Testing & Certification
Certification Checklist
The scenarios you must run and evidence before production is enabled.
Before going to production, all scenarios must be tested end-to-end, receiving and validating the webhook for each one.
Scenarios to test
- Cards: success, refund, decline, insufficient funds, and 3DS. See Card test cases.
- APMs: SPEI Standard, SPEI Frictionless, OXXO Pay, Cash vouchers — Cash, Cash vouchers — Transfer, and MercadoPago. See APM test cases.
- Withdrawals: create → process in the Dashboard → simulate
LQ/D/CN. See Withdrawals test cases.
Per-scenario validations
- Receive the webhook with the final status for each scenario.
- Validate that
payment_idandorder_idare present. - Confirm webhook deduplication works correctly.
Environment notes
- Test cards only work in Sandbox (
stage.tonder.io). - For MercadoPago, use only MP's official test cards and an email with the
@testuser.comdomain. - For withdrawals, use the test institution code
97846.
Production configuration
Before the final deployment, confirm:
- Production credentials configured securely, separated from staging.
- Your code uses the production base URL and you have a process to rotate keys.
- HTTPS on all communications; keys and secrets stored securely (not in code).
- Error handling that doesn't expose sensitive data in logs or to the end user.
- Webhook endpoint configured and tested.
Next steps
Was this page helpful?