经过一番挖掘后，我从Apple的技术说明TN2259 ：

After a bit of digging I found this from Apple's Technical Note TN2259:

如何验证收据（iOS）？

How do I verify my receipt (iOS)?

请务必先使用生产网址验证收据;如果您收到21007状态代码，请继续使用沙箱URL进行验证。遵循此方法可确保您在沙盒中测试或查看应用程序时无需在URL之间切换，或者在App Store中进行实时更新。

Always verify your receipt first with the production URL; proceed to verify with the sandbox URL if you receive a 21007 status code. Following this approach ensures that you do not have to switch between URLs while your application is being tested or reviewed in the sandbox or is live in the App Store.

所以看起来我应该完全破解& sandbox 参数并且就这样做。我真的不得不去挖掘这个答案，所以我在这里发帖，希望别人可以碰到它！

So it looks like I should axe the &sandbox parameter completely and just do that. I really had to dig for this answer so I'm posting it here in hopes that someone else runs across it!