# Testing Guide

Test your AuxCORE integration on **Sandbox** before production go-live.

---

## Test environments

| Environment | Public API base |
|-------------|-----------------|
| Sandbox | `https://uat.auxcore.net/api/v1/public` |

Use the same host you log into for the dashboard. Production (`app.auxcore.net`) uses live cards — do not use test PANs there.

---

## Credentials

1. Log in to the Sandbox dashboard  
2. Open **Settings → Developer & Integrations → API Keys** — create a **Secret** key (Your server or backend) for curl/Postman  
3. For website tests, create an **SDK Embed** key (`lpk_live_…`)  

Sandbox and production keys use the same prefixes (`api-…`, `lpk_live_…`) — the `live` in `lpk_live_` does not mean production. A key belongs to the host you created it on: a key from `uat.auxcore.net` only works against `uat.auxcore.net`, and returns `401` on `app.auxcore.net`.

Optional: use **Settings → Developer & Integrations → SDK & API Docs** (`/settings/developer/sdk`) for a live SDK test without writing HTML.

---

## Test connection

```bash
export BASE="https://uat.auxcore.net/api/v1/public"
export API_KEY="your-secret-key"

curl -X POST "$BASE/testConnection" \
  -H "x-api-key: $API_KEY"
```

---

## Test sale (approved)

The API rejects raw `CardNumber` / `CVV` on Sandbox and Production with `400 PCI_SCOPE_VIOLATION`. Tokenize a [test card](#test-cards) first, then charge the returned `pciToken`. On Sandbox you can tokenize from your server with a secret key:

```bash
curl -X POST "$BASE/tokenize-card" \
  -H "x-api-key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"cardNumber": "4111111111111111", "expiryMonth": "12", "expiryYear": "2030", "cvv": "123"}'
# → { "success": true, "data": { "pciToken": "pci_tok_…", "last4": "1111", ... } }

export PCI_TOKEN="pci_tok_…"   # data.pciToken from the response

curl -X POST "$BASE/transaction" \
  -H "x-api-key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "Amount": 25.00,
    "SuggestedMode": "Card",
    "pciToken": "'"$PCI_TOKEN"'",
    "BillingCustomerName": "Test User",
    "BillingEmail": "test@example.com"
  }'
```

Save `data.TransactionId` from the response. Approval: HTTP 200, `data.Status` `"1"`, `data.ResponseCode` `"100"`.

In production, collect cards in the browser with the [PCI SDK](./sdks.md) instead: posting card numbers from your server puts it in PCI scope.

---

## Test decline

Tokenize card `4000000000000002` and charge the resulting `pciToken` — on most sandbox processors this returns HTTP **402** with `"status": "declined"` and `data.Status` `"9"` (the outcome may vary by processor).

---

## Void, refund, capture

```bash
TXN="550e8400-e29b-41d4-a716-446655440020"   # data.TransactionId from the sale

# Full refund (add "amount" for a partial refund)
curl -X POST "$BASE/refund" \
  -H "x-api-key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"transactionId\": \"$TXN\"}"

# Void (unsettled sale)
curl -X POST "$BASE/void" \
  -H "x-api-key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"transactionId\": \"$TXN\"}"
```

For auth-only, send `"TransactionType": "auth"` on `/transaction`; capture it later with the dashboard API — see [Captures →](../core/captures.md).

---

## SDK embed test

1. Create SDK Public key at `/settings/developer/api-keys`  
2. Open **Settings → Developer & Integrations → SDK & API Docs** → **No-Code SDK** tab  
3. Paste your `lpk_live_…` key in the live tester  
4. Run a $1.00 test, typing card `4111111111111111` into the hosted card field  

Or embed manually:

```html
<div data-auxvault="amount"></div>
<div data-auxvault="card"></div>
<button data-auxvault-button="pay">Pay</button>
<div data-auxvault-result></div>

<script src="https://vault.auxcore.net/sdk/auxVault.js"
        data-auto-init="true"
        data-api-key="lpk_live_YOUR_KEY"
        data-endpoint="https://uat.auxcore.net/api/v1/public"
        data-vault-file="https://vault.auxcore.net/sdk/auxvault-field.html"
        data-vault-card-file="https://vault.auxcore.net/sdk/auxvault-card-unified.html"
        data-diagnostics="true">
</script>
```

`data-diagnostics="true"` prints request/response details for debugging.

---

## Test cards

Use these numbers on **Sandbox only**. Every other page links here.

| Brand | Number | CVV | Result |
|-------|--------|-----|--------|
| Visa | 4111111111111111 | 123 | Approved |
| Visa | 4000000000000002 | 123 | Declined (may vary by processor) |
| Mastercard | 5555555555554444 | 998 | Approved |
| Amex | 378282246310005 | 1234 | Approved |
| Discover | 6011111111111117 | 123 | Approved |

- **Expiry:** any future date (e.g. `12/30`). **CVV:** any 3 digits, or 4 for Amex.
- **Where to enter them:** the hosted PCI fields (SDK, payment link, Virtual Terminal), or `POST /tokenize-card` from your server on Sandbox. Never send them to `/transaction` — charge the `pciToken`.
- **Outcomes** depend on the sandbox processor configured for the merchant. A decline card that approves on your processor is a processor difference, not an integration bug.

---

## Postman & Swagger

- Import **AuxCORE.postman_collection.json** from `/settings/developer/sdk` or `/postman-collection`  
- Set `baseUrl` to `https://uat.auxcore.net` (Sandbox)  
- Swagger: `{host}/api-docs` (not available on production)

---

## Pre-production checklist

- [ ] `testConnection` succeeds on Sandbox  
- [ ] Sale, void, and refund tested  
- [ ] SDK tester approves on `/settings/developer/sdk`  
- [ ] Webhooks received on your test HTTPS endpoint  
- [ ] Switch `data-endpoint` / `AUXCORE_API_BASE` to `https://app.auxcore.net/api/v1/public` for go-live  
- [ ] New live API keys; Sandbox keys disabled  

---

**Need help?** Contact support@auxcore.net