Sandbox mirrors live behavior closely enough that most integration bugs show up here before they reach production — but a few things behave differently on purpose. This page is a checklist for exercising your integration end to end before going live.
Getting access
See Authentication → Sandbox for how to provision a sandbox account and retrieve your sandbox API key. Sandbox requests go to https://sandbox.dev.business.mamopay.com/manage_api/v1, separate from the production https://business.mamopay.com/manage_api/v1.
Test cards
Use these with CVV 123 and expiry 01/28 on any sandbox payment link (Create Payment Link has the canonical copy of this table):
| Card Number | Outcome | 3DS | Address required | Country |
|---|---|---|---|---|
4659 1055 6905 1157 | Success | No | No | GB |
4242 4242 4242 4242 | Success | Yes | No | GB |
4111 1111 1111 1111 | Success | Yes | Yes | US |
4567 3613 2598 1788 | Fail | No | No | GB |
4095 2548 0264 2505 | Fail | No | Yes | US |
If a card triggers 3DS, enter Checkout1! when prompted for the password.
Card origin in sandbox responses still reports UAE card or International card based on the test card's country above — use it to test both fee paths on your side.
Register webhooks separately per environment
Sandbox and live are separate environments with separate API keys, which means a webhook registered against your production key does not fire for sandbox events and vice versa. Register your endpoint in both environments if you want to test the webhook path in sandbox — see Register a Webhook. Everything else (retry policy, auth_header verification, idempotent handling) behaves identically between the two; see Webhook delivery & retries.
Settlement timing is slower by default
Sandbox settlement defaults to a multi-day delay (unlike live, where settlement is same-day or next-day — see Payment Object). This means a sandbox payment won't be immediately available for a payout, which can block end-to-end payout testing. If this is in your way, ask your Mamo contact to switch your sandbox account's settlement period to immediate.
Don't trust redirect query params in tests either
If you're testing the hosted checkout redirect flow, the status query param appended to your return_url is client-side and can be tampered with or missed — the same caution applies in sandbox as in production. Confirm the real outcome via a webhook or by calling Fetch Payment Link Info / the transaction info endpoint, not the redirect URL. See Create Payment Link for the full param list.
Idempotency keys work the same way
Idempotency-Key retention (about 7 days) and conflict behavior are identical in sandbox — see Idempotency. Sandbox and live keys are scoped separately (different API key, different account), so reusing a key across environments is safe and won't collide.
Marketplace / split payments
If you're integrating payouts_share, see Marketplace & Split Payments — the settlement-delay note above is the main sandbox-specific wrinkle for testing recipient payouts end to end.