The PayCA sandbox runs the whole EUR card flow from EUR Card Top-ups and Payouts: quotes, top-ups with 3-D Secure, payouts, statuses, webhooks and the account ledger. No card is charged and no money moves. The same API calls work in production unchanged; only the base URL and your credentials differ.

Setup #

export PAYCA_BASE_URL="https://b2bapi.stage.payca.vc"
export PAYCA_CLIENT_ID="<your sandbox client id>"
export PAYCA_CLIENT_SECRET="<your sandbox client secret>"

Ask your PayCA contact to enable EUR card top-ups and payouts for your sandbox client. Send them the HTTPS prefixes of your return pages, for the 3-D Secure redirect. Once it is done, GET /v1/client/settings lists EUR in cardFundingCurrencies, and GET /v2/accounts/{accountId}/payout-options of an EUR account lists the card payout.

Register your deposit and payout webhook endpoints on the sandbox as described in Webhooks. Sandbox webhooks are signed and retried like production ones.

Test Cards #

The card number decides what happens. Any expiry date in the future and any three-digit CVV work. Every number below passes the Luhn check.

Card number Scheme Top-up Payout
4242424242424242 Visa Succeeds at once, no 3-D Secure Succeeds
5555555555554444 Mastercard Succeeds at once, no 3-D Secure Succeeds
4000000000003220 Visa Asks for 3-D Secure Succeeds
4000000000000002 Visa Declined at once (issuer declined) Declined
5105105105105100 Mastercard Declined at once (issuer declined) Declined
4000000000009995 Visa Declined at once (insufficient funds) Declined
4000000000000077 Visa In progress, then succeeds Stays in progress until PayCA decides it
Any other valid Visa or Mastercard — Asks for 3-D Secure Succeeds

More cases:

  • Expired card. An expiry month in the past declines the top-up or payout.
  • Mistyped number. A number that fails the Luhn check is declined.
  • Other schemes. American Express and others are refused with 400 before anything is created, as in production.

A payout reaches its final status about 10 seconds after it is created. Until then it is processing.

Use only these numbers, or numbers you made up. Never enter a real card in the sandbox.

The Sandbox 3-D Secure Page #

When a top-up asks for 3-D Secure, the deposit carries checkoutUrl, as in production. Redirect the user's browser to it. In the sandbox it opens a page at https://checkout.stage.payca.vc that shows the amount and the last four digits of the card, and lets you choose the issuer's answer:

Button Top-up status The browser returns to
Authenticate processing, then completed completeRedirectUrl
Fail authentication (with a decline reason) failed cancelRedirectUrl
Cancel cancelled cancelRedirectUrl

A page that is left open for 30 minutes expires, and the top-up becomes expired.

As in production, the return to your page is not the result. Read the deposit, or wait for the webhook.

What Differs from Production #

  • Settlement. In production a successful top-up is credited about four business days after the payment (Settlement). Sandbox clients are set to zero days, so the top-up goes from processing to completed within seconds. Ask your PayCA contact if you want to rehearse the wait.
  • Refunds and chargebacks cannot be triggered from the API. Ask your PayCA contact to refund a sandbox top-up, or to hold or decide a payout, when you want to see those webhooks.
  • Balances. Sandbox balances are not real money. Your PayCA contact can top up a sandbox account so that you can rehearse payouts.
  • Payer screening. Every field of the payer profile is still required and checked for format, but no person is screened. Use invented people.

Checklist #

  1. A top-up with 4242424242424242 reaches completed, and your deposit webhook receives it.
  2. A top-up with 4000000000003220 returns checkoutUrl. Authenticate on the page: your user lands on completeRedirectUrl, and the top-up reaches completed.
  3. The same with Fail authentication: cancelRedirectUrl, failed, and declineFee debited.
  4. A top-up with 4000000000000002 is failed without a redirect.
  5. A create repeated with the same Idempotency-Key returns the same top-up.
  6. A payout to 4242424242424242 goes processing, then completed; the hold becomes a debit.
  7. A payout to 4000000000000002 goes failed, and the hold returns to available.