Production and Sandbox Testing

Production practices

• Keep clientSecret in backend-only secret storage.
• Never expose credentials in frontend code.
• Use HTTPS only.
• Verify webhook signatures using raw body.
• Make webhook handlers idempotent.
• Rotate API credentials on schedule.
• Refresh expired payment tokens using sessionTokenProvider.

Sandbox test cards

Use for sandbox testing only.

Important notes:

• If CVV is required and not specified, use any random CVV.
• AMEX CVV is 4 digits.
• Expiry date can be any future date for regular sandbox tests.
• Use invalid/expired dates only for failure testing scenarios.