Guide

Sandbox & test cards

Zazu provides a sandbox environment so you can integrate, test edge cases, and verify webhook handling without moving real money or charging real cards.

Accessing the sandbox#

Each region has a dedicated sandbox host alongside production. Sandbox and production data are isolated — keys, customers, payments, and webhooks created in one will not appear in the other.

Region	Sandbox dashboard	Sandbox API base
Morocco	`staging.zazu.ma`	`staging.zazu.ma/api`
South Africa	`staging.zazu.africa`	`staging.zazu.africa/api`

Generate a dedicated sandbox API key from the sandbox dashboard (Settings → Developer → API Keys). Production keys do not work against the sandbox and vice versa.

Test cards#

Use these card numbers on any sandbox hosted payment page. Any future expiry date, any 3-digit CVC, and any postcode are accepted.

Card number	Brand	Result
`4242 4242 4242 4242`	Visa	Payment succeeds
`5555 5555 5555 4444`	Mastercard	Payment succeeds
`4000 0000 0000 0002`	Visa	Card declined

Real card numbers are never charged on the sandbox. Submitting one returns a generic decline.

Reconciling payment state#

Two ways to confirm whether a sandbox payment succeeded:

API — GET the checkout session or payment link and check the status field.
Webhooks — listen for checkout_session.completed or payment_link.paid. Sandbox webhooks fire identically to production, signed with the same scheme.

Webhooks are the source of truth for fulfillment. Use the API endpoints for reconciliation or recovery when a webhook is missed.

A confirmed payment first reads clearing (credited, provider settlement pending, settled_at null) — sandbox included. Fulfill on checkout_session.completed / payment_link.paid; if you also track settlement, listen for checkout_session.settled / payment_link.payment_settled, which fire once settled_at is set.

Going live#

When your sandbox integration is stable:

Mint a fresh API key from the production dashboard (production keys can't be cloned from sandbox).
Switch your application's base URL from the sandbox host to production.
Replace test-card flows with real card collection (the hosted page handles PCI).
Re-register your webhook endpoint against the production dashboard.