Payment gateway testing: sandboxes, test cards, 3DS and webhook tests

What should you test?

Cover the full lifecycle, not only a successful payment.

• Approved payment, soft decline (for example insufficient funds) and hard decline.
• 3-D Secure frictionless and challenge flows, and an abandoned challenge.
• Authorisation and later capture, partial capture, void.
• Full and partial refunds, and a chargeback in sandboxes that simulate one.
• Each local method: redirects, app switches, pending and expired payments.
• Webhooks: delivery, duplicates, out-of-order events and signature checks.
• Timeouts and retries with the same idempotency key.

How do test cards work?

Each provider publishes test card numbers and special amounts or values that trigger outcomes such as declines or 3DS challenges. They work only in that provider's sandbox; test numbers differ between providers.

How do you go live safely?

The last step happens in production.

1. Switch keys Replace sandbox API keys and webhook secrets with live ones.
2. Check webhooks Confirm the live endpoint receives and verifies events.
3. Live test Make a small real payment with a company card.
4. Refund Refund it and confirm the refund webhook.
5. Monitor Watch approvals and errors closely for the first days.

How does OrsunPay help with testing?

OrsunPay is a payment orchestration platform: you keep your own contracts with licensed providers (for example Stripe, Adyen or Worldpay), and OrsunPay is not a payment institution, acquirer or merchant of record and does not hold or transmit funds. With OrsunPay you test one API and one webhook format against the sandboxes of all connected providers, including routing and retry rules. For OrsunPay pricing, see the pricing page at /pricing.