Securing 2M+ accounts & $15B+ in assets, protected & secure·B5 Secure™ — per data-element authorization for .NET platforms
Start free

Test Mode

Step 2

Test Mode

Test Mode is a sealed rehearsal room. It must never accept production data, production credentials, or production callbacks. Use it to validate happy paths and failure paths before staging.

Test-mode components

Postman collectionRequests for health, decision, evidence, and webhook simulation.Open →Postman environmentPlaceholder variables for base URL, tenant, application, key ID, and secret.Open →Bash first callCommand-line request template for macOS, Linux, and WSL.Open →PowerShell first callWindows and LocalWP-friendly request template.Open →Test configurationEnvironment-safe configuration template with no real secret values.Open →

Exercise failure paths

Expired timestampVerify stale signatures fail closed.Open →Replay attemptSubmit the same nonce twice and require deterministic rejection.Open →Wrong audienceBind a request to an unintended API and require denial.Open →Missing scopeRequest an action outside the application grant.Open →Webhook retryReplay a signed event and verify idempotent handling.Open →

Continue

Run Quick StartMake and inspect the first protected call.Open →Open Developer ToolsDownload all starter assets.Open →Browse GuidesChoose the platform-specific implementation.Open →

Implementation steps

Copy the Test Mode environment file and replace only placeholder values supplied by the B5 test tenant.
Run the health and metadata requests before attempting a protected operation.
Verify one successful request and capture its correlation and evidence identifiers.
Run every listed failure case and confirm the expected reason code.
Export the test evidence and attach it to the staging promotion review.

Control details

Failure Expired

Set a timestamp outside the accepted lifetime. The request must be denied before application logic runs.

Failure Replay

Reuse the same nonce and canonical request. The replay store must reject the duplicate atomically.

Failure Audience

Change the audience while retaining the original signature. Audience binding must fail.

Failure Scope

Request a protected action not present in the application grant. Authorization must deny it.

Failure Webhook

Deliver the same event identifier more than once. The receiver should verify the signature and remain idempotent.

Test Mode lab

Import the collection and exercise both success and failure

JSONPostman collectionHealth, decision, evidence, and webhook requests.Download ↓JSONPostman environmentTest-only variables.Download ↓PS1PowerShell clientWindows and LocalWP-friendly signed request.Download ↓SHBash clientmacOS, Linux, and WSL signed request.Download ↓

Required success evidence

  • HTTP success response
  • B5 correlation identifier
  • Decision and reason code
  • Evidence identifier
  • Expected audience and scope

Required denial tests

  • Expired timestamp
  • Reused nonce
  • Wrong audience
  • Missing scope
  • Revoked key
  • Duplicate webhook event
Developer Relations

Talk to a human.

Get architecture guidance, Test Mode access, integration review, or help choosing the right B5 identity and authorization pattern.

Contact Developer RelationsRequest a demo
Scroll to Top