Sandbox Environment¶
The QPay sandbox is a fully functional environment for integration development and testing. It mirrors the production platform but uses isolated data and test card networks.
Base URLs¶
| Service | URL |
|---|---|
| Services API (cards, BINs, products) | https://sandbox.qpay.quecto.com.br |
| Credentials API (users, clients, tokens) | https://sandbox.qpay.quecto.com.br |
| Ledger Accounts API (tenants, cardholders, invoicing) | https://sandbox.qpay.quecto.com.br/api/issuer/ledger |
| API docs (interactive) | https://sandbox.qpay.quecto.com.br/docs |
| Token endpoint | https://sandbox.qpay.quecto.com.br/realms/qpay/protocol/openid-connect/token |
Characteristics¶
| Property | Sandbox | Production |
|---|---|---|
| Card network | Test / simulated | Live UnionPay |
| Data isolation | Fully isolated from production | — |
| Transactions | Simulated via Issuer Simulator (Ledger Callback contract) | Live authorization against the applicable ledger |
| Ledger | QPay's internal ledger by default | QPay's internal ledger, or the issuer's own |
| Embossing | Simulated | Physical card bureaus |
| Uptime SLA | Best-effort | 99.9% |
| Rate limits | Relaxed | Standard |
Sandbox limits¶
- Maximum 50 cards per issuer tenant in the sandbox
- Access tokens expire after 5 minutes (same as production)
- Sandbox data may be reset periodically with advance notice
Test data¶
The sandbox is pre-loaded with sample data to help you get started quickly:
- A sample processor tenant with at least one BIN range configured
- A set of card templates associated with that BIN
- Sample card layouts and product configurations
Choosing a ledger¶
New issuer tenants in the sandbox start with no auth_url, which means authorization is routed to QPay's internal ledger. You can join it and start onboarding cardholders without implementing anything.
To test your own ledger instead, register your callback configuration and set auth_url. The bundled Issuer Simulator implements the six processor-facing operations of the Ledger Callback API and is a useful target while you build. Clearing auth_url routes authorization back to the internal ledger, so the switch is reversible at any time.
Contact support@quecto.com.br to request additional test data or a sandbox reset.
Checking service health¶
curl https://sandbox.qpay.quecto.com.br/api/credentials/whoami \
-H "Authorization: Bearer <access_token>"
A 200 OK response confirms the service is reachable and your token is valid.
Getting help¶
| Channel | Use for |
|---|---|
| support@quecto.com.br | Tenant requests, access issues |
| GitHub Issues | API bugs, documentation feedback |