---
updatedAt: 2026-08-31T12:04:13.000Z
agentTools:
  projectIndex: https://docs.castle.io/llms.txt
---

# Mock Request Tokens

A `request_token` parameter is required to be sent with every request to the Filter and Risk API endpoints. In order to test Castle without having a client-side integration in place, you can use **Mock Request Tokens** to evaluate different risk scenarios.

## Format

`test|<parameter>:<value>|<parameter>:<value>...`

The `device` parameter is required. All other parameters are optional. A Mock Request Token without a `device` parameter is rejected as invalid.

## Usage

Mock Request Tokens will streamline your testing process by giving you a way to force certain aspects and characteristics of a request, without doing a full integration. For example, if you want to simulate a user using Firefox on a Windows device in the US, you can use the following Mock Request Token value:

`request_token: "test|device:firefox_on_windows|ip:us-ca"`

<Callout icon="🚧" theme="warn">
  ### Reminder

  Test tokens are only supported on **Sandbox** environments.
</Callout>

## Test Token Parameters & Values

| Parameter       | Possible Values                                                                                                                   | Description                                                                                                                       |
| :-------------- | :-------------------------------------------------------------------------------------------------------------------------------- | :-------------------------------------------------------------------------------------------------------------------------------- |
| `device`        | `chrome_on_mac`<br />`safari_on_mac`<br />`firefox_on_mac`<br />`chrome_on_windows`<br />`firefox_on_windows`<br />`bot_on_linux` | Pre-determined device combinations to represent various device types                                                              |
| `ip`            | `se`<br />`us-ca`<br />`jp`                                                                                                       | IP location of the request                                                                                                        |
| `policy.action` | `allow`<br />`challenge`<br />`deny`                                                                                              | Force a policy action to be returned by Castle                                                                                    |
| `risk`          | value from `0-1.0`                                                                                                                | Set the Castle Abuse score to a specific value. The Bot score is not affected, and is still calculated from the device you select |

The `risk` and `policy.action` parameters are independent. A high `risk` value on its own does not force a `deny` action, because your policies still decide the action. Set both parameters when you want a specific score and a specific action in the same response.

## Examples

Mac computer using a Chrome browser, connecting from California, US:

```
test|device:chrome_on_mac|ip:us-ca
```

Headless browser, connecting from Japan:

```
test|device:bot_on_linux|ip:jp
```