# Test keys

> Every Wicket test site key and secret key, and what each one does, for development and for tests that submit a form.

Source: https://www.coritan.com/docs/wicket/test-keys/

Test keys let you build and test a form without a widget of your own. They work on any hostname, are never counted in a widget's analytics, and never touch a widget on your account. A test site key runs the real check in the browser and answers with a fixed result.

## Test site keys

Put one in the `data-sitekey` attribute of the widget, or pass it to `wicket.render`.

| Site key | What the widget does |
| --- | --- |
| `wk_test_pass` | Passes, visible. |
| `wk_test_fail` | Fails, visible. |
| `wk_test_pass_invisible` | Passes, invisible. |
| `wk_test_fail_invisible` | Fails, invisible. |
| `wk_test_interactive` | Shows the checkbox, then passes. |

A passing widget hands the form the token `WICKET.DUMMY.TOKEN`. A failing widget shows the failure and hands over no token.

## Test secret keys

Send one as the `secret` of the verify call ([Verify a token on your server](/docs/wicket/verify-tokens/)).

| Secret key | What the verify call answers |
| --- | --- |
| `wks_test_pass` | Every token passes. The answer's `hostname` is `example.com`, `action` and `cdata` are empty, and `metadata.event` is 32 zeros. |
| `wks_test_fail` | Every token fails with `invalid-input-response`. |
| `wks_test_spent` | Every token fails with `timeout-or-duplicate`. |

A test secret key answers the same for any token, a real one included, as long as the call has a token. A call with no `response` still answers `missing-input-response`. A test secret key is never limited by a budget.

A real secret key refuses `WICKET.DUMMY.TOKEN` with `invalid-input-response`. A form that ships with a test site key therefore cannot pass on your real widget.

## What a test key does not do

- It does not check the page's hostname, so a page on `localhost` or on a staging address works.
- It is not counted: the widget's numbers, the verified tokens and your account's activity show nothing for it.
- It writes no report. The feedback call with a test secret key answers 202 and keeps nothing ([Verify a token on your server](/docs/wicket/verify-tokens/#report-what-a-check-turned-out-to-be)).

## Use them in tests

- To test the form's happy path, load the page with `wk_test_pass` and verify with `wks_test_pass`.
- To test what your form does when the check fails, load the page with `wk_test_fail` and verify with `wks_test_fail`.
- To test how your server handles a token it has seen before, verify with `wks_test_spent`.
- To test a checkbox in your page's layout, use `wk_test_interactive`.

Before you go live, replace the test site key with your widget's site key and the test secret key with its secret key, and submit the form once on the real hostname.

## Related

- [Add Wicket to your site](/docs/wicket/add-wicket-to-your-site/)
- [Verify a token on your server](/docs/wicket/verify-tokens/)
- [Widget modes](/docs/wicket/widget-modes/)
- [Move from Cloudflare Turnstile to Wicket](/docs/wicket/migrate-from-turnstile/)