Testing with processors

Most payment processors give you two completely separate environments: a test (sandbox) account for trying things out, and a live account for taking real money. They have separate logins, separate credentials, and separate data.

Use the right cards in the right place

• In a test environment, only ever use the processor’s test cards. Test cards are fake numbers that simulate approvals, declines, and other outcomes without any money moving.
• In a live environment, only ever use real cards for genuine transactions.

Never mix the two. Don’t put a real card into a test environment, and don’t use test cards in live.

Putting real cardholder data through a non-production environment is a breach of the PCI DSS rules that govern how card data must be handled — test environments are not built to protect real card numbers. And test cards in a live environment simply won’t work, and may be flagged as fraud.

Test and live don’t promote

A test account is not a draft of your live account. There is no promotion of a test account — its configuration or its data — into live. The two are entirely independent. When you’re ready to go live, you connect the live account separately and set it up in its own right.

Where to find each processor’s test cards

Every processor has its own test cards. Each one is listed on that processor’s page under Processors — look for the Test cards link in the At a glance section, which takes you straight to that processor’s official test card details.

Where a processor doesn’t publish test cards openly, request them from the gateway directly.