Testing
Sandbox usage, webhook testing, and production-readiness checks for Cobru integrations.
Start here
- Refresh an access token in sandbox.
- Create a real payment from your backend.
- Open the hosted payment URL built from the returned
urlslug. - Confirm redirect handling and callback handling in your own system.
- Record enough evidence to debug the run later.
Sandbox environment
| Property | Value |
|---|---|
| Base URL | https://dev.cobru.co |
| Purpose | development, QA, integration debugging |
| Credentials | separate from production |
| Fees | not representative of production economics |
| Recommended use | auth validation, payment creation, hosted checkout, webhook handling, QR/BRE-B flow testing |
Treat sandbox as a behavior-validation environment, not as a source of truth for production economics, settlement timing, or support procedures.
Recommended test flow
- Refresh an access token.
- Create a payment in sandbox.
- Build the hosted payment URL from the returned
urlslug. - Complete the flow manually through Cobru's page.
- Confirm your webhook receives the expected state update.
Minimum integration test matrix
| Scenario | What to verify |
|---|---|
| Token refresh | POST /token/refresh/ works with your credential storage and cache strategy |
| Payment creation | your backend sends payment_method_enabled as a JSON string and gets 201 |
| Hosted payment URL | your app uses response.url, not response.pk, to build the checkout URL |
| Redirect handling | payer_redirect_url resolves correctly after payment completion |
| Callback handling | your webhook endpoint persists, deduplicates, and acknowledges callbacks fast |
| Payment lookup | your system can reconcile the payment after a callback or manual support action |
Recommended test accounts and fixtures
- one low-value order for smoke tests
- one order with BRE-B enabled
- one order with multiple payment methods enabled
- one invalid payload fixture to confirm error normalization
- one webhook replay fixture for idempotency checks
Local webhook testing
ngrok http 3000Use the generated HTTPS URL as your callback field in the payment creation request.
What to record during every test run
- request body sent to Cobru
- raw Cobru response body
- generated payment URL
- every webhook payload
- your own reconciliation result
- the internal order ID or payment reference you mapped to Cobru
Common sandbox pitfalls
Exit criteria before production
- you can create and complete a payment end to end from your app
- you can persist and deduplicate callbacks
- you can manually reconcile a payment from Cobru data plus your own order state
- your logs include enough information to debug a failed payment without guessing
- your credentials are not hardcoded anywhere outside secure environment storage
Read next
/docs/production-readiness/docs/webhooks/docs/troubleshooting/docs/errors