Sandbox Overview

The Sandbox is a fully isolated copy of the Spayon payment flow. It uses the same API structure, the same session shape and the same callbacks as Production, but no real payment provider is ever contacted and no money moves.

Use it to build and verify your integration before going live.

Same code, no changes

Sandbox uses the same request and response formats as Production. When you switch to live, only the base URL and your credentials change — no code changes.

Getting access

Sandbox is enabled per vendor by Spayon. Contact support to have it switched on for your account.

Once enabled:

• Your admin panel switches to Sandbox mode — a banner appears at the top, and Sessions and Transactions show sandbox data only
• A separate Sandbox Client ID and Sandbox Client Secret appear under Settings
• Your live credentials are hidden while sandbox is on, and return when it is disabled

If you are a super vendor, open My Profile → your vendor to see that vendor's sandbox credentials.

Credentials are not interchangeable

Sandbox credentials only authenticate against sandbox endpoints, and live credentials only against live endpoints. A sandbox session ID is not recognised by the live API, and vice versa — the two environments store their data separately.

Base URLs

	Production	Sandbox
Token	https://api.spayon.io/api/tokens	https://api.spayon.io/api/sandbox/vendor/tokens
Checkout session	https://api.spayon.io/api/vendor/checkout-session	https://api.spayon.io/api/sandbox/vendor/checkout-session
Swagger	Production docs	Sandbox docs

Sandbox runs on the same host as Production, under the /api/sandbox path. There is no separate domain to allow-list.

Authentication

Identical to Production — exchange your credentials for a 1-hour Bearer token:

POST https://api.spayon.io/api/sandbox/vendor/tokens
Content-Type: application/json

{
  "client_id": "YOUR_SANDBOX_CLIENT_ID",
  "client_secret": "YOUR_SANDBOX_CLIENT_SECRET"
}

Creating a session

Identical to Production. See Create Payment Session for the full request body.

POST https://api.spayon.io/api/sandbox/vendor/checkout-session
Authorization: Bearer YOUR_SANDBOX_TOKEN

The response returns a session_url on the sandbox checkout:

{
  "status": "pending",
  "order_id": "your-order-id",
  "session_id": "16c4af36-bd41-4794-996e-930909aa2851",
  "session_url": "https://pay.spayon.io/sandbox/session/16c4af36-bd41-4794-996e-930909aa2851"
}

Open that URL to walk the payment journey. See Testing Payments.

Fields not supported in sandbox

Field	Behaviour
product_id	Rejected — sandbox has no product catalog. Use product_name, price and currency instead
category_id	Rejected — same reason

defaultPaymentMethod and availablePaymentMethods are accepted and stored, so your live request body works unchanged. They do not yet affect which methods the sandbox checkout displays.

Callbacks

Sandbox fires the same callbacks as Production, to the same callback_url, with the same payload and retry policy (3 retries over 5 minutes).

The X-Signature header is an HMAC-SHA256 of the raw request body, signed with your Sandbox Client Secret. Verify it exactly as you do in production, just with the sandbox secret.

See Callbacks & Returns for the payload shape.

Differences from Production

	Production	Sandbox
Payment providers	Real acquirers	None — outcomes are chosen by you
Payment methods shown	Your configured methods	Currently a single card option
Money movement	Real	None
Wallet and balance	Yes	Not represented
Receipt emails	Sent	Not sent
Callbacks	Yes	Yes, identical

Your data is kept

Disabling sandbox mode hides your sandbox sessions and transactions — it does not delete them. Re-enabling sandbox restores the full history.

Callback and Return URLs are shared

The Callback URL, Return URL and Contact Email in your settings are shared between sandbox and live. Changing them while in sandbox also changes them for real payments.

To test against a different endpoint, send callback_url and return_url on each sandbox checkout session instead of changing your account settings.