| Environment | Base URL | Description |
|---|
| Sandbox | https://api-sandbox.waffo.com | Test environment; no real charges will be made |
| Production | https://api.waffo.com | Production environment |
The SDK switches via Environment.SANDBOX / Environment.PRODUCTION; there is no need to manually modify the URL.
Test card numbers
Credit Card
CC_VISA
| Card number | Result |
|---|
4576750000000110 | Payment succeeds |
4576750000000220 | Payment fails |
CC_MASTERCARD
| Card number | Result |
|---|
2226900000000110 | Payment succeeds |
2226900000000220 | Payment fails |
CC_JCB
| Card number | Result |
|---|
3528000000000214 | Payment succeeds |
3528000000120006 | Payment fails |
CC_AMEX
| Card number | Result |
|---|
3400000000000216 | Payment succeeds |
340000000200027 | Payment fails |
Debit Card
DC_VISA
| Card number | Result |
|---|
4001700000000110 | Payment succeeds |
4001700000000220 | Payment fails |
DC_MASTERCARD
| Card number | Result |
|---|
2226930000000110 | Payment succeeds |
2226930000000220 | Payment fails |
DC_JCB
| Card number | Result |
|---|
3088850000000116 | Payment succeeds |
3088850000200004 | Payment fails |
DC_AMEX
| Card number | Result |
|---|
340034000100009 | Payment succeeds |
340034000400003 | Payment fails |
Expiration date: any future date
CVV: any 3 digits (AMEX uses 4 digits)
Sandbox simulator
The sandbox does not connect to real payment channels. Use the simulator to control payment outcomes directly:
- One-time payment: After creating an order, open the checkout page. The page provides “Payment Success” and “Payment Failed” buttons — click either to trigger the corresponding result and Webhook.
- Subscription first payment: Same as one-time payment; operate on the checkout page.
- Subscription renewal simulation: Call
POST /api/v1/subscription/manage to get the management page URL → open the management page → the page provides “Simulate Next Payment Success” and “Simulate Next Payment Failed” buttons; each click simulates one renewal cycle.
Example subscription renewal management page:
Payment method testing methods
Some payment methods require dedicated checks in addition to regular sandbox payment testing.
Octopus testing
If you need to complete QR code payment testing with the Octopus test app, see Octopus sandbox test payment.
Google Pay testing
If your integration needs Google Pay on Checkout or your own frontend, complete these checks.
- Sign in with a Google Pay test account.
- Add the account to the Google Pay test mode stub data group.
- Confirm that the target country or region is in the Google Pay supported countries list.
- If you load the payment page inside an Android App WebView, apply the Google Pay Android WebView configuration.
- Before production launch, Android Apps must request Google Pay API access through the Google Pay publish guide.
- If production access is not approved, users may see
OR_BIBED_11 or a similar error.
When applying for production access, select Gateway as the gateway type. After submitting the materials, provide the Google account merchant MID and app name to the Waffo technical support group if you need Waffo to help accelerate review.
Apple Pay testing
If your integration needs Apple Pay on Checkout or your own frontend, complete these checks.
- We recommend testing with the merchant’s own Apple Pay account.
- The test account must have a valid Visa, Mastercard, or Amex card.
- UnionPay cards are not supported for Apple Pay testing.
- If you see
Service unavailable, check the device or account region settings.
- Web testing may require a global proxy. Mobile payment-link testing can usually work with partial proxy coverage when the Apple Pay sheet is launched from the link.
- Before launch, confirm that the target country or region is in the Apple Pay supported countries list.
Testing Webhooks
The sandbox environment supports Webhook callbacks. Make sure your notifyUrl is publicly accessible. For local development, it is recommended to use an intranet tunneling tool (such as ngrok or cloudflared).
Sandbox and production use different API Keys and RSA keys. Octopus, Apple Pay, and Google Pay also require separate checks for app, account, country, WebView, or production permission requirements.