Choose your guide
Rules that apply to every sandbox flow
Authenticate with sandbox credentials. Keep production credentials out of test requests.
Use a new
externalReference for every attempt.Treat
successful as the only fulfilled state.Verify the final status through a webhook or the transaction endpoint before providing value.
Never send real money or real card details to a sandbox flow.
Before going live
1
Cover both branches
Run the success and failure fixture for every method you plan to use — not just the happy
path.
2
Exercise every challenge
If your markets involve OTP, PIN, 3DS, or address verification, drive each one end to end.
3
Test your webhook handler
Use Simulate Webhook to fire event shapes that are
awkward to trigger organically.
4
Confirm signature verification
Send a request with a bad signature and check that your endpoint rejects it.
Environments
How sandbox and production differ, and how to switch between them.