Testing
Validate your online payments integration against the sandbox environment with test cards.
Test your Checkout integration in the Tapaya sandbox before taking live payments. Sandbox payments use test cards, so no real money moves. Production Checkout accepts real payments from approved merchants.
Point your server at the sandbox API
Set TAPAYA_CHECKOUT_API_URL to https://api.sandbox.tapaya.com and store a merchant checkout key in TAPAYA_CHECKOUT_API_KEY. Keep both on your server.
TAPAYA_CHECKOUT_API_URL=https://api.sandbox.tapaya.com
TAPAYA_CHECKOUT_API_KEY=tapaya_test_...Complete onboarding with the online payments capability and check that the merchant is Ready in Checkout settings. Save return URLs if you use Hosted Checkout.
Create a test session
Create a session for a test order, exactly as in the Quick Start Guide. Store the returned
id with the order before redirecting, so you can check the result even if the browser is closed.
Pay with a test card
Open the session's url and pay with one of the cards below, any future expiry date, and CVC 123.
Verify from your server
Retrieve the session from your server and compare its order reference, amount, currency, and
paymentStatus with the stored order. The browser returning to your success URL does not prove payment.
Test cards
Use these test cards.
| Scenario | Card number | Expected result |
|---|---|---|
| Payment succeeds | 4242 4242 4242 4242 | paymentStatus: successful. Your server fulfills the order once. |
| Card is declined | 4916 0184 7581 4056 | paymentStatus: failed, status stays open. The customer can try another card on the same session. |
| 3D Secure required | 4012 0018 0000 0016 | Complete the test challenge. Fulfill only after retrieval confirms success. |
A processing-error card can pass tokenization and fail only when charged, so always check the retrieved status rather than the card form's reaction.
What the sandbox environment covers
- Hosted Checkout: cards with the test cards above. Wallet buttons depend on the merchant's settings and the customer's device and browser, so do not rely on them appearing in every test.
- Embedded payments: cards and supported wallets with Tapaya.js 0.2.0. Test wallet availability, cancellation, total changes, and server verification. Apple Pay requires a registered shop domain. See Embedded Checkout.
- Session lifetime: sessions accept new payments for 30 minutes after creation. Use a new
merchantOrderIdfor each independent test: an order can be paid only once, and a new session for an unpaid order replaces the previous one.
Once the basic flow passes, work through the QA Checklist, which covers retries, lost responses, and customers who never return.