API credentials
Allow-list of (x-API-key, merchantAccount) pairs. A wrong key gets the documented 401 errorCode 000; a valid key with an unpaired merchantAccount gets 403 "010 Not allowed".
Webhook settings
Standard-webhook URL and the HMAC key (hex) — the key must match the backend, or verification breaks (which is itself a useful test).
Payments & sessions
Everything the backend created. Resending fires AUTHORISATION for the CURRENT state (duplicate-delivery testing).
Test triggers
| Trigger | Behavior |
|---|---|
| 4111 1111 4555 1142 | Visa — Authorised, no 3DS |
| 5555 5555 5555 4444 | Mastercard — Authorised, no 3DS |
| 4917 6100 0000 0000 | Visa 3DS2 — RedirectShopper → hosted challenge |
| 5454 5454 5454 5454 | Mastercard 3DS2 — RedirectShopper → hosted challenge |
| holderName: DECLINED | Refused / "Refused" (code 2) |
| holderName: CARD_EXPIRED | Refused / "Expired Card" (code 6) |
| holderName: INVALID_CARD_NUMBER | Refused / "Invalid Card Number" (code 8) |
| holderName: NOT_ENOUGH_BALANCE | Refused / "Not enough balance" (code 12) |
| holderName: CVC_DECLINED | Refused / "CVC Declined" (code 24) |
| any other PAN | Authorised (emulator liberty) |
Webhook deliveries
Requests from the backend
Danger zone
wipes payments, logs and every runtime override — back to configured defaults