Testing

​

Overview

Every Modulus API has a sandbox that mirrors production behavior with no real money moved. This page is the single reference for sandbox test data across all APIs: card numbers, simulation codes, activation codes, and the scenarios each one triggers. Sandbox and production use separate credentials and URLs.

​

Sandbox base URLs

​

Ecom: test cards

Use these cards on the hosted checkout (Payment Links) and in the JavaScript SDK. No real money moves. Challenge cards present a 3D Secure OTP step (enter 1234). Frictionless cards authenticate with no customer interaction. Any future expiry date and any 3-digit CVC work in sandbox.

​

Ecom: scenario matrix

What to run, what you should get back, and what to assert in your integration. See Errors for the full code catalog and 3D Secure for the challenge flow.

​

QR Ph: simulation

QR Ph has no card data. You generate a QR code, then drive outcomes with the Simulate Webhook API using a useCase value. The full step-by-step walkthrough (create, convert, decode, simulate, receive) lives in the QR testing guide. Sandbox activation code: A9X4-B7P2-Q6Z8-M3L5 Reusing the same merchantReferenceNumber is rejected as a duplicate. See the QR testing guide for the complete simulation flow and additional edge cases.

​

Transaction Reporting, Onboarding, Terminal Gateway

These APIs have no discrete card or simulation fixtures. Test them against the sandbox base URLs above using each API’s own auth - Transaction Reporting uses X-API-Key, Onboarding uses a Bearer JWT, and Terminal Gateway uses HMAC-signed headers (see each API’s Authentication page). Each endpoint’s reference page includes a complete sample request and response you can run directly: