A longtail card test link is a hosted payment URL that points at a gateway sandbox and accepts only vendor-issued test card numbers. It reproduces the full checkout flow, including authorization, 3D Secure, declines, refunds, and webhooks, without moving real money. Developers use it to confirm an integration works before swapping in live credentials.
What does a card test link actually do?
The link is a checkout endpoint bound to a sandbox account. When a tester submits a published test PAN, the gateway returns scripted responses such as approved, declined, or challenge required. The same link can be reused across QA runs because no funds and no real cardholder data are involved.
How is a test link different from a live payment link?
Three things change: the credential pair, the card numbers accepted, and the settlement path. A sandbox link rejects live PANs and never reaches an acquirer. A live link performs real authorization, applies real fees, and settles to your merchant account.
Card Verification Test URL: Sandbox Endpoints Explained
Why the word “longtail”?
Short test links cover the happy path only. A longtail link is built to carry the long tail of edge cases: expired cards, insufficient funds, incorrect CVV, soft declines, and issuer challenges. Covering those cases is what separates a demo from an integration you can ship.
What should you test through the link?
- Successful authorization with an approved test PAN.
- Declines for expired card, wrong CVV, and insufficient funds.
- 3D Secure challenge, frictionless pass, and authentication failure.
- Partial and full refunds, plus void after authorization.
- Idempotent retries when a request times out.
- Webhook delivery, ordering, and signature verification.
- Currency and locale variants, including zero decimal currencies.
How do you build a test link step by step?
Start in the gateway dashboard and open the developer or sandbox section. Create a test API key pair and confirm the account is in test mode before generating any URL. Then create a payment session server side and render the returned hosted checkout URL.
- Keep the secret key on the server and expose only the session token in the browser.
- Register the sandbox webhook endpoint and store the signing secret.
- Seed the checkout with realistic amounts, currencies, and customer references.
- Log the gateway request ID for every attempt so declines can be traced.
Which card numbers belong in a test link?
Use only the test PANs published in the processor's own documentation, and read the mapping between each number and its scripted response. Never enter a real card number into a sandbox, even your own, because it breaks PCI scope rules and can trip fraud monitoring. If a scenario is not covered by a published number, ask the processor for an additional test profile instead of improvising.
How do you handle sandbox responses correctly?
Treat decline codes as first class data, not as errors to swallow. Map each code to a customer message and a retry policy so production behavior is already decided. Verify that your application reads the final status from the webhook rather than from the browser redirect, since redirects can be abandoned.
What compliance rules still apply in a sandbox?
PCI DSS scope reduction practices apply even when no live data is present, because code written for testing tends to reach production. Never log full PANs, CVVs, or track data, and mask anything that must be stored. Use tokens or gateway vault references in your database instead of card fields.
Frequently asked questions
Can a test link accept real cards?
No. A correctly configured sandbox rejects live PANs, and attempting it may violate your merchant agreement.
How long does a test link stay valid?
Hosted sessions usually expire within minutes to hours. Generate a new session per test run rather than reusing an old URL.
Do test links work with mobile SDKs?
Yes. The same sandbox credentials drive native SDK test modes, so one test matrix can cover web and app.
When should the link switch to live mode?
Only after every decline path, webhook, and refund case passes consistently across repeated runs on the sandbox.