Sandbox / test mode

Payparse uses Stripe-style test keys on the same API host. There is no separate sandbox base URL — point Odoo or your integration at https://api.payparse.ca (or your local URL) and use test keys.

Key prefixes

Mode	Publishable	Secret
Live	pp_pub_…	pp_live_…
Test	pp_pub_test_…	pp_live_test_…

Create Live or Test keys from the dashboard API Credentials page. Checkout sessions created with a test secret key are stored with livemode: false. Secret keys include checkout.write, payments.read, and events.read by default.

Never use live keys in CI or staging. Test Interac confirmation with simulate-payment — real email ingest ignores test sessions.

Developers dashboard

Merchants can exercise sandbox flows without pasting secret keys:

1. Open Developers (/dashboard/developers)
2. Preview checkout reuses a stable PREVIEW-SANDBOX test session (refreshed expiry; success/cancel return to Developers)
3. Simulate payment calls the cookie-authenticated BFF POST /api/sandbox/simulate (test sessions only)
4. Inspect recent events under Developers → Events

Create a test checkout

curl -X POST https://api.payparse.ca/v1/checkout/sessions \
  -H "Authorization: Bearer pp_live_test_YOUR_SECRET" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 25000,
    "currency": "cad",
    "reference": "TEST-INV-001",
    "success_url": "https://yoursite.com/success",
    "cancel_url": "https://yoursite.com/cancel"
  }'

The response includes "livemode": false.

Simulate Interac payment

Only pp_live_test_* keys may call this endpoint. Live keys receive 403. The session must belong to the key’s merchant, be livemode: false, and not be expired or already completed (for confirmed).

curl -X POST https://api.payparse.ca/v1/sandbox/simulate-payment \
  -H "Authorization: Bearer pp_live_test_YOUR_SECRET" \
  -H "Content-Type: application/json" \
  -d '{
    "sessionId": "cuid_session_id",
    "outcome": "confirmed"
  }'

You may pass reference instead of sessionId (case-insensitive). Outcomes:

Outcome	Transaction status	Webhooks (livemode: false)
confirmed	CONFIRMED, session → COMPLETED	checkout.session.completed, payment.confirmed
failed	FAILED	payment.failed
requires_manual_review	REQUIRES_MANUAL_REVIEW	payment.pending_review

Required scope

checkout.write

Webhook livemode

Outbound webhook bodies include a top-level livemode boolean (mirrors Stripe):

{
  "id": "evt_…",
  "type": "payment.confirmed",
  "created_at": "2026-07-16T12:00:00.000Z",
  "livemode": false,
  "data": {
    "reference": "TEST-INV-001",
    "amount": 25000,
    "status": "CONFIRMED"
  }
}

Sandbox simulations always send livemode: false. Live email reconciliation sends livemode: true.

Email ingest vs sandbox

The Cloudflare Email Worker / /v1/internal/ingest-email path only auto-confirms checkout sessions with livemode: true. Test sessions are confirmed exclusively via POST /v1/sandbox/simulate-payment (or the Developers dashboard BFF).

Test refunds

Test-mode refund requests are auto-approved. Completing a test refund does not require a real outbound Interac reference; the platform still emits a single payment.refunded event with livemode: false and marks the payment REFUNDED.