# Test environment

Tino does not have a separate test environment (sandbox) for the API yet: every route runs on the customer's real account, services and money. This page describes how to test safely under that condition.

Updated: 2026-10-21.

## Testing with a read-only token

When exploring the API, create a [personal API token](/en/docs/personal-tokens) with only the `…:read` scopes you need, a 30-day expiry, and an IP restriction to the machine you test from. Write routes then return 403 `insufficient_scope` instead of making real changes.

```bash
curl https://api.tino.vn/v1/service -H "Authorization: Bearer $TINO_TOKEN"
```

Revoke the token as soon as you finish testing, at `https://auth.tino.vn/en/me/security`.

## Write routes have real effects

| Action | Real effect |
| --- | --- |
| Ordering or renewing domains, services, SSL certificates | creates an order and an invoice |
| Paying with the balance, paying invoices with the balance | deducts money from the account |
| Topping up | creates a top-up invoice |
| Changing nameservers, editing or deleting DNS records | the domain's website and email change once DNS propagates |
| Starting, stopping, restarting, resetting a VPS | services on the VPS are interrupted |
| Creating or replying to tickets | Tino staff receive and handle them |

Test DNS actions on a domain or zone that no real website uses, or use a `TXT` record with its own name and delete it afterwards.

## Check before you act

- `GET /v1/service/@id/methods`: the actions the service supports, before you call them.
- `POST /v1/service/@id/upgrade` without `send=true`: only calculates the upgrade price; the request is not sent.
- `POST /v1/domain/lookup`: checks whether a domain is available and its price, before you order.

## Running tests without touching a real account

Run a mock server from the [OpenAPI](/en/openapi.json) document (for example with Prism or another OpenAPI tool): routes with complete sample responses have them attached as `example`. The app's tests call the mock; only the final check calls the real API with a read-only token.

## AI assistants through MCP

When you connect Claude or ChatGPT to Tino through [MCP](/en/docs/mcp), keep the ask-before-running mode on for write actions and read the details carefully before approving.