The verdict in three sentences
A payment checkout is tested entirely in sandbox before any production launch: test keys, dummy MSISDNs, test cards, simulation of failure cases. In 2026, obtaining production API keys takes 1 to 5 business days depending on the provider and required KYC level — plan for this delay. The go-live checklist (signature, idempotency, retry, failures, reconciliation) matters as much as the happy path.
State of mobile money sandboxes 2026
| Provider | Sandbox available | Test keys | Test numbers/cards | Prod key delay |
|---|---|---|---|---|
| Paystack | Yes, complete | sk_test_... / pk_test_... | Documented test cards | ~1-3 days |
| Flutterwave | Yes | Test keys | Cards + test OTP | ~1-3 days |
| MTN MoMo | Developer sandbox | Subscription key + API user | Test MSISDN | ~2-5 days |
| M-Pesa (Daraja) | Full sandbox | Consumer key/secret test | Shortcodes + test MSISDN | ~2-5 days |
| CinetPay | Yes | Dedicated API keys | Provided test numbers | ~2-5 days |
| Flutterwave (KE/GH) | Yes | Test keys | Cards + OTP | ~1-3 days |
| Paystack (GH/ZA) | Yes | sk_test_... | Test cards | ~1-3 days |
Rule: request your sandbox access AND start the production KYC procedure on the same day. The sandbox unblocks you immediately; KYC (documents, business registration, director ID) is the real bottleneck.
What you absolutely must simulate
The happy path (successful payment) is the simplest case. A robust checkout mainly tests degraded cases:
| Scenario to test | How to trigger it | What the code must do |
|---|---|---|
| Successful payment | Success number/card | Fulfill after status verification |
| Failed payment | Failure number/card | Show clear error, fulfill nothing |
| Pending payment | pending amount/number | Wait for webhook + polling |
| USSD/OTP timeout | Don't confirm the OTP | Expire cleanly, allow retry |
| Duplicate webhook | Replay the event | Idempotency: single effect |
| Bad signature | Change the secret | Reject with 401 |
| Inconsistent amount | Alter the payload | Refuse, alert |
Go-live checklist
Before going to production, tick each line. This separates a toy integration from one ready to collect money.
| Go-live item | Checked? |
|---|---|
| Prod keys injected via environment variables (never hardcoded) | ☐ |
| Signature verification active on the webhook endpoint | ☐ |
| Uniqueness constraint on the transaction reference | ☐ |
| Status reverification via API before fulfillment | ☐ |
Fallback polling for pending | ☐ |
| Clear client-side error messages (EN/local) | ☐ |
| Transaction logging (amount, reference, status) | ☐ |
| Webhook URL configured on the provider side | ☐ |
| Real low-amount payment tested in prod | ☐ |
| Refund procedure tested | ☐ |
Mini case study
Fatou, a freelance developer in Nairobi, integrates M-Pesa Daraja for a restaurant client. She requests the sandbox and starts KYC on Monday. Sandbox active in 2 hours: she codes and tests the happy path, failures and deduplication in 2 days. Production keys arrive Friday (4 days of KYC).
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Thanks to the checklist, the switch to production takes only 30 minutes: injecting keys, one real payment of ~KES 50 to validate, refund tested. Zero surprises. Without a sandbox, she would have tested on real customer payments — and debugged live on real orders.
FAQ
Can I test without creating a merchant account?
Yes for most sandboxes: Paystack and Flutterwave give test keys immediately after signup. But PRODUCTION keys always require a valid merchant account with complete KYC.
How long to get production keys?
2026 order of magnitude: 1 to 5 business days depending on the provider and the completeness of your KYC file (business registration, ID, settlement account). Start this process on day one of the project.
Which numbers do I use to simulate a mobile money payment?
Each provider publishes its test MSISDNs or cards in its docs: success, failure, pending numbers. Never test with a real number in sandbox — it won't work and it skews your tests.
Should I test in production before launch?
Yes, a final test with a real low-amount payment (for example KES 50) then a refund. The sandbox never reproduces 100% of real operator behavior.
How do I handle secrets and API keys?
Never hardcoded in code or committed to Git. Use environment variables, separate between test and prod, and rotate secrets if one leaks.
Let's talk about your project. We integrate and test your mobile money checkout in sandbox then production, go-live checklist included. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.