Sandbox testing

Use our sandbox environment to validate the complete Partner-SDK booking journey before moving to production. Test SDK initialization, sdk_context_token generation and handoff, the Book API response, conditional 3DS challenge handling, and the final Booking Status API polling.

Refer to the environment setup provided during onboarding.

⚠️
Important:
Use only the sandbox credentials, endpoints, and test cards. Never send test bookings to production or use real card details.

Before you start

Load and initialize partner.js with environment: "sandbox".
Configure the partner backend with the confirmed Sandbox URLs for Book and Booking Status API requests.
Use Sandbox credentials and complete a valid Search and Precheck flow so that the Book request contains current identifiers, availability, and pricing.
Ensure that, for a 202 Book response with requiredAction: "payment_challenge", the frontend can receive the returned statusToken in the same browser session.

Sandbox endpoints

API	Method	Sandbox URL	Purpose
Book	POST	`{{sandboxBaseURL}}/api/v4/book`	Creates a booking. Include the unchanged `sdk_context_token` returned by `window.partnerSDK.checkout()` in the request.
Booking Status	POST	`{{sandboxBaseURL}}/api/v4/book/status`	Polls the authoritative booking result when the Book/Booking Status API returns a challenged response or `processing: true`. Use the same opaque `statusToken` returned by the Book API.

Test scenarios

Use the following values to exercise the expected Sandbox outcomes. Card data below is for Sandbox use only.

Test card values

Scenario	Card type	Number	Expiry	CVC
Successful payment	Visa	4111 1111 1111 1111	03/2029	737
Refused payment	Visa	4111 1111 1111 1111	03/2029	737
3DS challenge	Visa	4212 3456 7891 0006	03/2030	737
Failed 3DS challenge	Visa	4212 3456 7891 0006	03/2030	737
Frictionless 3DS	Mastercard	5201 2815 0512 9736	03/2030	737

Scenario behavior

Scenario	Additional input	Expected result
Successful payment	None	The payment is authorized, and the booking flow reaches its normal successful outcome. Verify that a fresh `sdk_context_token` is included in the Book request.
Refused payment	Set the cardholder name to `DECLINED`.	The payment is refused. Verify that the application shows a clear failure state and does not show a completed booking. Confirmation required: You must identify the refusal-simulation field supported end-to-end by the Sandbox.
3DS challenge	Use `password` as the web challenge password.	The Book API returns `status: 202`, `requiredAction: "payment_challenge"`, and a `statusToken`. Pass that exact token to `window.partnerSDK.handleChallenge(statusToken)`, then poll the Booking Status API until it returns a terminal result. Confirmation required: You must confirm that this card maps to the challenge flow in the Sandbox.
Failed 3DS challenge	Enter any challenge password other than `password`.	Authentication fails. Verify that the failure is presented clearly and that the backend checks authoritative booking status before offering a retry.
Frictionless 3DS	None	3DS authentication completes without interactive challenge UI. Verify that the booking flow continues and final confirmation still comes from the backend Booking Status result.

What to verify

partner.js loads without blocking errors and initializes in Sandbox mode.
A fresh sdk_context_token is generated immediately before booking and passes unchanged from frontend to backend to the Affiliate Book API.
Use the checkout configuration and Sandbox scenarios that apply to your integration. For 3DS integrations, handle unsuccessful handleChallenge() outcomes as rejections. The backend Booking Status result remains the source of truth for the booking outcome.
The application handles successful, refused, processing, and action-required Book responses.
When payment_challenge is required, the frontend passes the accurate statusToken from Book response to handleChallenge().
The backend polls the Booking Status API and treats its terminal result as authoritative; a successful browser challenge alone is not booking confirmation.
Logs and analytics contain no raw card data, sdk_context_token, or statusToken.

⚠️
Important:
The sdk_context_token and the statusToken must be treated as opaque values. You must not decode, parse, or modify the token values.