Skip to main content
Use your sandbox account to build and test your integration before going live. If you have not set up your account yet, start with Create an Account and Authentication.

​
Sandbox Environment

Sandbox and production run on the same system with the same base URL:
The only difference is your API key. Sandbox and production are two separate accounts on the same environment, so there are no surprises when you go live. To switch from sandbox to production, just swap your API key. Your sandbox account stays active alongside your live account, so you can continue running tests or developing new features at any time.

​
What’s included in sandbox

A sandbox account is a full replica of a production account. Every API endpoint, feature, and configuration option available in production works identically in sandbox. The only differences are:
  • Sandbox is limited to 100 tokenizations per month and 50 payment gateway (UPG) operations per month by default. Exceeding either limit blocks further use with a usage-limitation message. To increase your limit, contact support@pcibooking.net, explain why you need the increase, and the request will be reviewed - if approved, your limits are raised.
  • You can use PCI Booking’s built-in test gateways (NULLSuccess and NULLFailure) with no PSP account at all, or store your PSP’s own credentials. If the PSP offers a dedicated sandbox/test environment, your sandbox account is wired to it; if they don’t, sandbox falls back to that PSP’s production environment. Check the Universal Payment Gateway page or ask your PSP whether they offer one.
  • Sandbox and production have separate API keys, users, and stored data.
Need to stress-test or do high-volume testing beyond sandbox limits? Contact support@pcibooking.net - a separate live account can be set up for this purpose, billed alongside your regular production usage.

​
Test cards vs. real cards

PCI Booking’s own tokenization layer does not differentiate between “test cards” and “real cards.” The only requirements are that the card number passes the Luhn algorithm and, in some cases, that the expiry date is in the future. Sandbox and production accounts run on the same PCI-certified environment, so both offer the same level of security. The real limitation comes from third parties in your flow: PSPs and 3DS providers. Whenever a third party has a dedicated sandbox environment, that’s what your sandbox account talks to; testing against it generally requires that third party’s own test card data. The 3DS test cards below, for example, are the exact set our 3DS provider gave us for their sandbox, not universal test cards. This means a card that’s a valid 3DS test card is not necessarily valid for your PSP’s sandbox, and vice versa - the two sets rarely overlap. If you need to test 3DS and a PSP charge together, use one of PCI Booking’s built-in mock gateways (NULLSuccess or NULLFailure) for the PSP leg: perform 3DS authentication with a real 3DS test card as normal, then process the resulting transaction through the mock gateway instead of a PSP sandbox. This avoids needing a single card that satisfies both providers at once.
Using a real card in a sandbox account is only safe if every third party in the flow (PSP, 3DS provider) also has that request routed to its own sandbox. If any of them falls back to production because it doesn’t offer one, a real card triggers a genuine live transaction with that provider. When in doubt, use test cards.
PCI Booking offers free sandbox accounts for development and testing. Request a sandbox account to get started.

​
Test Cards

Use these card numbers in the sandbox environment. All test cards use any future expiry date.

​
Standard Test Cards

​
3D Secure Test Cards

For all 3DS test cards, use cardholder name Three DS test and CVV 123. Frictionless flow (authenticates automatically, no user interaction): Device fingerprint flow (collects device info for risk analysis): Challenge flow (requires OTP entry): Device fingerprint + challenge flow (fingerprint first, then OTP):

​
Go-Live Checklist

Before switching to production:
  • All API calls work correctly in sandbox
  • Error handling covers all API error codes
  • API keys are stored securely (environment variables, not source code)
  • Webhook endpoints (if used) are configured and tested
  • Production API keys obtained from your PCI Booking account
  • Sandbox API keys swapped for production API keys
Talk to our PCI experts for a pre-launch review.