Skip to main content
When your live integration tests finish, retire the test users you created. Retiring a user revokes its access and keeps the records that explain earlier charges.
Sandbox keys create no live balances or end users and need no cleanup.

​
How it works

If you’ll reuse a test identity, reset its policy and keep it. If not, wind it down and retire it.

​
Retire a test user

1

Stop new activity

Stop issuing calls, tokens, and top-ups for the identity.
2

Wait for pending activity

Let in-flight calls settle and hosted checkout sessions complete or expire.
3

Return the remaining credits

Deallocate the balance to the workspace pool.
4

Retire the user

A workspace owner or admin with tokens:manage completes fresh MFA or passkey verification, then retires the user through the API. If retirement is blocked, the response lists what to resolve first.
Retirement:
  • Revokes the user’s tokens and agent keys.
  • Cancels cost approvals and resets the active policy.
  • Freezes the account. Financial and security history stay available.
Retiring the same user again is safe.
A retired identity stays inactive. Issuing a new token can’t reactivate it. To reuse the identity, reset its policy instead.

​
Reset a policy without retiring the user

Use this when the identity should stay available for another test. The caller needs tokens:manage, and dashboard callers must be an owner or admin. The reset waits until no active reservation depends on the policy, and keeps the policy’s decision history. The API reference covers permissions, blockers, and responses.

​
Next steps

Sandbox keys

Test without live users or credits.

Customer balances

Allocate and deallocate customer credits.