Linque Testing
The sandbox at https://api.btsandbox.com/linque sends real codes to real United States numbers through the same provider as production. It also reserves a set of numbers that are never messaged, so an automated test needs no phone.
Reserved Numbers
| Number | Behavior |
|---|---|
+14155551212 | No SMS is sent and sms_sent is false. The code is always 123456 |
+14155550100 to +14155550199 | The same, one hundred of them, so parallel runs can each take their own |
The send limit applies to each reserved number: three sends per five minutes, resends included. Rotate numbers rather than wait.
| Code | Submitting it |
|---|---|
123456 | Accepted. Verifies the phone and returns the test wallet. A code is single use, so submitting it again answers 410 with type: "verification_code_expired" |
000000 | Always 410 with type: "verification_code_expired" |
| Any other | Always 403 with type: "verification_code_invalid" |
Test Wallet
The sandbox discovers the same wallet for every verified shopper, whatever name and number are entered. It comes from the discovery provider's development environment, so the names and last four digits can change without notice. These are the cards it returned on November 4, 2026.
| Card | network | last4 | Security code | Verifying it |
|---|---|---|---|---|
| Chase Credit Card | visa | 7234 | 878, three digits | Returns a card token |
| Apple Card | mastercard | 0000 | Three digits, none documented | 403 with type: "security_code_invalid". Spends an attempt |
| American Express Credit Card | amex | 0988 | Four digits, none documented | The same, with a four-digit field |
| PayPal - Credit Cards | null | 9544 | Three digits, none documented | The same |
| Barclays Bank Credit Card | null | 8382 | Three digits, none documented | The same |
| Discount Tire Credit Card | null | 5823 | Three digits, none documented | The same |
| Wells Fargo Credit Card | visa | 0332 | Three digits, none documented | The same |
Every card has requires_security_code: true. issuer and art_url are null on all of them and network is null on three, so the sandbox exercises a wallet without artwork and cards whose network is unknown. Size the field from security_code_length.
The provider documents a code for the Chase card only. The other cards refuse it, so they are the way to reach the invalid and exhausted outcomes. An incorrect security code spends one of the three attempts on that card, as in production, and the third answers 429 with type: "security_code_attempts_exhausted".
A card that cannot be verified is a normal checkout outcome rather than an integration failure. Running out of security-code attempts on one card also leaves the rest of the wallet available.
Tokens
A verified card becomes a real card token in your sandbox tenant, created by your application, holding the provider's test card. The Chase card becomes a Visa credit card with BIN 42424229, last four 7234 and expiration 03/2028. Read it, proxy it and charge it against your processor's sandbox as you would any Basis Theory token. Whether the processor's sandbox accepts the test card is up to the processor.