> ## Documentation Index > Fetch the complete documentation index at: https://waffo.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Sandbox Testing FAQ > How to get sandbox credentials, simulate payment success and failure, use test card numbers, receive webhooks locally, and understand the differences between sandbox and production. ## How do I get access to the sandbox? The sandbox is available to every Waffo merchant account. You need: 1. A Waffo Merchant account. 2. An API Key — view it on **Merchant Portal → Integration** (requires the Dev or Admin role). 3. An RSA key pair for request signing — the sandbox provides pre-generated keys; see [Authentication and signing](/docs/en/developer-docs/integration/api/overview). No real charges are ever made in the sandbox. ## How do I point my integration at the sandbox? | Environment | Base URL | | - | - | | Sandbox | `https://api-sandbox.waffo.com` | | Production | `https://api.waffo.com` | If you use a Waffo SDK, set `Environment.SANDBOX` / `Environment.PRODUCTION` — there is no need to modify URLs manually. ## How do I simulate a successful or failed payment? The sandbox does not connect to real payment channels. Instead, the checkout page shows simulation buttons: 1. Call `POST /api/v1/order/create` and retrieve the checkout URL from `orderAction`. 2. Open the checkout page in your browser. 3. Click **Payment succeeded** (order status becomes `PAY_SUCCESS`) or **Payment failed** (order status becomes `ORDER_CLOSE`). After clicking, Waffo automatically sends a `PAYMENT_NOTIFICATION` webhook to your `notifyUrl`. The simulation flow is the same for all payment methods — no real channel is called. Where a card flow shows a card form, use the quick-fill buttons or the test cards below. ## How do I test subscription renewals without waiting for a billing cycle? 1. Create and activate a subscription (`POST /api/v1/subscription/create`, then simulate the first payment on the checkout page — the status changes to `ACTIVE`). 2. Call `POST /api/v1/subscription/manage` to get the `managementUrl` and open it in your browser. 3. Click **Simulate next payment succeeded** (sends `PAYMENT_NOTIFICATION` and `SUBSCRIPTION_PERIOD_CHANGED_NOTIFICATION`) or **Simulate next payment failed** (sends a failed `PAYMENT_NOTIFICATION`). Each click simulates one renewal period, so you can chain multi-period scenarios (period 2 succeeds, period 3 fails). The management page also supports cancellation, which sends a `SUBSCRIPTION_STATUS_NOTIFICATION` with status `USER_CANCELLED`. See [Sandbox simulator](/docs/en/developer-docs/tools-and-references/developer-tools/sandbox-simulator) for details. ## Which test card numbers can I use? For card-entry flows, use these sandbox card numbers (they match the Portal's **Test Cards** list; none of them triggers a 3DS challenge — the sandbox has no 3DS simulation): | payMethodName | Payment succeeds | Payment fails | | - | - | - | | CC\_VISA | `4576750000000110` | `4576750000000220` | | CC\_MASTERCARD | `2226900000000110` | `2226900000000220` | | CC\_JCB | `3528000000000214` | `3528000000120006` | | CC\_AMEX | `3799960000000110` | `3799960000000220` | | DC\_VISA | `4001700000000110` | `4001700000000220` | | DC\_MASTERCARD | `2226930000000110` | `2226930000000220` | | DC\_JCB | `3088850000000116` | `3088850000200004` | | DC\_AMEX | `3421560000000110` | `3421560000000220` | Expiration date: any future date. CVV: any 3 digits (AMEX uses 4 digits). For most scenarios, the checkout simulation buttons are sufficient and no card number is needed. When a flow does require you to type a card, prefer the **quick-fill buttons on the sandbox checkout page**, or the list at **Merchant Portal → Integration → Test Cards** — the in-product source is the one to trust if any document disagrees with it. See [Sandbox Simulation Limits FAQ](/docs/en/support/sandbox-simulation-limits-faq). ## How do I trigger specific error codes in the sandbox? The sandbox reserves special order amounts that intentionally return matching error codes — for example, amounts `90`, `990`, `1990`, `19990` trigger `C0005 Payment Channel Rejection` on order or subscription creation, and other reserved amounts trigger `C0001 System Error` or `E0001 Unknown Status`. The reserved amounts apply to **order create, order cancel, subscription create and subscription cancel**; on the refund API, a `refundAmount` equal to one of the create-family amounts makes the refund request fail at request time and leaves a `REFUND_FAILED` refund order, while the refund-specific amounts on the published simulator page do not take effect. Avoid these amounts when you only want the normal success/failure flow — and note this is a sandbox-only rule, not production behavior. The full mapping, and what to do if your real prices collide with a reserved amount, are in [Sandbox Simulation Limits FAQ](/docs/en/support/sandbox-simulation-limits-faq). ## Why am I not receiving webhooks from the sandbox? The sandbox sends real webhook callbacks, but your `notifyUrl` must be publicly accessible — Waffo cannot reach `localhost` or a private address. For local development, use an intranet tunneling tool (such as ngrok or cloudflared) and set the tunnel's public URL as your `notifyUrl`. See [Webhook overview](/docs/en/developer-docs/webhook/overview) for the callback contract. ## What is different between sandbox and production? | Aspect | Sandbox | Production | | - | - | - | | Base URL / SDK | `https://api-sandbox.waffo.com` / `Environment.SANDBOX` | `https://api.waffo.com` / `Environment.PRODUCTION` | | Funds | No real charges | Real transactions | | Payment channels | Simulator buttons; no real channel connection | Real payment channels | | API Key | Sandbox-specific | Separate production API Key | | RSA keys | Pre-generated sandbox keys | Generate a new production key pair — do not reuse sandbox keys | Octopus, Apple Pay, and Google Pay require additional dedicated checks beyond regular sandbox testing — see [Sandbox and testing](/docs/en/developer-docs/getting-started/sandbox). Before switching to production, complete every item in the [Go-live checklist](/docs/en/developer-docs/getting-started/go-live), including integration acceptance submitted to the Waffo technical support group. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.