Without a sandbox there is no safe integration path. In acceptance you test tokens, sending and webhooks without production impact. Documents from a test account stay on the Peppol test network.

Request OAuth2 credentials via the contact form. State that this is a developer/API integration and which type of connection you are building (own software, ERP, service provider, …).

After alignment, eConnect typically creates:

For server-to-server integrations: Client Credentials (grant_type=client_credentials, scope ap). Rights attach to the application without end-user passwords in your backend.

• Do not put a production clientId in local developer .env files
• Do not send test traffic to psb.econnect.eu / identity.econnect.eu
• Do not assume accp data or parties exist in production

1. Credentials received and stored safely (secrets manager / vault)
2. You know which partyId your test party has
3. You know the difference between acceptance and production hosts — next: Acceptance endpoints