Test API

Charge

Simulate card charges in the test environment. All transactions are simulated and do not process real funds. Use your test API key with /api/test/charge.

Important

Send requests to /api/test/charge with your test API key. For card numbers and expected outcomes, see the Test Cards reference.

Card Charge

POST/api/test/charge

EncryptedAPI Key

Payload encryption required. Encrypt the request JSON and send { "payload": "<iv>:<ciphertext>" }. Decrypt the response payload field. Encryption guide →. Do not share your API key or Encryption Key with anyone.

Uses the test gateway for sandbox testing. Request and response shapes match the live endpoint.

Same request body as the live endpoint. Use test card numbers below or on the Test Cards page.

Important

All payment API requests must be encrypted on your server before sending. Build the JSON below, encrypt it with your Encryption Key, and POST {"payload": "<iv_hex>:<ciphertext_hex>"}. Do not share your API key or Encryption Key with anyone — use them only on your backend. See the Encryption guide for code examples.

Request structure (encrypt this JSON)

{
  "merchantOrderId": "ORD-12345",

  "payment": {
    "amount": 100,
    "currency": "USD"
  },

  "card": {
    "number": "4539148800003011",
    "expiryMonth": 12,
    "expiryYear": 2031,
    "cvv": "123",
    "holderName": "John Doe"
  },

  "customer": {
    "firstName": "John",
    "lastName": "Doe",
    "email": "john@example.com",
    "ip": "185.23.44.91"
  },

  "billing": {
    "addressLine1": "12, Hill",
    "city": "Nevada",
    "state": "Nevada",
    "country": "US",
    "postalCode": "12345"
  },

  "callback": {
    "webhookUrl": "https://your-domain.com/webhook",
    "returnUrl": "https://your-domain.com/payment/callback"
  }
}

Wire format (send this to the API)

Encrypted request body

{
  "payload": "3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a:8e4f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f0"
}

Request Parameters

Single reference table grouped by JSON object. Nested fields use dot notation (e.g. payment.amount).

Field	Type	Required	Description
Order
merchantOrderId	string	Required	Unique order identifier from your system
merchantProfileId	number	Optional	Merchant profile ID. Defaults to your PRIMARY profile if omitted
terminalId	string	Optional	Terminal ID to route the charge to a specific MID (skips routing/cascading)
description	string	Optional	Human-readable payment description
metadata	string	Optional	Additional data as a JSON string
source	string	Optional	Payment source. Use 'link' when charging via a payment link token
token	string	Optional	Payment link token (required when source is 'link')
Paymentpayment
payment.amount	number	Required	Payment amount (minimum 0.01)
payment.currency	string	Required	Currency code (3 letters, e.g. USD, EUR)
Cardcard
card.number	string	Required	Card number (13–19 digits)
card.expiryMonth	number	Required	Expiry month (1–12)
card.expiryYear	number	Required	Expiry year (4 digits)
card.cvv	string	Optional	CVV code (3–4 digits)
card.holderName	string	Optional	Name printed on the card
Customercustomer
customer.firstName	string	Required	Customer first name
customer.lastName	string	Required	Customer last name
customer.email	string	Required	Customer email address
customer.phoneNumber	string	Optional	Customer phone number
customer.ip	string	Optional	Customer IPv4 address for risk checks. Falls back to the request IP if omitted
Billingbilling
billing.addressLine1	string	Required	Billing street address
billing.city	string	Required	Billing city
billing.state	string	Required	Billing state or region
billing.country	string	Required	Billing country (2-letter ISO code)
billing.postalCode	string	Required	Billing ZIP or postal code
Callbackcallback
callback.webhookUrl	string	Required	Webhook URL for transaction status notifications
callback.returnUrl	string	Required	URL to redirect the customer after payment or 3DS
callback.cancelUrl	string	Optional	URL to redirect if the customer cancels

Test Card Numbers

Card Number	Scenario	Auth	Status	Description
4539148800003010	3D Secure authentication	3DS	REDIRECT	Triggers a 3D Secure flow. The API returns a redirect URL in the is3DS field. Send the customer to that URL to complete authentication.
4539148800003011	Successful payment (2D)	2D	SUCCESS	Simulates a frictionless approval with no 3DS step. The transaction completes immediately with a SUCCESS status.
4539148800003012	Declined payment (2D)	2D	FAILED	Simulates an issuer decline with no 3DS step. The API returns success: false with status FAILED, error.code DECLINED, message, and full data (merchantOrderId, transactionId, amount, currency, customer fields). The wire response remains encrypted.

Response: 3D Secure (card 4539148800003010)

Important

When the card requires 3DS, the response has status: "REDIRECT" and an is3DS URL. Redirect the customer to that URL to complete authentication.

Important

All payment API responses — including success, declined, failed, and validation errors — are returned encrypted when you are authenticated. The wire body is {"success": true|false, "payload": "<iv_hex>:<ciphertext_hex>"}. Decrypt payload with your Encryption Key to read the standard JSON documented below. Outer success mirrors the decrypted outcome (false for declines and errors). Do not share your Encryption Key or API key — keep both on your server only.

Wire format (from API)

{
  "success": true,
  "payload": "7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7:4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8"
}

After decryption

3DS redirect

200

{
  "success": true,
  "status": "REDIRECT",
  "data": {
    "amount": 11,
    "currency": "USD",
    "merchantOrderId": "e21be056-d0c2-4003-be28-28dc88684b35",
    "transactionId": "FP2603YFGPKSWF0060",
    "firstName": "John",
    "lastName": "Doe",
    "address": "12, Hill",
    "city": "Nevada",
    "state": "Nevada",
    "country": "US",
    "email": "john@example.com",
    "webhookUrl": "https://your-domain.com/webhook"
  },
  "is3DS": "https://api.payoflux.com/payment/sandbox/card?transactionId=FP2603YFGPKSWF0060"
}

Response: 2D Success (card 4539148800003011)

Wire format (from API)

{
  "success": true,
  "payload": "7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7:4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8"
}

After decryption

2D success

200

{
  "success": true,
  "status": "SUCCESS",
  "data": {
    "amount": 11,
    "currency": "USD",
    "merchantOrderId": "e21be056-d0c2-4003-be28-28dc88684b35",
    "transactionId": "FP2603YFGPKSWF0060",
    "firstName": "John",
    "lastName": "Doe",
    "address": "12, Hill",
    "city": "Nevada",
    "state": "Nevada",
    "country": "US",
    "email": "john@example.com",
    "webhookUrl": "https://your-domain.com/webhook"
  }
}

Response: 2D Failed (card 4539148800003012)

Important

Wire format (from API)

{
  "success": true,
  "payload": "7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7:4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8"
}

After decryption

2D declined

200

{
  "success": false,
  "status": "FAILED",
  "message": "Transaction declined by issuer",
  "error": {
    "code": "DECLINED",
    "message": "Transaction declined by issuer"
  },
  "data": {
    "amount": 11,
    "currency": "USD",
    "merchantOrderId": "e21be056-d0c2-4003-be28-28dc88684b35",
    "transactionId": "FP2603YFGPKSWF0060",
    "firstName": "John",
    "lastName": "Doe",
    "address": "12, Hill",
    "city": "Nevada",
    "state": "Nevada",
    "country": "US",
    "email": "john@example.com",
    "webhookUrl": "https://your-domain.com/webhook"
  }
}

Full Test Cards Reference