Sandbox & Testing
The Strictly API uses a single environment for both sandbox and production — the behavior is controlled by the merchant account you authenticate with. Sandbox merchant accounts process test transactions that never touch real money.
Getting sandbox access
To test against the API you need a Strictly merchant account configured in sandbox mode. Contact your account manager or reach out to us to request one.
Once your sandbox account is ready, you'll receive:
| Credential | Where to find it |
|---|---|
| Your merchant account email | |
| Password | Your merchant account password |
| Key-hash | Dashboard → Administration → Security Keys |
| Base URL | https://api.paywithzero.net/v1 (same for sandbox and production; the API Reference may show the development host api.zerospay.com) |
Sandbox mode is enabled per merchant account — it is not a separate environment or base URL. Use your sandbox account credentials to test, and your production account credentials to go live.
Test payment token
The recommended sandbox approach is to use a test payment token instead of raw card numbers.
Tokenize a card first (or use the pre-built test token below) and pass it as card.paymentToken in charge requests.
| Field | Value |
|---|---|
Test paymentToken | 00000000-000000-000000-000000000000 |
This token simulates a successful card charge in sandbox. Pass it as card.paymentToken in your charge request.
To simulate a declined transaction, set amount below 100 cents (less than $1.00, e.g. 50).
Test card numbers
If you prefer to use raw card numbers (e.g. for the /tokenize endpoint), these test values work in sandbox:
Standard test cards
Use expiration 10/29, any 3-digit CVV, and any billing ZIP code.
| Brand | Card number | Type |
|---|---|---|
| Visa | 4111 1111 1111 1111 | Credit |
| Visa | 4000 0000 0000 0002 | Credit |
| Mastercard | 5115 0555 5555 5551 | Credit |
| Mastercard | 5121 2121 2121 2124 | Debit |
| Discover | 6011 9737 0000 0005 | Credit |
| Discover | 6011 4023 4444 4445 | Debit |
| American Express | 3700 0000 0000 002 | Credit |
Additional test cards
| Brand | Card number |
|---|---|
| Visa | 4124 9399 9999 9990 |
| Mastercard | 2223 0000 1000 5251 |
| Discover | 6011 3083 5555 5559 |
| American Express | 3700 0009 9999 9990 |
Triggering specific outcomes
| Scenario | How to trigger |
|---|---|
| Approved transaction | Use any valid test card with amount ≥ 100 ($1.00) |
| Declined transaction | Set amount below 100 cents (e.g. 50) |
| Fatal / invalid card error | Use an invalid card number format |
Test ACH
For ACH (bank transfer) testing, use any routing and account numbers. Test transactions are processed in sandbox mode and do not initiate real transfers.
An ACH payment becomes refundable 6 minutes after the charge, even in sandbox; before that,
cancel it with POST /public/ach/void. Partial refunds are supported up to the remaining refundable
balance, except for WEB SEC merchants, which must refund the exact original amount. See
Refund an ACH payment in the reference.
What differs in sandbox
- No real money moves — all transactions are simulated
- Emails are suppressed — invoice and payment request emails are not delivered to recipients
- Webhooks fire normally — your webhook endpoint will still receive events, so you can test end-to-end flows
Even though the sandbox does not charge cards, never send real payment credentials in test requests.
Simulating webhook events
When you create a payment in sandbox, the corresponding webhook events are fired in real-time (if you have a webhook endpoint configured). This lets you test your full event-handling pipeline without any real transactions.
See Webhooks for how to configure and verify webhook deliveries.
Moving to production
When you're ready to go live:
- Replace your sandbox account credentials with your production
email,password, andkey-hash - The base URL stays the same:
https://api.paywithzero.net/v1 - Ensure your server is not logging raw request bodies that include card numbers