Skip to main content
Sandbox is a separate environment with its own keys. Nothing you do there touches real money or real cards.

​
Switching environments

The base URL is the same in both environments — your key determines which one you hit.
Test keys are marked as such in the key itself, so a key intended for testing cannot accidentally charge a real card.
Test and live keys are issued as a matching set: a test public key only works alongside a test secret key and the test encryption key. Mixing an encryption key from one environment with an API key from the other produces a 400 — Something went wrong while trying to decrypt your payload.

​
What only exists on sandbox

The encryption helper is the big one. If your integration calls it, it will break the moment you point at production. Implement encryption yourself before going live.

​
Test cards

Card numbers, expiry dates and CVVs for the various authentication paths — 3-D Secure, no-auth, declines — are issued with your sandbox credentials. Contact Reeple if you don’t have them.
The authentication path is driven by the card you use, plus the optional authOption field: See Pay with a card for the exact payloads.

​
Testing bank transfers

List banks returns real bank codes on sandbox. Pay with one, and the response gives you a recipientAccount. On sandbox no real transfer is needed — settlement is simulated.

​
A checklist before going live

1

Your own encryption works

Run a full create, pay and status cycle without calling /charge/data/encrypt at all.
2

You poll to a final status

Confirm you branch on isFinalStatus, not on the pay-order response.
3

You verify server-side

Confirm Verify an order runs with your secret key from your backend before anything is fulfilled.
4

Fulfilment is idempotent

Verify the same reference twice and confirm the order is only fulfilled once.
5

You handle pending

Confirm a payment that never completes leaves the order pending rather than failed, and that a backend job reconciles it.
6

Swap the keys

Replace test keys — all three — with live ones. See Authentication.