This page describes the test scenarios we support, why they matter for product quality and compliance, and how to use test cards safely in Sandbox mode.
How to use Sandbox & test cards#
1
Switch to Sandbox
Use your Sandbox API key and Test Merchant ID. Never send test cards to Production.
2
Use the test cards below
PAN, expiry and CVV values below deterministically trigger validation errors, 3-D Secure, insufficient funds, and more.
3
Acknowledge webhooks
Return 2xx to confirm delivery. Log the payload; verify signatures if enabled.
Do not use real customer data in Sandbox. Test PANs never move money and are accepted only in Sandbox.
Test Cards#
Use these only in Sandbox. They are designed to trigger specific outcomes so you can validate your integration end-to-end.
| Test Case | Card number | Expiry | CVV | Expected Result |
|---|
| Payment Success | 4111 1111 1111 1111 | 12/29 | 123 | Payment processed successfully |
| Payment Fail | 5105 1051 0510 5100 | 11/28 | 123 | Payment error (PAN fails Luhn/range) |
Keep expiry dates in the future during testing. Use a random cardholder name. Do not reuse real customer names or emails in Sandbox.
Validation Tests#
API key: Wrong credentials or a terminal not bound to the merchant should return auth errors without touching the acquirer.
Amount: Enforce numeric, > 0, ≤ two decimals; respect business min amount (e.g., 100). Invalid formats (strings, floats in scientific notation) should fail fast.
Order details & payment method: Validate presence and schema; reject unsupported methods early.
3DS notification URL: If provided, must be HTTPS and reachable; reject malformed URLs.
Capture & Refund#
Partial capture: If supported, ensure amount ≤ authorized amount; subsequent captures obey remaining balance.
Partial refund: Track cumulative refunded amount; status reflects partial vs full refund.
What to verify before go-live#
All validation cases behave as specified (clear messages, correct HTTP codes).
Transaction, capture, refund, recurring, and save-card paths pass end-to-end.
Webhooks are received, verified, and acknowledged with 2xx.
Monitoring dashboards and alerts are wired and tested.
