Testing & go-live

Sandbox access

Email support@cashwo.com.au with your company name, a technical contact and what you're building. You'll receive:

• The sandbox API endpoint and merchant portal address.
• A sandbox merchant account with every frequency enabled, including ONETIME.
• Test customers and test bank accounts that authorise or decline.
• Your API key, through a one-time secure link. Cashwo never sends keys or secrets in plain email.

The sandbox moves no real money. Sandbox and production use separate keys, webhook secrets and merchant accounts, and a key from one never works in the other. Sandbox data may be reset from time to time.

Test scenarios

Work through these before asking for production access.

• Create a MONTHLY agreement with an initial_amount, open the link, verify, authorise with a test bank, and receive agreement_activated then payment_settled.
• Send the same create_agreement twice with one Idempotency-Key and confirm only one agreement exists.
• Create an agreement with a bad phone and email, and show both validation messages in your system.
• Create and pay a ONETIME agreement on the same day.
• Page through list_agreements and list_payments until has_more is false.
• Suspend, resume and cancel an active agreement through the API, and receive each agreement_* webhook.
• Cancel an agreement before the customer authorises it, and confirm the link can no longer be authorised.
• Authorise with a declining test bank and handle payment_failed.
• Make your endpoint return 500 once, confirm the retry arrives with the same event_id, and that you process it once.
• Send your endpoint a webhook with a tampered body and confirm it's rejected with 401.

Go-live checklist

• Production merchant account approved (identity and business checks complete).
• Production API key stored in your secrets manager, not in source code.
• Production webhook endpoint set, signing secret created, signature check on.
• Every write call sends an Idempotency-Key, and your system handles each error_code.
• Webhook handler is idempotent on event_id and answers within 15 seconds.
• A scheduled job reconciles with list_payments and updated_since.
• Someone on your team watches failed webhook deliveries and knows where to replay them.
• Sandbox keys and endpoints removed from production configuration.

Support

Integration questions: support@cashwo.com.au, Monday to Friday, 9am–5pm AEST. Include the agreement_id, payment_id or event_id and the time of the request; never send your API key or webhook secret.