diff --git a/auth-api/devops/vaults.gcp.env b/auth-api/devops/vaults.gcp.env
index 8660836a6c..099510b124 100644
--- a/auth-api/devops/vaults.gcp.env
+++ b/auth-api/devops/vaults.gcp.env
@@ -30,6 +30,7 @@ NOTIFY_API_VERSION="op://API/$APP_ENV/notify-api/NOTIFY_API_VERSION"
 PAY_API_URL="op://API/$APP_ENV/pay-api/PAY_API_URL"
 PAY_API_VERSION="op://API/$APP_ENV/pay-api/PAY_API_VERSION"
 LEGAL_API_URL="op://API/$APP_ENV/legal-api/LEGAL_API_URL"
+LEGAL_SANDBOX_API_URL="op://API/sandbox/legal-api/LEGAL_API_URL"
 LEGAL_API_VERSION="op://API/$APP_ENV/legal-api/LEGAL_API_VERSION"
 LEGAL_API_VERSION_2="op://API/$APP_ENV/legal-api/LEGAL_API_VERSION_2"
 GCP_AUTH_KEY="op://gcp-queue/$APP_ENV/gtksf3/AUTHPAY_GCP_AUTH_KEY"
diff --git a/auth-api/docs/dotenv_template b/auth-api/docs/dotenv_template
index 2c0350591a..28444a2002 100644
--- a/auth-api/docs/dotenv_template
+++ b/auth-api/docs/dotenv_template
@@ -57,6 +57,7 @@ PAYBC_CLIENT_SECRET=test
 PAYBC_PORTAL_URL=http://localhost:8080
 NOTIFY_API_URL="https://mock-lear-tools.pathfinder.gov.bc.ca/rest/SBC+Notify+API+Reference/2.0.0/api/v1"
 LEGAL_API_URL="https://legal-api-dev.pathfinder.gov.bc.ca/api/v1"
+LEGAL_SANDBOX_API_URL="https://legal-api-dev.pathfinder.gov.bc.ca/api/v1"
 
 
 
diff --git a/auth-api/env.sample b/auth-api/env.sample
index b6adc27235..100abee883 100644
--- a/auth-api/env.sample
+++ b/auth-api/env.sample
@@ -43,6 +43,7 @@ NOTIFY_API_VERSION="/api/v1"
 PAY_API_URL="https://pay-api-dev.apps.silver.devops.gov.bc.ca"
 PAY_API_VERSION="/api/v1"
 LEGAL_API_URL="https://legal-api-dev.apps.silver.devops.gov.bc.ca"
+LEGAL_SANDBOX_API_URL="https://legal-api-dev.apps.silver.devops.gov.bc.ca"
 LEGAL_API_VERSION="/api/v1"
 LEGAL_API_VERSION_2"/api/v2"
 
diff --git a/auth-api/poetry.lock b/auth-api/poetry.lock
index 6e4a02f3a4..072778cf5b 100644
--- a/auth-api/poetry.lock
+++ b/auth-api/poetry.lock
@@ -949,7 +949,7 @@ six = "^1.16.0"
 type = "git"
 url = "https://github.com/seeker25/flask-jwt-oidc.git"
 reference = "main"
-resolved_reference = "d208d4643e3b17358f7295bee0f955e67ba6ac88"
+resolved_reference = "563f01ef6453eb0ea1cc0a2d71c6665350c853ff"
 
 [[package]]
 name = "flask-mail"
diff --git a/auth-api/src/auth_api/config.py b/auth-api/src/auth_api/config.py
index 31fc338a13..f8dd1cad91 100644
--- a/auth-api/src/auth_api/config.py
+++ b/auth-api/src/auth_api/config.py
@@ -131,6 +131,7 @@ class _Config:  # pylint: disable=too-few-public-methods
     PAY_API_URL = os.getenv("PAY_API_URL", "") + os.getenv("PAY_API_VERSION", "")
 
     LEGAL_API_URL = os.getenv("LEGAL_API_URL", "")
+    LEGAL_SANDBOX_API_URL = os.getenv("LEGAL_SANDBOX_API_URL", "")
     LEGAL_API_VERSION = os.getenv("LEGAL_API_VERSION")
     LEGAL_API_VERSION_2 = os.getenv("LEGAL_API_VERSION_2", "")
 
@@ -300,6 +301,7 @@ class TestConfig(_Config):  # pylint: disable=too-few-public-methods
     ENTITY_SVC_CLIENT_SECRET = os.getenv("KEYCLOAK_TEST_ADMIN_SECRET")
 
     LEGAL_API_URL = "https://mock-auth-tools.pathfinder.gov.bc.ca/rest/legal-api/2.7"
+    LEGAL_SANDBOX_API_URL = "https://mock-auth-tools.pathfinder.gov.bc.ca/rest/legal-api/2.7"
     LEGAL_API_VERSION_2 = "/api/v1"
 
     NOTIFY_API_URL = "http://localhost:8080/notify-api/api/v1"
diff --git a/auth-api/src/auth_api/services/affiliation.py b/auth-api/src/auth_api/services/affiliation.py
index 0021787373..ee8d74f12d 100644
--- a/auth-api/src/auth_api/services/affiliation.py
+++ b/auth-api/src/auth_api/services/affiliation.py
@@ -40,6 +40,7 @@
 from auth_api.utils.passcode import validate_passcode
 from auth_api.utils.roles import ALL_ALLOWED_ROLES, CLIENT_AUTH_ROLES, STAFF, Role
 from auth_api.utils.user_context import UserContext, user_context
+from auth_api.utils.util import get_request_environment
 
 from .activity_log_publisher import ActivityLogPublisher
 from .rest_service import RestService
@@ -560,7 +561,14 @@ def _get_nr_details(nr_number: str):
 
     @staticmethod
     def _validate_firms_party(token, business_identifier, party_name_str: str):
-        legal_api_url = current_app.config.get("LEGAL_API_URL") + current_app.config.get("LEGAL_API_VERSION_2")
+        env = get_request_environment()
+        if env == "sandbox":
+            legal_api_url = current_app.config.get("LEGAL_SANDBOX_API_URL") + current_app.config.get(
+                "LEGAL_API_VERSION_2"
+            )
+        else:
+            legal_api_url = current_app.config.get("LEGAL_API_URL") + current_app.config.get("LEGAL_API_VERSION_2")
+
         parties_url = f"{legal_api_url}/businesses/{business_identifier}/parties"
         try:
             lear_response = RestService.get(parties_url, token=token, skip_404_logging=True)