Sandbox

What crosses the wire

• What you get

  A set of credentials, at least one test merchant ID, and access to the documented test cards. The keys are environment-scoped, so they authenticate only against the sandbox and nowhere else.

• What it stands in for

  The card networks and the issuer decision. Everything upstream of that — your request, the gateway contract, the event stream, the settlement records — behaves as it does on production.

• What it cannot stand in for

  A real bank account, real funding timing and your actual pricing. Those come from an approved merchant account, and no sandbox response should be read as a quote or a deposit schedule.

When to use it

• During evaluation

  Prove the integration works before committing to a merchant account, and before anyone signs anything.

• For every release

  Keep a permanent sandbox account so changes are verified before they reach live traffic, not after.

• When onboarding or handing over

  A new developer, or a partner agency taking over the integration, can be given sandbox credentials without any access to live money.

How to implement Sandbox

What fails, and how you find out

• The signing secret was not swapped at cutover

  Sandbox and production sign with different secrets. A handler that verified correctly all through development rejects every live event, and because rejection looks like a security failure it is often misdiagnosed as an attack.

• A sandbox key deployed to production

  Every call fails authentication at once. Refusing to boot when the credential does not match the expected environment turns a live outage into a failed deploy.

• Timing assumptions carried across

  Accelerated settlement in sandbox teaches your code that funding follows capture almost immediately. On production it follows the funding schedule on your account, and jobs built on the sandbox rhythm sit idle.

• Sandbox treated as a load test

  It is a correctness environment, not a capacity one. Numbers observed there say nothing about production throughput, and using it that way mostly produces throttling responses.

Sandbox versus production

• Isolation is by credential, not by convention

  The two environments hold separate data and separate keys, and neither key works against the other. There is no configuration mistake that lets a sandbox call reach live funds.

• Outcomes are chosen by card number

  A production result depends on the issuer. A sandbox result depends on which documented card you sent, which is why the same test can be run a thousand times and mean something each time.

• Time is compressed, money is not real

  Batches close and deposits fund in minutes so reconciliation can be exercised, and the amounts, fees and schedules involved are illustrative rather than a preview of your account.