Testing Guide#

Test your AuxCORE integration on Sandbox before production go-live.

Test environments#

Use the same host you log into for the dashboard. Production (app.auxcore.net) uses live cards — do not use test PANs there.

Credentials#

1. Log in to the Sandbox dashboard
2. Open Settings → Developer & Integrations → API Keys — create a Secret key (Your server or backend) for curl/Postman
3. For website tests, create an SDK Embed key (lpk_live_…)

Sandbox and production keys use the same prefixes (api-…, lpk_live_…) — the live in lpk_live_ does not mean production. A key belongs to the host you created it on: a key from uat.auxcore.net only works against uat.auxcore.net, and returns 401 on app.auxcore.net.

Optional: use Settings → Developer & Integrations → SDK & API Docs (/settings/developer/sdk) for a live SDK test without writing HTML.

Test connection#

export BASE="https://uat.auxcore.net/api/v1/public"
export API_KEY="your-secret-key"

curl -X POST "$BASE/testConnection" \
  -H "x-api-key: $API_KEY"

Test sale (approved)#

The API rejects raw CardNumber / CVV on Sandbox and Production with 400 PCI_SCOPE_VIOLATION. Tokenize a test card first, then charge the returned pciToken. On Sandbox you can tokenize from your server with a secret key:

curl -X POST "$BASE/tokenize-card" \
  -H "x-api-key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"cardNumber": "4111111111111111", "expiryMonth": "12", "expiryYear": "2030", "cvv": "123"}'
# → { "success": true, "data": { "pciToken": "pci_tok_…", "last4": "1111", ... } }

export PCI_TOKEN="pci_tok_…"   # data.pciToken from the response

curl -X POST "$BASE/transaction" \
  -H "x-api-key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "Amount": 25.00,
    "SuggestedMode": "Card",
    "pciToken": "'"$PCI_TOKEN"'",
    "BillingCustomerName": "Test User",
    "BillingEmail": "test@example.com"
  }'

Save data.TransactionId from the response. Approval: HTTP 200, data.Status "1", data.ResponseCode "100".

In production, collect cards in the browser with the PCI SDK instead: posting card numbers from your server puts it in PCI scope.

Test decline#

Tokenize card 4000000000000002 and charge the resulting pciToken — on most sandbox processors this returns HTTP 402 with "status": "declined" and data.Status "9" (the outcome may vary by processor).

Void, refund, capture#

TXN="550e8400-e29b-41d4-a716-446655440020"   # data.TransactionId from the sale

# Full refund (add "amount" for a partial refund)
curl -X POST "$BASE/refund" \
  -H "x-api-key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"transactionId\": \"$TXN\"}"

# Void (unsettled sale)
curl -X POST "$BASE/void" \
  -H "x-api-key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"transactionId\": \"$TXN\"}"

For auth-only, send "TransactionType": "auth" on /transaction; capture it later with the dashboard API — see Captures →.

SDK embed test#

1. Create SDK Public key at /settings/developer/api-keys
2. Open Settings → Developer & Integrations → SDK & API Docs → No-Code SDK tab
3. Paste your lpk_live_… key in the live tester
4. Run a $1.00 test, typing card 4111111111111111 into the hosted card field

Or embed manually:

<div data-auxvault="amount"></div>
<div data-auxvault="card"></div>
<button data-auxvault-button="pay">Pay</button>
<div data-auxvault-result></div>

<script src="https://vault.auxcore.net/sdk/auxVault.js"
        data-auto-init="true"
        data-api-key="lpk_live_YOUR_KEY"
        data-endpoint="https://uat.auxcore.net/api/v1/public"
        data-vault-file="https://vault.auxcore.net/sdk/auxvault-field.html"
        data-vault-card-file="https://vault.auxcore.net/sdk/auxvault-card-unified.html"
        data-diagnostics="true">
</script>

data-diagnostics="true" prints request/response details for debugging.

Test cards#

Use these numbers on Sandbox only. Every other page links here.

• Expiry: any future date (e.g. 12/30). CVV: any 3 digits, or 4 for Amex.
• Where to enter them: the hosted PCI fields (SDK, payment link, Virtual Terminal), or POST /tokenize-card from your server on Sandbox. Never send them to /transaction — charge the pciToken.
• Outcomes depend on the sandbox processor configured for the merchant. A decline card that approves on your processor is a processor difference, not an integration bug.

Postman & Swagger#

• Import AuxCORE.postman_collection.json from /settings/developer/sdk or /postman-collection
• Set baseUrl to https://uat.auxcore.net (Sandbox)
• Swagger: {host}/api-docs (not available on production)

Pre-production checklist#

• testConnection succeeds on Sandbox
• Sale, void, and refund tested
• SDK tester approves on /settings/developer/sdk
• Webhooks received on your test HTTPS endpoint
• Switch data-endpoint / AUXCORE_API_BASE to https://app.auxcore.net/api/v1/public for go-live
• New live API keys; Sandbox keys disabled

Need help? Contact support@auxcore.net