Claimable sandboxes: Frictionless Stripe accounts for agents

Stripe now gives out working test accounts without a sign-up, because a coding agent can build a payment integration in minutes and signing up had become a noticeable delay. A claimable sandbox is a full Stripe sandbox, the isolated test environment with test API keys that normally comes after registering, created without an account. The user registers only once the integration works, and the sandbox, with its test payments and other objects, is attached to a new or existing account. Stripe's engineering post, by Mathew Varughese, says it designed this with platforms such as Vercel, Replit and Lovable, and offers it through an API for those platforms, in Stripe's docs, and as a CLI command, stripe sandbox create, built for agents.

Most of the post is about handing out free, unauthenticated keys, served by Stripe's production infrastructure at more than 50,000 sandboxes a day, without adding latency, piling up cost or inviting abuse. Sandboxes come from a pool created in advance, so requests don't wait the few seconds provisioning takes, and unclaimed ones are deleted after a set time so test data doesn't pile up. The CLI and API require an email address, which Stripe shows during the claim to make phishing with collected sandboxes harder, and the keys are a new type with their own rate limits. The CLI couldn't use a browser captcha, so it must solve a proof-of-work puzzle: the server sends a random salt and a hash of that salt combined with a secret number, the CLI tries numbers until one produces the same hash, and the server checks the answer. A larger secret number takes longer to find, and Stripe raises it based on server load and fraud signals tied to the email, which slows bulk requests without a pop-up. Stripe reports that thousands of users a day turn a sandbox into a real account and that more than 100,000 businesses have started this way.