Aller au contenu principal

Sandbox Environment

LodinPay's sandbox is a fully isolated copy of the production gateway. You can exercise the full integration — payment link generation, hosted page, SCA, webhook, return — without moving real money or affecting your KYB profile.

Sandbox endpoint​

https://api-preprod.lodinpay.com/merchant-service/extensions/pay/rtp
Production endpoint

Your production endpoint is provided during go-live onboarding. Do not point a live integration at the sandbox: production cards / IBANs will be rejected, and any successful test won't make it to real bank rails.

Sandbox credentials​

  1. Sign in to the Lodin Console.
  2. Go to Settings → API keys → Sandbox.
  3. Copy your sandbox Client ID and Client Secret.
  4. Enter them in your plugin configuration or your API client.

Sandbox credentials are separate from production credentials. You can rotate sandbox keys freely without operational risk.

Walking the full flow​

  1. Create a test order on your store (any amount ≥ 0.01 €).
  2. Select "Pay with Bank" at checkout.
  3. Get redirected to the Lodin sandbox hosted page (URL contains pay-preprod.lodinpay.com).
  4. Choose Test Bank (always available in sandbox) and complete SCA with the dummy credentials shown on-page.
  5. Land back on your return page after the simulated transfer.
  6. Verify on your server side: the webhook landed, the signature verified, the order moved to PAID.

What to verify before going live​

  • Payment link is generated (HTTP 200 with url in the body).
  • Customer is redirected to the hosted payment page.
  • Webhook arrives at your endpoint, signed and verifiable.
  • Order state transitions PENDING_PAYMENT → PAID.
  • webhook.amount matches order.amount (reconciliation passes).
  • Duplicate webhooks are no-ops (idempotency holds — replay the same event from the Console to confirm).
  • Failed payments set the order to PAYMENT_ERROR and restore the cart.
  • Return URL tampering is rejected (manually edit a parameter and confirm the return page errors out, but the order state stays correct).
  • Webhook handler responds 200 within 10 s, even under realistic load.
  • Logging is gated behind a debug flag — production won't dump client_secret or full request bodies.

See also​