Skip to main content
The Therius sandbox (https://api-sandbox.therius.io/v1, prv_sandbox_... keys) is a fully isolated environment. Requests are handled by the built-in Therius sandbox provider, which simulates responses without touching a card network — no real money moves. This page lists the test data that drives each simulated outcome.
The card numbers below apply to the built-in Therius sandbox provider. If you have configured a real provider in sandbox/test mode (for example Stripe test keys), that provider’s own test-card set applies instead — use the numbers from their documentation.

​
Using the test cards

  • Send the request with a prv_sandbox_... key, or add the header X-Environment: sandbox.
  • Use any future expiry (for example 12/29) and any 3-digit CVV (for example 123).
  • American Express requires a 4-digit CVV (for example 1234).

​
Approvals

​
Declines

Each of these card numbers returns a declined status with a matching refusalCode — see Declined Payments for the full code reference.

​
3D Secure

3DS is enabled per route, not per card — the step-up decision is made by a 3D Secure step in the routing pipeline. The default seeded sandbox route sends the BINs below through the built-in 3DS simulator and then to the sandbox gateway, so these cards work out of the box.

​
Walking through the challenge card

1

Submit the purchase

Charge 4000002500003155. The response is:
2

Send the shopper to the challenge URL

Redirect to actionRequired.url. The sandbox simulator treats the challenge as instantly completed — no interaction is required.
3

Resume the payment

Call POST /payment/resume with { "sessionId": "..." } and your Authorization: Bearer prv_sandbox_... header — the prv_sandbox_ prefix routes to the sandbox. Sessions are single-use and expire after 15 minutes. A successful resume returns the final PaymentResponse with status: "captured".
The sandbox gateway refuses the two 3DS BINs (40000032200, 40000025000) if they arrive without ECI/CAVV data — so an approval proves the 3DS handoff actually happened, rather than the step being silently skipped.

​
Alternative payment methods

Send an apm block instead of card. No card number is needed. Each method returns a deterministic sandbox response:

​
Subscriptions in the sandbox

  • Create a subscription with any approval card above. It is stored on the sandbox database, fully separate from production.
  • The dunning worker processes sandbox subscriptions on the sandbox schedule.
  • Webhook deliveries for sandbox events are written to the sandbox delivery log and are marked with "environment": "sandbox" in the payload.

​
Idempotency in the sandbox

The Idempotency-Key header is optional in the sandbox but behaves exactly as it does in production — retrying with the same key returns the cached first response. Build the habit here so your production code is already correct. See Idempotency.