Test your integration

Test the complete merchant journey before requesting production access. A successful API request alone does not verify the XPay Element, customer authentication, webhook, and reconciliation parts of the integration.

Before you begin#

Use XPay test credentials and the test SDK for the platform you are integrating. For Web SDK v5, load:

https://js.xstak.com/v5/xpay-stage.js

Use only the XPay-supplied test data on this page. Never use these values against a production integration.

By default, an XPay test account includes a test MPGS integration with Bank Alfalah. The test cards on this page can be used with that configuration.

To test a merchant-specific gateway configuration instead, obtain test credentials directly from the applicable bank or payment service provider and configure that gateway for the XPay test environment.

Test card scenarios#

Use expiry 05/39 to test a transaction that fails because of the supplied expiry scenario.

A 2DS payment doesn't perform customer authentication. Because unauthenticated card payments aren't permitted for this flow in Pakistan, the 2DS test card is expected to fail.

Test JazzCash#

Use CNIC 345678 with one of these phone numbers:

Test EasyPaisa#

EasyPaisa does not support the XPay test environment. Do not expect an EasyPaisa test transaction to complete in test mode.

Test the happy path#

1. Create a PaymentIntent from the merchant backend.
2. Confirm that the response contains a PaymentIntent ID, pi_client_secret, and encryptionKey.
3. Render XPay Element in the merchant frontend.
4. Confirm the payment with the XPay SDK.
5. Complete customer authentication when XPay presents it.
6. Verify the webhook signature.
7. Match the webhook to the stored PaymentIntent and merchant order reference.
8. Confirm that the final PaymentIntent status is succeeded.

Test failure handling#

Verify at least these conditions with approved XPay test data:

• The PaymentIntent request is rejected because authentication headers or the signature are invalid.
• XPay Element is incomplete and the payment cannot be submitted.
• A payment attempt returns to requires_payment_method.
• A payment requires customer action before it can complete.
• A card payment fails when the expiry 05/39 is used.
• A JazzCash payment returns the documented failure result for 03123456780.
• The webhook signature is invalid and the event is rejected.
• The frontend response is interrupted but the backend can reconcile the PaymentIntent.

Verify stored identifiers#

For every test order, store enough information to trace the complete flow:

• Merchant order reference.
• PaymentIntent ID.
• XPay customer ID when one exists.
• Refund ID when the test includes a refund.
• Webhook event identifier when provided.

Do not store sensitive card values, API secrets, webhook secrets, or full reusable payment tokens in application logs.

Next steps#

• Start with Accept your first payment if the happy path is not complete.
• Use API responses and errors to diagnose failed requests.
• Review PaymentIntent lifecycle and statuses before connecting payment outcomes to fulfillment.