🗺️Testing strategy

Test the integration in layers before enabling production traffic.

1. Contract tests

Verify authentication, resource discovery, field parsing, pagination, validation errors, quote polling, and transaction creation without depending on a particular provider outcome.

2. Sandbox end-to-end tests

Use a pk_test_ widget and provider-specific test data to cover:

• buy and sell operation selection;

• region and nested-region selection;

• payment-method and asset availability;

• valid and invalid amounts;

• direct and indirect buy quotes;

• sell quotes and deposit instructions;

• provider success and failure paths;

• transaction status updates and webhook verification;

• redirect return behavior.

3. Production smoke tests

After production access is enabled, use a feature flag or restricted audience to verify the live configuration. Production transactions are real; use only approved test amounts, accounts, and procedures.

Environment rules

• Never enter real card data into a provider test checkout.

• Provider sandboxes can differ from production in KYC, payment methods, assets, and status timing.

• Do not load-test provider sandboxes.

• Keep sandbox and production keys, webhook secrets, origins, and transaction IDs separate.