Testing in Sandbox

Test everything with fake data

The Sandbox environment is a complete copy of the API that runs on play money. You can act as a merchant from start to finish (create a key, create payins, create payouts, receive webhooks, read balances and journals) without a real customer, bank or AntaraPay operator. Sandbox simulates all of them for you.

Step by step

1. Sign in to the dashboard and switch to Sandbox (environment switch in the header).
2. Open Integration and generate your webhook key pair and an API key. Sandbox keys start with qp_test_; copy the key, it is shown once. Give it the payins:read, payins:write, payouts:read and payouts:write scopes.
3. Your account is credited with play money automatically (IDR 10,000,000 the first time). Check it with GET /api/v1/balances, and top it up with POST /api/v1/sandbox/balance/topup.
4. Create a payin and a payout as described in the Payin and Payout guides. Sandbox settles them by itself after about 10 seconds, based on the amount or account number you send (see the tables below).
5. Receive the webhooks on your own server, or use the built-in receiver if you do not have one yet.

curl "https://sandbox-api.antarapay.com/api/v1/sandbox" \
  -H "Authorization: Bearer $ANTARAPAY_API_KEY"

GET /api/v1/sandbox returns the autopilot settings, the starter balance, and every scenario below with an example amount or account number.

Payin scenarios

The outcome is chosen by the last three digits of the amount. Any other amount is paid successfully.

Channels with delayed settlement (for example QRIS_GOPAY) are paid and then released immediately, so you do not wait for the settlement period.

Payout scenarios

The outcome is chosen by the last four digits of recipient.account_number. Your balance is reserved when the payout is created and released again when it fails or is rejected.

Control it by hand

Use these endpoints with the same API key to play the customer, the operator and the bank yourself. They only affect your own payins and payouts, do not need an Idempotency-Key, and respond with 409 when the payin or payout is already in a final state.

curl -X POST "https://sandbox-api.antarapay.com/api/v1/sandbox/payins/$PAYIN_ID/pay" \
  -H "Authorization: Bearer $ANTARAPAY_API_KEY"

Built-in webhook receiver

No server to receive webhooks yet? Let Sandbox be your server. It receives the events, verifies both the Ed25519 and the HMAC signature, and keeps what it got so you can inspect it.

Each event has type set to payin or payout; read data.status to know what happened (see the webhook guide).

A complete test run

# 1. Receive webhooks in the built-in inbox
curl -X POST "$BASE/api/v1/sandbox/webhook/receiver" -H "Authorization: Bearer $KEY"

# 2. Create a payin that will be paid by itself
curl -X POST "$BASE/api/v1/payins" \
  -H "Authorization: Bearer $KEY" -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"reference":"ORD-1","amount":"15000","currency":"IDR","channel":"QRIS_QOIN"}'

# 3. About 10 seconds later: status SUCCEEDED, balance increased
curl "$BASE/api/v1/payins/$PAYIN_ID" -H "Authorization: Bearer $KEY"
curl "$BASE/api/v1/balances" -H "Authorization: Bearer $KEY"

# 4. Create a payout that will complete by itself
curl -X POST "$BASE/api/v1/payouts" \
  -H "Authorization: Bearer $KEY" -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"reference":"PO-1","amount":"40000","currency":"IDR","recipient":{"type":"END_USER","bank_code":"BCA","account_number":"1234567890","account_name":"TEST USER"}}'

# 5. Read the webhooks you received and the journal
curl "$BASE/api/v1/sandbox/webhook/inbox" -H "Authorization: Bearer $KEY"
curl "$BASE/api/v1/journals" -H "Authorization: Bearer $KEY"