Test your integration end to end before processing real payments. The sandbox follows the production flow: create a request, open hosted checkout, approve, and receive the webhook.
Sandbox setup
SavaPay provides test access to approved pilot merchants during onboarding. Your package contains the test API URL, API key, webhook signing secret, and test-customer steps. Keep test configuration separate from production.
Run these checks
- Create a payment request and open the checkout link.
- Approve the payment as a test customer.
- Confirm your server receives payment.succeeded.
- Check payment status before completing the test order.
- Send the same create request twice with the same idempotency key and confirm the original intent is returned.
- Retry with a different amount and confirm your system handles idempotency_conflict.
- Reject a webhook with an invalid signature and confirm your server returns 400.
- Test a refund and confirm your system receives the update.
What to test
| Scenario | Expected outcome |
|---|---|
| Happy path | Intent created → customer approves → succeeded webhook fires |
| Customer never approves | Intent moves to expired when the checkout window ends |
| Merchant cancels | Unpaid intent moves to cancelled |
| Refund | Succeeded payment moves to refunded and the webhook fires |
| Idempotency | Same key and request returns the original intent; a changed request returns idempotency_conflict |
| Bad signature | Your webhook handler rejects with 400 |
Simulating a payment
Create an intent with your test key, open the returned checkoutUrl, and approve as the customer:
const intent = await sp.createPaymentIntent(
{ amount: 1299, currency: 'USD', merchantReference: 'test-1' },
'test-1'
)
// Open intent.checkoutUrl in a browser, approve as the customer,
// then watch for the payment.succeeded webhook.Ready for production
Before accepting live payments, confirm:
- Your merchant account is active.
- Your production webhook URL is public and uses HTTPS.
- Your server verifies webhook signatures.
- Your system stores processed webhook event IDs.
- Every write request uses an idempotency key.
- Payment amounts use whole cents, without floating-point math.
- Your team tested successful payments, failures, cancellations, expiry, and refunds.
Go live
Replace sandbox settings with production settings. Run one small real payment through the complete order flow and confirm your records match SavaPay. For activation, see: Authentication
Before processing real customer payments, review: Production readiness