SDKs, CLI and API

Which interfaces does Sandboxer offer?

Sandboxer offers five ways in, all backed by the same API, so a sandbox created one way can be used from any other.

Inside a sandbox, SANDBOXER_TOKEN and SANDBOXER_API_URL are already set, so the SDKs work there with no arguments, scoped to that one sandbox. The MCP server has its own page: Sandboxer MCP server.

How does the sbx CLI work?

sbx is a single static binary, and most of its commands map to one API call. The CLI reference lists every command and flag.

curl -fsSL https://sandboxer.com/install | sh      # macOS / Linux
irm https://sandboxer.com/install.ps1 | iex        # Windows PowerShell
sbx self-update

For scripts, --json gives machine-readable output, and it turns on by itself when output is not a terminal. Exit codes are documented: for example, 3 means not signed in and 4 means not found. sbx exec and sbx ssh return the remote command's own exit code, so a failing test fails your script.

id="$(sbx new --type small --json | jq -r 'select(.event=="ready") | .id')"
sbx exec "$id" "npm ci && npm test"
sbx stop "$id" --json

How do the TypeScript and Python SDKs look?

Both SDKs wrap the API in a Sandboxer client that reads SANDBOXER_API_KEY from the environment. Creating a sandbox waits until it is ready.

npm install sandboxer-sdk

import { Sandboxer } from "sandboxer-sdk";

const sandboxer = new Sandboxer();
const sandbox = await sandboxer.create({ type: "default", ttlSeconds: 1800 });
const run = await sandbox.exec("node -v");
console.log(run.exitCode, run.stdout);
await sandbox.stop();

In Python, install sandboxer-sdk, not sandboxer. The Python SDK docs warn that the PyPI package named sandboxer is an unrelated project.

pip install sandboxer-sdk

from sandboxer import Sandboxer

with Sandboxer() as client:
    sandbox = client.create(type="default", ttl_seconds=1800)
    print(sandbox.exec("python3 --version").stdout)
    sandbox.stop()

Both SDKs cover lifecycle calls, streamed and detached commands, files, hosting, agent prompts and usage. See the TypeScript SDK docs for the full list.

Can you call the REST API directly?

Yes. Send a bearer API key with each request. A create call returns 202 while the machine boots; poll the sandbox until its state is ready, or subscribe to the sandbox.ready webhook.

curl -sS -X POST https://sandboxer.com/api/v1/sandboxes \
  -H "Authorization: Bearer $SANDBOXER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"type":"default","ttlSeconds":3600}'

The API reference documents every endpoint, and creates can be made safe to retry with an Idempotency-Key header.

Does Sandboxer work with the Daytona SDK?

Yes, for the calls it covers. Sandboxer runs a Daytona-compatible API that the Daytona TypeScript and Python SDKs can use after you change the API URL and key. Its migration guide says lifecycle, files, processes, sessions and previews work, while images, volumes, GPUs, git and PTY return not_supported.

DAYTONA_API_URL=https://sandboxer.com/daytona/api
DAYTONA_API_KEY=<your Sandboxer API key>

What else can you hook into?

• Webhooks: signed lifecycle events, using HMAC-SHA256 with a timestamp
• OpenTelemetry: export metrics and lifecycle events over OTLP
• Scoped API keys: limit a key to certain actions, sandboxes and an expiry