# Testing

Use sandbox credentials and sandbox Yanez URLs for all integration testing.

## Suggested Test Plan

| Area | Test |
| --- | --- |
| Request signing | Valid signed request succeeds. |
| Request signing | Missing signature returns `401`. |
| Request signing | Reused nonce returns `401`. |
| Request signing | Body changed after signing returns `401`. |
| Record validation | Existing `yid` returns `yid_valid: true`. |
| Record validation | Missing `yid` returns `yid_valid: false`. |
| Record validation | Bound public key returns `public_key_valid: true`. |
| Record validation | Wrong public key returns `public_key_valid: false`. |
| Platform flow | User can complete the flow from the partner app. |
| Platform flow | Cancellation and retry are handled cleanly. |
| Key rotation | New key can be activated before old key is revoked. |

## Sandbox Data

Yanez will provide or approve sandbox test identities during onboarding. Do not
use production user data in sandbox.

## Logging

Log these values on the partner backend:

- request path
- partner request id
- `kid`
- Yanez response status
- Yanez `event_id` or partner correlation id when available

Do not log private keys, signatures, full biometric payloads, or sensitive user
data.