Testing

Credo's sandbox environment mirrors production exactly - same API, same endpoints, same behavior - but with no real money. Use it to test every part of your integration before switching to live keys.

Sandbox environment

Test cards

Testing bank transfers

When you initialize a transaction with initializeAccount set to 1, a virtual bank account is generated for the customer to transfer to.

In sandbox mode, bank transfers are simulated. After initializing:

1. Note the virtual account number from the payment page
2. The transaction auto-completes in sandbox (no actual transfer needed)
3. Verify the transaction to confirm the status

Testing the full flow

# Initialize a transaction
curl -X POST https://api.credodemo.com/transaction/initialize \
  -H "Authorization: YOUR_TEST_PUBLIC_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 50000,
    "email": "test@example.com",
    "currency": "NGN",
    "bearer": 0,
    "channels": ["CARD"],
    "initializeAccount": 0,
    "callbackUrl": "https://yoursite.com/callback"
  }'

curl https://api.credodemo.com/transaction/vs_xxxxxxxxxxxx/verify \
  -H "Authorization: YOUR_TEST_SECRET_KEY"

Testing direct card charge

If you're using the direct charge API:

curl -X POST https://api.credodemo.com/transaction/direct/initiate \
  -H "Authorization: YOUR_TEST_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 50000,
    "currency": "NGN",
    "reference": "TEST-DIRECT-001",
    "card": {
      "pan": "5399838383838381",
      "cvv": "470",
      "expiryYear": 2028,
      "expiryMonth": 10
    },
    "customer": {
      "email": "test@example.com"
    },
    "authorization": {
      "mode": "PIN",
      "pin": "1234"
    }
  }'

If the response indicates OTP is required, authorize with:

curl -X POST https://api.credodemo.com/transaction/direct/authorize \
  -H "Authorization: YOUR_TEST_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "transRef": "vs_xxxxxxxxxxxx",
    "authorization": {
      "mode": "OTP",
      "otp": "123456"
    }
  }'

What to test

Use this checklist to validate your integration before going live:

Payment flow

• Transaction initializes successfully
• Customer is redirected to checkout page
• Payment completes with test card
• Customer is redirected back to your callbackUrl
• Transaction verifies with status 0

Verification logic

• Amount matches what you expected
• Currency matches
• Business reference matches your order
• Duplicate payments are handled (same transRef isn't processed twice)

Webhooks

• Webhook is received at your endpoint
• X-Credo-Signature verification passes (SHA512 of secretKey + businessCode)
• Handler processes all event types: transaction.successful, transaction.failed, transaction.transaction.transfer.reverse, transaction.settlement.success
• Duplicate webhooks are handled idempotently (use transRef + event as key)

Error scenarios

• Declined card shows appropriate message to customer
• Network timeout during verification is retried
• Invalid API key returns 401 and is handled
• Missing required fields return clear error messages

Edge cases

• Customer closes browser mid-payment (webhook still arrives)
• Very large amounts work correctly (watch for integer overflow)
• Special characters in customer names don't break anything
• Concurrent transactions don't interfere with each other

Switching to production

When all tests pass:

# Environment variables
CREDO_API_URL=https://api.credocentral.com
CREDO_PUBLIC_KEY=your_live_public_key
CREDO_SECRET_KEY=your_live_secret_key

Next steps