The PCI sandbox environment of PCI Proxy EU allows developers to test the entire tokenization and payment flow without ever using real cards or connecting to a production acquirer. Unlike a generic sandbox, the test environment faithfully replicates the behaviour of the PCI vault and processor responses, including error scenarios. This guide shows how to access it, which test cards are available and how to migrate to production.
What the PCI sandbox is and why it's different from a normal sandbox
A PCI sandbox is not just a test environment with fake data: it is an isolated perimeter that respects the same security policies as the production environment, but uses test credentials and data that have no commercial value. The distinction matters because a poorly configured sandbox could encourage developers to test with real cards, creating a real PCI risk even during development.
The PCI API sandbox of PCI Proxy EU uses dedicated endpoints with sandbox.pci-proxy.eu prefix physically separate from the production infrastructure. Sandbox API keys do not work in production and vice versa. The test vault accepts any formally valid PAN (that passes the Luhn check) but never transmits it to a real processor. The token generated in sandbox is not usable to charge a real card.
How to access the PCI Proxy EU sandbox and available test cards
Sandbox access is free and requires no contract. After registering on the developer portal, test credentials are provided: a sandbox API key and instructions for configuring the SDK or REST calls to the test environment. No commercial onboarding is necessary to start developing.
The available test cards cover the main schemes: Visa (4111 1111 1111 1111), Mastercard (5500 0000 0000 0004), American Express and others. Each test card can be used to simulate specific scenarios: approved authorisation, decline for insufficient funds, decline for expired card, processor timeout, 3DS2 challenge required, and 3DS2 frictionless. Response codes correspond to ISO 8583 standards, allowing the developer to write realistic handlers already in the testing phase.
From testing to production: migration checklist
The transition from sandbox to production requires some technical and documentary verifications. On the technical side: replace test API keys with production ones in environment variables, update endpoints from sandbox.pci-proxy.eu to api.pci-proxy.eu, and verify that no test cards remain hard-coded in the code. On the documentary side: complete the appropriate SAQ (typically SAQ A or SAQ A-EP) and transmit the attestation to the acquirer.
Before going live, it is advisable to perform an end-to-end test in production with a real low-value card to verify connectivity with the acquirer and correct operation of notification webhooks. PCI Proxy EU provides a detailed migration checklist in the developer portal, with automated tests that verify configuration before production environment activation.
Frequently asked questions
Is the PCI sandbox free?
Access to PCI Proxy EU's sandbox is free and time-unlimited. No credit card or contract signing is needed to start developing. The free plan includes all test environment features, predefined test cards and access to complete API documentation.
Do test cards also simulate error scenarios?
Each test card has a series of response codes configurable via the CVV field or transaction amount. For example, a specific amount can force a decline for insufficient funds, while another can simulate a timeout. This mechanism allows testing all branches of error handling logic without needing separate mock tools.
How long does it take to go from sandbox to production?
If the sandbox integration is complete and all tests pass, the technical migration takes less than one working day. The longer time is typically documentary: completing the SAQ, gathering evidence and sending to the acquirer. With a reduced perimeter like that offered by PCI Proxy EU, this process often takes less than a week.
Start testing tokenization today in the free sandbox, without real cards and without a contract. Discover PCI Proxy EU.