A checkout integration is tested in a provider sandbox with published test card numbers. Never send live card data to a test environment. Never send test numbers to a live endpoint.
Card Checkout Verification Process
Run everything in the sandbox
Stripe, Adyen, Braintree, and Checkout.com issue separate test API keys. Test keys carry a distinct prefix, such as sk_test_ at Stripe. Test mode accepts only numbers from the provider's published list. A live key inside a test script will create a real charge.
Test Checkout Flow for Card Payment Guide
PCI DSS applies to any system that stores, processes, or transmits a primary account number. Sandbox work stays outside that scope while the data is fake.
Card Checkout Procedure Testing Guide
Use published test cards
- 4242 4242 4242 4242: Visa, approves.
- 4000 0000 0000 0002: declines with a generic error.
- 4000 0000 0000 9995: declines for insufficient funds.
- 4000 0000 0000 3220: forces 3D Secure authentication.
- 4000 0000 0000 3063: forces a 3DS challenge the test user can fail.
Expiry accepts any future date. CVC accepts any 3 digits. These rules hold across most providers. Check the provider table before you hardcode a value.
card checkout verification process
Test these paths
- Successful authorization and capture.
- Authorization with a later capture.
- Decline at authorization.
- 3DS challenge pass and fail.
- Webhook delivery for payment_intent.succeeded and charge.refunded.
- Duplicate submit with the same idempotency key.
- Network timeout, then retry.
Webhooks and idempotency
Webhooks arrive out of order and more than once. Store the event ID and skip repeats. Send an idempotency key on every create call so a retry does not double charge. Replay a captured event payload against your handler and confirm the order state does not change.
Fraud controls
Card testing uses small live charges to check whether stolen numbers work. Rate limit by IP, card fingerprint, and email. Require CVC and 3DS. Block after a run of declines. Alert on many small authorizations from one device.
Go-live checklist
Swap test keys for live keys. Remove test numbers from fixtures. Point webhooks at the live endpoint. Confirm the 3DS configuration in the live account. Run one live charge with your own card.