SDK app. Apps developed on Sandboxes are portable and can be used in other Lattice
deployments based on your environment requirements.

> **Pricing**
>
> Lattice Sandboxes environments are provided free of charge.
> You can make an unlimited number of free API calls to your
> environment to create, stream, and task entities in Lattice.

## Before you begin

* If you don't have access to Lattice Sandboxes, [request to join the Lattice SDK developer program](https://dashboard.developer.anduril.com).

## Sign in

Anduril uses Okta to authenticate access to Lattice Sandboxes. Multi-factor authentication (MFA)
is satisfied with a passkey, such as a browser passkey, operating system biometrics, or a physical FIDO/UBI security key.

> **Browser support**
>
> Use Chrome or a Chromium-based browser, such as Microsoft Edge or Brave, to access the Lattice Sandboxes developer portal.
> Firefox is not supported and will prevent you from completing the sign-in procedure.

If this is your first time signing in, activate your Okta account and register a passkey:

Open the welcome email and choose the **Activate Okta Account** link.
The link expires seven days after the email is sent.

On the **Set up security methods** page, next to **Password**,
choose **Set up**, then choose and confirm a password.

Next to **Security Key or Biometric Authenticator**, choose **Set up**,
then register one of the following passkey options:

* **Browser passkey**: Stored by your browser's password manager so that you can sign in from any device signed in to the same browser profile.
* **Operating system biometrics**: Uses Touch ID, Face ID, Windows Hello, or another built-in platform authenticator bound to the current device.
* **Physical FIDO or UBI key**: Uses a hardware token such as a YubiKey, which you can carry with you between devices.

To sign in after activation, do the following:

Open the [Lattice Sandboxes sign-in page](https://login.developer.anduril.com).

For **Username**, enter the email address that you used to request access to the Lattice Developer program.

For **Password**, enter the password you created during activation.

Complete the passkey challenge using the authenticator method you registered.
On success, Okta redirects you to the Lattice Sandboxes dashboard.

> **Info**
>
> To manage your passkeys and password, visit `https://login.developer.anduril.com/account-settings/home`.
> If you lose access to your passkey, reach out to `lattice-developers@anduril.com` for assistance.

After logging in, the dashboard displays all existing environments associated with your account
and the status of each environment.

## Create an environment

To create a new environment, open the [Environment Catalog](https://sandboxes.developer.anduril.com/idee/environments/catalog),
then do the following:

Choose **New Environment**.

![Shows an empty list of environments](/_fern-img/50acdfa5596cba9813763367a61c168ee58a82776b25d4ac1fafda0053e9d5ac.webp)

On the **Environment Catalog** page, choose **Lattice** and click **Create**. You'll be redirected to the environment
creation details page, where you see the status of your environment:

![Shows the environment details page](/_fern-img/50b68edbbda8e34fb5b1e6c4fd0db6e979e833aaacd497b965af21c3b7a7a11f.webp)

Once the state changes to **Ready**, review the following details:

**`Resource Endpoint`**

Use this to launch the Lattice UI or connect to Lattice programmatically.

---

**`Lattice Client ID`**

Use the client ID to authorize your integration with the Lattice SDK.

---

**`Lattice Client Secret`**

Use the client secret to authenticate your integration with the Lattice SDK.

---

**`Lattice User`**

The user name you use to log in to the Lattice UI.

---

**`Lattice Password`**

The password you use to log in to the Lattice UI.

---

**`Lattice Auth Token`**

This is your **environment token**. Save this token in addition to the
[Sandboxes token](/guides/developer-tools/sandboxes#set-up-credentials), to authenticate your requests with the Lattice API.

---

Confirm you have access to your environment by clicking the Lattice URL link, then log in using the provided user name and password.

> **Restrictions**
>
> * Create up to **2** concurrent environments in Sandboxes.
> * Environments have a maximum lifetime of **12 hours**.
> * Environments have a maximum idle lifetime of **2** hours. You must make a
>   network call, or sign in to the Lattice UI to keep your environment active.
> * Access tokens obtained using client credentials have a lifetime of 30 minutes.

## Set up credentials

To query your Sandboxes environment, you will need:

* **Sandboxes token** (`anduril-sandbox-authorization` header) -- This is your account-level authorization token, because the Sandboxes Proxy uses it to verify your account before forwarding requests to your environment.
  Create this token once, then use it to access all of your environments.
* **Environment token** (`authorization` header) -- This is the long-lived, static bearer token your integration uses to authenticate with the environment, because it lets you call Lattice directly without a token exchange.
  Your environment token is the **Lattice Auth Token** shown on the environment details page after [creating a new environment](/guides/developer-tools/sandboxes#create-an-environment).

If you use OAuth 2.0 client credentials instead of an environment token, you also need your **Lattice Client ID** and **Lattice Client Secret**, because your integration exchanges them for a short-lived access token.
Both are automatically generated when [creating a new environment](/guides/developer-tools/sandboxes#create-an-environment).

Your Sandboxes token and an environment credential -- an environment token, or a Client ID and Secret -- are required at runtime to interact with Lattice Sandboxes.
The **Sandboxes Proxy** verifies your Sandboxes token, then forwards the request to your environment.

![Diagram showing the authorization flow for Lattice Sandboxes.](/_fern-img/aff262eaf9f72a8e3e87f59fd6d5db7d5e948bd30bc3e0483a98e22f6d6c61fa.webp)

---

To create a new Sandboxes token, do the following:

Open the [Account & Security](https://sandboxes.developer.anduril.com/user-settings) page in Sandboxes portal, not the Lattice environment. This token can be used for all environments for the life of the token.

In the **Bearer tokens** section, click **+ New Token**:

![Shows the Account & Security page where you can create, and manage, your
authorization tokens.](/_fern-img/f9fc9ebcfe81ab1f18459a58d0e220ae9f3af95240b817d8b02166f1a897a27e.webp)

On the **Create Bearer Token** modal, enter the following:

* **Bearer token name** -- Enter a descriptive name for your Sandboxes token.
* **Bearer token expiration** -- Select an expiration time frame.

Click **Create** to generate a Sandboxes token, then save your Sandboxes token.

> **Warning**
>
> After this step, the Sandboxes token will not be visible again.

To authenticate API requests to your Sandboxes environment, choose an authentication method:

#### Environment token

Use the **Lattice Auth Token** from your environment details page as a long-lived, static bearer token. Export it as an environment variable:

```bash
export ENVIRONMENT_TOKEN="<YOUR_LATTICE_AUTH_TOKEN>"
```

Pass the token in the `Authorization` header to interact with Lattice:

```bash
curl -X GET https://$LATTICE_ENDPOINT/api/v1/objects \
     -H "Authorization: Bearer $ENVIRONMENT_TOKEN" \
     -H "Anduril-Sandbox-Authorization: Bearer $SANDBOXES_TOKEN"
```

> **Token rotation**
>
> The environment token is long-lived but eventually expires. Rotate the token before it
> expires to avoid interrupting your integration.

#### Client credentials

Obtain a short-lived access token using the **Lattice Client ID** and **Lattice Client Secret**.

> **Info**
>
> If your environment page doesn't display a **Lattice Client ID** or **Lattice Client Secret**, under "Resource Credentials," contact your Anduril representative.

Send a `POST` request with the `client_id` and `client_secret` to the `/api/v1/oauth/token` endpoint.

```
curl --request POST "https://$LATTICE_ENDPOINT/api/v1/oauth/token" \
        --header "Anduril-Sandbox-Authorization: Bearer $SANDBOXES_TOKEN" \
        --header "Content-Type: application/x-www-form-urlencoded" \
        --data-urlencode "grant_type=client_credentials" \
        --data-urlencode "client_id=$LATTICE_CLIENT_ID" \
        --data-urlencode "client_secret=$LATTICE_CLIENT_SECRET" 

```

If the request is successful, you will receive a <code>**200**</code> status response. The body will contain the following data:

```json
{
    "access_token" : "*****",
    "expires_in" : 1800,        // seconds
    "scope": "lattice"
}
```

Export the `access_token` as an environment variable.

```
export ENVIRONMENT_TOKEN="*****" 
```

You can now use the `access_token` as the Authorization token to interact with Lattice.

```
curl -X GET https://$LATTICE_ENDPOINT/api/v1/objects \
     -H "Authorization: Bearer $ENVIRONMENT_TOKEN" \
     -H "Anduril-Sandbox-Authorization: Bearer $SANDBOXES_TOKEN"        
```

> **Token refresh**
>
> The `access_token` returned will only be valid for the value of `expires_in`, in seconds. If you're accessing the SDK through the REST clients, the
> clients will automatically manage refresh for you. If you are interacting with the SDK using gRPC or cURL, you will have to manage the token refresh
> based on the `expires_in` property.

## What's next?

* Test your new environment by running the [Quickstart](/guides/getting-started/quickstart) guide.
* Install the [Lattice SDK](/guides/getting-started/set-up) for a protocol and language of your choice to get started developing with Lattice.

> Setting up an environment in Lattice Sandboxes