diff --git a/README.md b/README.md
index c79c2d6..b49f90b 100644
--- a/README.md
+++ b/README.md
@@ -276,7 +276,6 @@ WhatsApp sandbox:
 
 ```bash
 WEBHOOK_HMAC_SECRET=...
-VERIFY_TOKEN=...
 PORT=3000
 WHATSAPP_API_URL=...
 WHATSAPP_ACCESS_TOKEN=...
@@ -287,7 +286,6 @@ Instagram sandbox:
 
 ```bash
 WEBHOOK_HMAC_SECRET=...
-VERIFY_TOKEN=...
 PORT=3000
 INSTAGRAM_API_URL=...
 INSTAGRAM_ACCESS_TOKEN=...
@@ -295,9 +293,8 @@ INSTAGRAM_ACCOUNT_ID=...
 ```
 
 `WEBHOOK_HMAC_SECRET` is the secret that signs delivered webhook payloads
-(the `X-HookMyApp-Signature-256` header). `VERIFY_TOKEN` is a temporary
-compatibility alias carrying the same value for older starter-kit setups;
-prefer `WEBHOOK_HMAC_SECRET` in new code.
+(the `X-HookMyApp-Signature-256` header). Sandbox env blocks do not include
+`VERIFY_TOKEN`: the sandbox tunnel never issues the verify-GET handshake.
 
 ## Telemetry
 
diff --git a/src/__tests__/starter-kit-alignment.test.ts b/src/__tests__/starter-kit-alignment.test.ts
index e0b0e4e..0af4c5a 100644
--- a/src/__tests__/starter-kit-alignment.test.ts
+++ b/src/__tests__/starter-kit-alignment.test.ts
@@ -5,7 +5,7 @@ const STARTER_KIT_ENV_URL =
 
 const CLI_CANONICAL_KEYS = [
   'PORT',
-  'VERIFY_TOKEN',
+  'WEBHOOK_HMAC_SECRET',
   'WHATSAPP_ACCESS_TOKEN',
   'WHATSAPP_API_URL',
   'WHATSAPP_PHONE_NUMBER_ID',
diff --git a/src/commands/sandbox/__tests__/env.test.ts b/src/commands/sandbox/__tests__/env.test.ts
index 3f3064a..c3e6035 100644
--- a/src/commands/sandbox/__tests__/env.test.ts
+++ b/src/commands/sandbox/__tests__/env.test.ts
@@ -55,12 +55,11 @@ describe('buildEnvBlock — WhatsApp regression', () => {
     delete process.env.HOOKMYAPP_SANDBOX_PROXY_URL;
   });
 
-  it('emits the WA block with WEBHOOK_HMAC_SECRET + the VERIFY_TOKEN compat alias', () => {
+  it('emits the WA block with WEBHOOK_HMAC_SECRET', () => {
     const out = buildEnvBlock(wa);
     expect(out).toBe(
       [
         'WEBHOOK_HMAC_SECRET=HMAC_wa_yyy',
-        'VERIFY_TOKEN=HMAC_wa_yyy',
         'PORT=3000',
         'WHATSAPP_API_URL=https://proxy.test/v24.0',
         'WHATSAPP_ACCESS_TOKEN=ACT_wa_xxx',
@@ -79,12 +78,11 @@ describe('buildEnvBlock — Instagram (D2)', () => {
     delete process.env.HOOKMYAPP_SANDBOX_PROXY_URL;
   });
 
-  it('emits the IG block with INSTAGRAM_* vars, v25.0 URL, and both HMAC keys', () => {
+  it('emits the IG block with INSTAGRAM_* vars, v25.0 URL, and WEBHOOK_HMAC_SECRET', () => {
     const out = buildEnvBlock(ig);
     expect(out).toBe(
       [
         'WEBHOOK_HMAC_SECRET=HMAC_ig_yyy',
-        'VERIFY_TOKEN=HMAC_ig_yyy',
         'PORT=3000',
         'INSTAGRAM_API_URL=https://proxy.test/v25.0',
         'INSTAGRAM_ACCESS_TOKEN=ACT_ig_xxx',
@@ -139,7 +137,6 @@ describe('runSandboxEnv --json — flat {KEY: VALUE} object', () => {
     const parsed = JSON.parse((writeSpy.mock.calls[0][0] as string).trim());
     expect(parsed).toEqual({
       WEBHOOK_HMAC_SECRET: 'HMAC_ig_yyy',
-      VERIFY_TOKEN: 'HMAC_ig_yyy',
       PORT: '3000',
       INSTAGRAM_API_URL: 'https://proxy.test/v25.0',
       INSTAGRAM_ACCESS_TOKEN: 'ACT_ig_xxx',
diff --git a/src/commands/sandbox/env.ts b/src/commands/sandbox/env.ts
index 1c74fa7..d3c7d58 100644
--- a/src/commands/sandbox/env.ts
+++ b/src/commands/sandbox/env.ts
@@ -5,10 +5,10 @@
 // Per D2: WA block uses the WHATSAPP_* prefix (including the WA quirk where
 // WHATSAPP_PHONE_NUMBER_ID carries the tester's phone, per spec D4). IG block
 // uses the INSTAGRAM_* prefix. Both blocks carry the session's webhook HMAC
-// signing secret as WEBHOOK_HMAC_SECRET, plus VERIFY_TOKEN as a temporary
-// compat alias (same value) for older starter-kit setups. The webhook verify
-// token and the HMAC signing secret are distinct concepts — the alias is
-// legacy naming, not an equivalence.
+// signing secret as WEBHOOK_HMAC_SECRET. No VERIFY_TOKEN is written: the
+// sandbox tunnel never issues the verify-GET handshake, and the temporary
+// compat alias for pre-split starter-kits was dropped alongside
+// webhook-starter-kit v3 (AIT-126).
 
 import * as fs from 'node:fs';
 import type { Command } from 'commander';
@@ -42,9 +42,6 @@ export function buildEnvPairs(session: SandboxSession): [string, string][] {
     case 'whatsapp':
       return [
         ['WEBHOOK_HMAC_SECRET', session.hmacSecret],
-        // Temporary compat alias — older starter-kit setups read the HMAC
-        // signing secret from VERIFY_TOKEN. Same value, distinct concept.
-        ['VERIFY_TOKEN', session.hmacSecret],
         ['PORT', '3000'],
         ['WHATSAPP_API_URL', `${proxyBase}/${session.whatsappApiVersion}`],
         ['WHATSAPP_ACCESS_TOKEN', session.accessToken],
@@ -53,8 +50,6 @@ export function buildEnvPairs(session: SandboxSession): [string, string][] {
     case 'instagram':
       return [
         ['WEBHOOK_HMAC_SECRET', session.hmacSecret],
-        // Temporary compat alias — see the WhatsApp block above.
-        ['VERIFY_TOKEN', session.hmacSecret],
         ['PORT', '3000'],
         ['INSTAGRAM_API_URL', `${proxyBase}/${INSTAGRAM_GRAPH_VERSION}`],
         ['INSTAGRAM_ACCESS_TOKEN', session.accessToken],