Sandbox and go-live
Test mode behaves exactly like production — real webhooks, real signatures, real request logs — but no money moves. Each environment has its own host and its own keys, and objects never cross between the two:
| Environment | Base URL | Keys |
|---|---|---|
| Sandbox | https://sandbox-api.mavunta.com/v1 | cwk_test_… |
| Live | https://api.mavunta.com/v1 | cwk_live_… |
A key sent to the other environment's host returns 400 environment_mismatch. The official SDKs and CLI pick the right host from the key prefix automatically.
The sandbox tester
From the developer console you can create a test payment and drive it to any outcome, which moves the intent and fires the matching webhook so you can test your real backend:
- Outcomes:
success,failed,underpaid,overpaid,expired,cancelled,review. - Send a standalone test webhook, view fake balances, and reset all sandbox data.
M-Pesa test numbers
The customer phone on a test payment selects the outcome automatically:
| Phone | Outcome |
|---|---|
+254700000001 | Payment succeeds |
+254700000002 | User cancels |
+254700000003 | Insufficient funds |
+254700000004 | STK timeout |
+254700000009 | Under review |
Going live
You do not simply flip a switch. Complete the technical steps in sandbox, then submit your business details (KYB) for review. The console tracks this checklist for you:
- Sandbox payment created and completed
- Webhook endpoint added and a delivery received
- Refund flow tested
- Business profile submitted and approved
cwk_live_… key and add a separate live webhook endpoint. The API surface is identical to sandbox; new merchants start with lower limits that increase with a clean payment history. The full production, security, and webhook checklists are in Go live.