Guide

# Sandbox & test cards

Zazu provides a sandbox environment so you can integrate, test edge cases, and verify webhook handling without moving real money or charging real cards.

## Accessing the sandbox

Each region has a dedicated sandbox host alongside production. Sandbox and production data are isolated — keys, customers, payments, and webhooks created in one will not appear in the other.

| Region | Sandbox dashboard | Sandbox API base |
| --- | --- | --- |
| Morocco | `staging.zazu.ma` | `staging.zazu.ma/api` |
| South Africa | `staging.zazu.africa` | `staging.zazu.africa/api` |

Generate a dedicated sandbox API key from the sandbox dashboard (Settings → Developer → API Keys). Production keys do not work against the sandbox and vice versa.

## Test cards

Use these card numbers on any sandbox hosted payment page. Any future expiry date, any 3-digit CVC, and any postcode are accepted.

| Card number | Brand | Result |
| --- | --- | --- |
| `4242 4242 4242 4242` | Visa | Payment succeeds |
| `5555 5555 5555 4444` | Mastercard | Payment succeeds |
| `4000 0000 0000 0002` | Visa | Card declined |

> **Note:** Real card numbers are never charged on the sandbox. Submitting one returns a generic decline.

## Reconciling payment state

Two ways to confirm whether a sandbox payment succeeded:

- **API** — GET the checkout session or payment link and check the status field.
- **Webhooks** — listen for checkout_session.completed or payment_link.paid. Sandbox webhooks fire identically to production, signed with the same scheme.

> **Tip:** Webhooks are the source of truth for fulfillment. Use the API endpoints for reconciliation or recovery when a webhook is missed.

A confirmed payment first reads `clearing` (credited, provider settlement pending, `settled_at` null) — sandbox included. Fulfill on `checkout_session.completed` / `payment_link.paid`; if you also track settlement, listen for `checkout_session.settled` / `payment_link.payment_settled`, which fire once `settled_at` is set.

## Going live

When your sandbox integration is stable:

1. Mint a fresh API key from the production dashboard (production keys can't be cloned from sandbox).
2. Switch your application's base URL from the sandbox host to production.
3. Replace test-card flows with real card collection (the hosted page handles PCI).
4. Re-register your webhook endpoint against the production dashboard.