Key points
- Exercise success, failure, expiration, refund, and webhook retry scenarios before going live.
- Sandbox and live keys, ledgers, and webhook endpoints are separate. Public HTTPS is still required for notify_url.
Use sandbox keys to test the full payment lifecycle without real money: the scenarios worth covering, test card numbers, and simulated wallets and 3D Secure.