Sandbox and test cards
Use the sandbox processor to develop without moving money. Sandbox credentials and resource IDs do not work in production.
| Purpose | Sandbox base URL |
|---|---|
| Account and billing APIs | https://staging-api.peakgateway.co |
| Checkout and direct payments | https://staging-pay.peakgateway.co |
| Token exchange | https://staging-api.peakgateway.co/auth |
Request a sandbox organization, location ID and API key from [email protected]. Ask support to confirm the location uses the sandbox processor. Create additional scoped keys in the dashboard. There is no shared public API key.
curl -sS -X POST 'https://staging-api.peakgateway.co/auth/oauth2/api-key/token' \
-H "X-Api-Key: ${PEAK_API_KEY}"
Use the returned access_token as Authorization: Bearer <ACCESS_TOKEN> on resource requests. Never expose the API key to a browser. The SDKs can exchange and cache tokens for you.
Test cards
Use a future expiration date and a test security code appropriate to the card brand. These numbers are only for the sandbox processor, not live processing.
| Card number | Brand | Default result |
|---|---|---|
4111111111111111 | Visa | Approved (A0000) |
5555555555554444 | Mastercard | Approved (A0000) |
378282246310005 | American Express | Approved (A0000) |
6011111111111117 | Discover | Approved (A0000) |
4000000000000002 | Visa | Declined (D2026) |
4000000000009995 | Visa | Insufficient funds (D2012) |
4000000000000069 | Visa | Expired card (D2011) |
4000000000000127 | Visa | CVV verification failed (D2020) |
The four approval cards follow configured card rules and approval rates; they approve at the default 100% rate. Custom sandbox rules can change results. Do not use real card or bank details in sandbox.
Exercise approval, decline, duplicate requests, signature failures and lost-response recovery before switching environments. Production processing requires separately issued production credentials and an approved location.