FreePublished on GitHub

payment-gateway-sandboxes

Wraps the vendor-generic payment-gateway sandbox pattern - test credentials, sandbox base URLs / environment switches, deterministic test-card matrices, and gateway-native webhook simulators - with per-gateway references for Adyen test mode, PayPal Sandbox, and Braintree sandbox. Use when testing code integrated with Adyen, PayPal, or Braintree; for Stripe use stripe-test-cards-and-webhooks (one-time payments) or stripe-subscription-billing-test-author (recurring billing).

The English summary is being prepared. Showing the original description.

testland/qa13 stars(GitHub 13 + cccskills 0)

Works withStripe

Run score Not tested

See how to install

Files included (5)

SKILL.md5.3 KB
.tessl-plugin/plugin.json618 B
references/adyen.md6.1 KB
references/braintree.md5.9 KB
references/paypal.md5.5 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

payment-gateway-sandboxes

Overview

Every major payment gateway ships the same four sandbox primitives, each under a different name:

Test credentials - a sandbox API key / merchant account that can never move real money.
An environment switch - a sandbox base URL or an SDK environment flag that routes calls to the test stack.
A deterministic test-card matrix - specific PANs (or amounts) that trigger specific outcomes: success, decline, 3DS challenge.
A webhook simulator / resend surface - a way to fire or replay asynchronous events at your handler on demand.

This skill is the single entry point for the non-Stripe gateways. The body covers the shared pattern; the per-gateway mechanics live in references/.

Routing table

Gateway	Reference	Distinctive sandbox trait
Adyen	references/adyen.md	Explicit sync-API / async-notification duality; HMAC-validated notifications
PayPal	references/paypal.md	Sandbox Business + Personal accounts; dashboard + API webhook simulator
Braintree	references/braintree.md	Amount-based magic values; sandbox-only `gateway.testing.settle`
Stripe	`stripe-test-cards-and-webhooks`	Stripe CLI (`stripe listen` / `stripe trigger`); test clocks in `stripe-subscription-billing-test-author`

When to use

Authoring tests for code integrated with Adyen, PayPal, or Braintree.
Wiring a gateway sandbox into CI (credentials, env switch, webhook secrets).
Porting an existing single-gateway suite to a second gateway.

The shared sandbox test pattern

Regardless of gateway, a payment integration suite has the same skeleton:

Initialize the SDK against the sandbox environment - never a prod key; the environment switch is an env var, not a hardcode.
Drive each documented test-card outcome - one test per outcome row (success, decline variants, 3DS frictionless, 3DS challenge), asserting the gateway's own result-code vocabulary.
Verify webhook signatures - every gateway signs its events (HMAC-SHA256 for Adyen, SHA256-with-RSA for PayPal, bt_signature parsing for Braintree); the suite must reject unsigned and wrong-secret payloads.
Prove handler idempotency under redelivery - all three gateways redeliver unacknowledged events; process-exactly-once is the contract. The full replay workflow is payment-flow-test-author.
Map the state machine - each gateway names the same lifecycle differently; translate via payment-flow-states-reference before asserting on states.

CI integration

Sandbox credentials are secrets like any other:

jobs:
  gateway-tests:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-node@v4
      - run: npm ci && npm test
        env:
          ADYEN_TEST_API_KEY: ${{ secrets.ADYEN_TEST_API_KEY }}
          PAYPAL_SANDBOX_CLIENT_ID: ${{ secrets.PAYPAL_SANDBOX_CLIENT_ID }}
          BT_SANDBOX_MERCHANT_ID: ${{ secrets.BT_SANDBOX_MERCHANT_ID }}

Per-gateway variable lists are in each reference.

Anti-patterns

Anti-pattern	Why it fails	Fix
Prod credentials in tests	Real settlement / real charges	Sandbox-only keys, per-env config
Skip webhook signature validation	Spoofed events trigger fulfillment	Verify per the gateway's scheme
Treat the sync API return as final	All three gateways finalize async	Webhook-driven state, per `payment-flow-states-reference`
One happy-path test	Decline / 3DS / fraud paths untested	One test per documented outcome row
Hardcoded merchant/account IDs	Per-env accounts drift	Env vars
One suite for all gateways	Result-code vocabularies differ	Per-gateway test directory

Limitations

Sandbox fidelity varies. Braintree settles synchronously via a test-only API; prod settles overnight. PayPal sandbox webhooks can lag.
Client-side surfaces need a browser. Drop-in / Hosted Fields / PayPal-button flows require Playwright against the sandbox UI.
Region-specific payment methods (iDEAL, Sofort, etc.) have separate test flows not covered here.

References

Adyen test mode, test cards, result codes, HMAC notifications: references/adyen.md.
PayPal Sandbox accounts, Orders v2, webhook simulator: references/paypal.md.
Braintree sandbox, amount-based magic values, webhook parser: references/braintree.md.
Companion catalog: payment-flow-states-reference (state machines + 3DS flows).
Flow suites on top of the sandboxes: payment-flow-test-author.
Stripe: stripe-test-cards-and-webhooks, stripe-subscription-billing-test-author.

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

More skills from this repository

a11y-violation-gate

Free

Builds a CI gate that fails the build on **new** WCAG / a11y violations introduced by a PR while grandfathering pre-existing violations on a per-rule / per-page baseline. Aggregates verdicts from axe-core / pa11y / Lighthouse a11y / WAVE / IBM Equal Access scans. Use when a project has accumulated a11y debt and a strict "zero violations" gate would block every PR - the ratchet pattern lets the team ship while preventing regressions.

The English summary is being prepared. Showing the original description.

testland/qa13Updated Oct 20, 2026

ab-test-validity-checklist

Free

Workflow skill that builds an A/B-test validity checklist from an experiment proposal, walking the canonical design-correctness gates - pre-registered OEC/power/guardrails, randomization unit + SRM check, assignment integrity, telemetry, peeking discipline, novelty/primacy, post-experiment SRM re-check - into a per-experiment checklist + sign-off form. Use when launching, auditing, or governing an experiment. For pitfall mechanics (guardrails, peeking) see experiment-results-interpreter's references; to read an already-valid result use experiment-results-interpreter; for per-SDK harness tests use experiment-sdk-testing - this gates DESIGN, not SDK code.

The English summary is being prepared. Showing the original description.

testland/qa13Updated Oct 20, 2026

add-to-homescreen-flow-tests

Free

The single install-flow skill: the reference contract for the PWA install flow (installability gate fields, `beforeinstallprompt` handshake, per-platform paths - Android WebAPK / iOS Share menu / Firefox no-op - and the `display-mode` post-install signal, in references/install-flow-reference.md) plus the build-an-X workflow that emits the Add-to-Home-Screen suite. Walks the four-stage timeline, emitting one test per gate cell per [web.dev/articles/install-criteria][install-criteria], the deferred-prompt → `prompt()` → `userChoice` chain per [web.dev/articles/customize-install][customize-install], the iOS Safari manual-metadata branch (`apple-touch-icon`) per [web.dev/learn/pwa/installation][learn-pwa], and the post-install `(display-mode: standalone)` MQ assertion. Output: a Playwright spec with per-stage cells plus a coverage matrix. Use when a PWA's manifest, icons, or install handler change, when install conversion drops at an unknown stage, or when triaging a flaky install assertion.

The English summary is being prepared. Showing the original description.

testland/qa13Updated Oct 20, 2026

ai-spec-coverage-mapper

Free

Build-an-X workflow that uses an LLM to map existing tests to spec sections - given a spec doc + the test suite, the LLM identifies which tests cover which sections, surfaces uncovered sections (gap), and recommends specific tests to add. Output is a coverage matrix per spec ID. Scope is mapping tests that already exist and naming the gaps, not authoring tests for new acceptance criteria. Use when a spec doc and a test suite both exist but nobody can say which requirements are actually covered - before a release sign-off, an audit, or a decision about where to spend the next round of test effort.

The English summary is being prepared. Showing the original description.

testland/qa13Updated Oct 20, 2026

ai-test-generator

Free

Generates tests from natural-language specs (acceptance criteria, user stories, requirements) using an LLM, with confidence scoring per test case (LLM self-assessment plus heuristics: assertion quality, naming, completeness), batching uncertain cases for human review, and integration with the team's existing test framework. Use when the user asks to generate unit tests from acceptance criteria, convert user stories to test cases, automate test creation from requirements, or augment a spec-driven test suite with AI-generated stubs that are then curated before merge.

The English summary is being prepared. Showing the original description.

testland/qa13Updated Oct 20, 2026

allure-reports

Free

Configures Allure Report (test-runner adapter install, `allure-results` directory wiring, `categories.json` for failure classification, `history-trend.json` retention via the copy-history-between-runs pattern), runs the Allure CLI to convert `allure-results` to a static HTML site, and uploads the report as a CI artifact. Use when the team needs richer test reporting than JUnit XML - step-level attachments, per-test history, retry tracking, and severity / epic / feature labeling across framework-agnostic adapters (pytest, Jest, JUnit, TestNG, NUnit, Mocha). As a rich static HTML report generator, it is the open-source alternative to the sunset ExtentReports (JVM/.NET per-test HTML narrative); for hosted cross-run flakiness analytics rather than a static per-run report use currents-integration.

The English summary is being prepared. Showing the original description.

testland/qa13Updated Oct 20, 2026

See all skills by testland

Report a problem with this skill

Install

Install with a command

npx skills add https://github.com/testland/qa --skill payment-gateway-sandboxes

Paste it into your terminal and run it (requires Node.js). You can choose which agents to install it for, such as Claude Code or Codex.

Ask your agent

Please install the following Agent Skill.
https://github.com/testland/qa/tree/main/plugins/qa-payment/skills/payment-gateway-sandboxes

First review SKILL.md and the bundled files and confirm there is nothing suspicious (such as sending data externally or reading credentials). Then place it in ~/.claude/skills/payment-gateway-sandboxes/ for Claude Code, or ~/.agents/skills/payment-gateway-sandboxes/ for Codex.

Send this text to Claude Code or Codex as is. It checks the contents before installing.

View source on GitHub

Repository: testland/qa
Stars: 13
Forks: 3
Category: Testing & Security
License: MIT
Original language: English
Last updated: Oct 20, 2026

A skill is a set of instructions and scripts for an agent. cccskills does not guarantee that skills are safe. Review the contents before you install.