Payments and webhooks

16 procedures covering test cards and sandbox modes, 3-D Secure flow, refunds and partial refunds, currency rounding, duplicate payment prevention. Out of scope here: PCI DSS certification, provider account setup, fraud rule tuning.

Checkers for this area

• Verify a webhook signaturebrowser
• Check a test card numberbrowser

Checklists

• Payment gateway testing checklist15 checks

Questions people ask about this area

• hmac sha256 verify signature
• stripe webhook signing secret
• stripe webhook retry policy
• idempotency key implementation
• jpy zero decimal currency
• price tampering cwe
• how to test a payment flow with test cards