api_test_sk_...) to exercise the full payment flow
without moving real money. Test mode behaves exactly like live mode — same
endpoints, same objects, same statuses — but cards are simulated.
Objects created in test mode are invisible to live keys and vice versa.
Check the
livemode flag on any object if in doubt.Test cards
Use these card numbers with any future expiry date, any 3- or 4-digit CVC, and any cardholder name:
On the hosted payment page in test mode, the 3D Secure challenge is replaced
by a simulator page where you choose Complete or Fail.
Scenarios to cover before going live
1
Happy path
Create a payment, complete it, verify you observe
SUCCEEDED via polling
and via the payment.succeeded webhook.2
Failures
Trigger at least
insufficient_funds and generic_decline; confirm your
checkout shows a sensible message and lets the customer retry with a
different card. See Operation failure codes.3
3D Secure
Complete and fail a challenge; verify both outcomes, including the
redirect back to your
return_url.4
Abandonment
Create a hosted payment and never complete it; verify your system handles
EXPIRED (and doesn’t strand the order).5
Retries and duplicates
Send the same create request twice with the same
Idempotency-Key and
confirm only one payment exists. Send it with a changed body and confirm
you get 409 with error.code: "idempotency_key_reused". See
Idempotency.6
Refunds
Refund a test payment partially, then fully; verify
amount_refunded,
amount_refundable, and refund webhooks.7
Webhook failures
Make your endpoint return 500 once and verify the delivery is retried.
Verify your signature check rejects a tampered payload.
Going live
- Complete the checklist above in test mode.
- Swap
api_test_sk_...forapi_live_sk_...in your server configuration — nothing else changes. - Configure live-mode webhook endpoints (test and live endpoints are separate).
- Make a small real payment and refund it to verify the live configuration end to end.