Testing
Test Environment
Test an app safely with synthetic stores, scoped tokens and signed Webhooks.
Test with controlled local fixtures or an environment explicitly authorized by SaaS. A public hosted Sandbox is not currently available, so never use a Production merchant or real customer data as a substitute.
| SANDBOX / authorized test | PRODUCTION |
|---|---|
| Synthetic merchant and store | Real merchant authorization |
| Test app and test Webhooks | Reviewed, approved app version |
| No customer impact | Production rate and security rules |
| Safe negative and retry cases | Only approved release validation |
Current local model
Use an isolated local/test environment provided or authorized by the platform. Keep test app versions, installations, tokens, webhook endpoints, and merchant records synthetic. Never copy production data, provider credentials, merchant secrets, or platform internals into fixtures.
Authentication cases
Test exact redirect matching, S256 verifier failure, state validation in your app, one-time code use, expired code, token expiration, refresh rotation, refresh reuse detection, invalid client ID, revoked installation, and missing scope. In an authorized enabled test environment, also verify actual login, explicit store selection, approve/decline, callback, code exchange, expiry, membership changes and cross-store denial.
API cases
Test all thirty documented operations, pagination at bounds, invalid cursors, the actual nested error envelope, 401, 403 where applicable, 404, 409, 413, 415, 422, 429, 500, and 503. Replay each write with the same Idempotency-Key and confirm the stored result is returned. Verify RateLimit-* values per installation and route key and respect Retry-After.
Webhook cases
Test one-time secret capture, signature verification over the raw body, timestamp tolerance, event-ID deduplication, idempotent processing, non-2xx responses, 15-second timeout behavior, bounded retry, terminal dead, SSRF rejection, DNS changes, and no redirect following. Exercise actual resource mutations, transaction rollback, no-op changes and both revocation race orders. Verify the final uninstall receipt separately from ordinary data delivery.
Release evidence
Before submission, record what ran, what was skipped, and why. Missing credentials or unavailable hosted infrastructure means SKIPPED, not passed. Do not weaken authorization, tenant isolation, validation, or security controls to make a test succeed.