> ## Documentation Index
> Fetch the complete documentation index at: https://docs.delegare.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Testing & Sandboxing

> How to test your Delegare integration safely.

Delegare provides a dedicated **Sandbox** environment that mirrors production but runs on test networks. Use this environment for all development and automated testing.

## Environment URLs

| Environment    | Base URL                              | Rail (Fiat)      | Rail (Crypto) |
| :------------- | :------------------------------------ | :--------------- | :------------ |
| **Sandbox**    | `https://api.sandbox.delegare.dev/v1` | Stripe Test Mode | Base Sepolia  |
| **Production** | `https://api.delegare.dev/v1`         | Stripe Live Mode | Base Mainnet  |

## Sandbox Testing Steps

### 1. Use Test API Keys

Log in to the [Sandbox Dashboard](https://app.sandbox.delegare.dev) to retrieve your Test Merchant ID and Test API Key. These keys are only valid for the sandbox URL.

### 2. Stripe Test Cards

When using the Setup UI in Sandbox mode, you can use Stripe's standard test cards (e.g., `4242 4242 4242 4242`) to simulate successful or failed authorizations.

### 3. Base Sepolia ETH/USDC

For crypto rail testing, ensure your test agent or user wallet has **Base Sepolia ETH** for gas and **Base Sepolia USDC** for payments.

* **Base Faucet:** [https://www.coinbase.com/faucets/base-ethereum-sepolia-faucet](https://www.coinbase.com/faucets/base-ethereum-sepolia-faucet)

## Webhook Testing

You can use tools like `ngrok` to expose your local server and set the `webhookUrl` in the Sandbox Dashboard. Delegare will sign every webhook with your sandbox-specific `webhookSecret` using HMAC-SHA256.

```bash theme={null}
# Example X-Delegare-Signature verification (Node.js)
const crypto = require('crypto');
const hmac = crypto.createHmac('sha256', process.env.DELEGARE_WEBHOOK_SECRET);
hmac.update(JSON.stringify(req.body));
const signature = hmac.digest('hex');

if (signature === req.headers['x-delegare-signature']) {
  // Verified!
}
```