Testing

Run the whole flow on the sandbox at demo.share-pay.co.uk with Stripe test cards before you go live.

The sandbox is a separate environment

	Production	Sandbox
Site	https://share-pay.co.uk	https://demo.share-pay.co.uk
API base	https://api.share-pay.co.uk	https://demo.share-pay.co.uk/api
Stripe	Live mode, real cards	Test mode, test cards
Accounts and keys	Your live merchant	Separate. Register again

It is not a mode you switch on. It is a different backend, on a different database, with different Stripe keys. Merchant records, API keys and webhook secrets do not cross between the two, so your production API key returns 401 Invalid API Key against the sandbox, and a sandbox key returns the same against production.

To set up:

1. Register an account at demo.share-pay.co.uk and become a merchant there.
2. Complete Stripe Connect onboarding again on the sandbox. It runs in Stripe test mode, so it verifies nothing real.
3. Set your allowed return domain and webhook URL on the sandbox Developers page. They are separate settings from your live ones.
4. Point your integration's base URL at https://demo.share-pay.co.uk/api and use the API key the sandbox issued.

Everything else in these docs, endpoints, payloads, signatures and statuses, is identical between the two.

Test cards

A card that always succeeds:

4242 4242 4242 4242
Any future expiry date, any CVC

Stripe's own test card list covers declines, authentication challenges and disputes. Anything Stripe supports in test mode works here, because the holds are ordinary manual-capture PaymentIntents on a test-mode connected account.

A reference integration

A working storefront runs at shop.share-pay.co.uk against the sandbox. It does the four things every merchant integration does: creates a checkout session with an API key from its own server, redirects the shopper, verifies the X-SharePay-Signature HMAC on the way back (rejecting bad signatures and timestamps older than 300 seconds), and fulfils the order on checkout_split.paid. If a detail on Hosted checkout or Webhooks is ambiguous, that is the thing to compare against.

Going live

share-pay.co.uk is the live environment. Stripe Connect onboarding there verifies your real business, and real cards are charged. Swap the base URL and the API key, and check that your allowed return domain and webhook URL are set on the live account too, because nothing you configured on the sandbox carries over.