Skip to main content

​
How do I get access to the sandbox?

The sandbox is available to every Waffo merchant account. You need:
  1. A Waffo Merchant account.
  2. An API Key — view it on Merchant Portal → Integration (requires the Dev or Admin role).
  3. An RSA key pair for request signing — the sandbox provides pre-generated keys; see Authentication and signing.
No real charges are ever made in the sandbox.

​
How do I point my integration at the sandbox?

If you use a Waffo SDK, set Environment.SANDBOX / Environment.PRODUCTION — there is no need to modify URLs manually.

​
How do I simulate a successful or failed payment?

The sandbox does not connect to real payment channels. Instead, the checkout page shows simulation buttons:
  1. Call POST /api/v1/order/create and retrieve the checkout URL from orderAction.
  2. Open the checkout page in your browser.
  3. Click Payment succeeded (order status becomes PAY_SUCCESS) or Payment failed (order status becomes ORDER_CLOSE).
After clicking, Waffo automatically sends a PAYMENT_NOTIFICATION webhook to your notifyUrl. The simulation flow is the same for all payment methods — no real channel is called. Where a card flow shows a card form, use the quick-fill buttons or the test cards below.

​
How do I test subscription renewals without waiting for a billing cycle?

  1. Create and activate a subscription (POST /api/v1/subscription/create, then simulate the first payment on the checkout page — the status changes to ACTIVE).
  2. Call POST /api/v1/subscription/manage to get the managementUrl and open it in your browser.
  3. Click Simulate next payment succeeded (sends PAYMENT_NOTIFICATION and SUBSCRIPTION_PERIOD_CHANGED_NOTIFICATION) or Simulate next payment failed (sends a failed PAYMENT_NOTIFICATION).
Each click simulates one renewal period, so you can chain multi-period scenarios (period 2 succeeds, period 3 fails). The management page also supports cancellation, which sends a SUBSCRIPTION_STATUS_NOTIFICATION with status USER_CANCELLED. See Sandbox simulator for details.

​
Which test card numbers can I use?

For card-entry flows, use these sandbox card numbers (they match the Portal’s Test Cards list; none of them triggers a 3DS challenge — the sandbox has no 3DS simulation): Expiration date: any future date. CVV: any 3 digits (AMEX uses 4 digits). For most scenarios, the checkout simulation buttons are sufficient and no card number is needed. When a flow does require you to type a card, prefer the quick-fill buttons on the sandbox checkout page, or the list at Merchant Portal → Integration → Test Cards — the in-product source is the one to trust if any document disagrees with it. See Sandbox Simulation Limits FAQ.

​
How do I trigger specific error codes in the sandbox?

The sandbox reserves special order amounts that intentionally return matching error codes — for example, amounts 90, 990, 1990, 19990 trigger C0005 Payment Channel Rejection on order or subscription creation, and other reserved amounts trigger C0001 System Error or E0001 Unknown Status. The reserved amounts apply to order create, order cancel, subscription create and subscription cancel; on the refund API, a refundAmount equal to one of the create-family amounts makes the refund request fail at request time and leaves a REFUND_FAILED refund order, while the refund-specific amounts on the published simulator page do not take effect. Avoid these amounts when you only want the normal success/failure flow — and note this is a sandbox-only rule, not production behavior. The full mapping, and what to do if your real prices collide with a reserved amount, are in Sandbox Simulation Limits FAQ.

​
Why am I not receiving webhooks from the sandbox?

The sandbox sends real webhook callbacks, but your notifyUrl must be publicly accessible — Waffo cannot reach localhost or a private address. For local development, use an intranet tunneling tool (such as ngrok or cloudflared) and set the tunnel’s public URL as your notifyUrl. See Webhook overview for the callback contract.

​
What is different between sandbox and production?

Octopus, Apple Pay, and Google Pay require additional dedicated checks beyond regular sandbox testing — see Sandbox and testing. Before switching to production, complete every item in the Go-live checklist, including integration acceptance submitted to the Waffo technical support group.