Testing your integration

Validate Gate contracts, credentials, embeds, and webhooks in sandbox.

Use https://gate-api-sandbox.0bit.app with sk_test_* and pk_test_*. Gate routes are unversioned.

Suggested test sequence

1. Call /capabilities/eligibility, /capabilities/currencies, /capabilities/assets, and the relevant payment-method endpoint.
2. Create a GateSession with a persisted idempotency key.
3. Mount the widget from an allowed origin with the matching pk_test_* and client_secret.
4. Confirm wrong origins, wrong-mode keys, altered client secrets, and cross-partner resource ids are rejected.
5. Configure an HTTPS webhook destination through PATCH /dashboard/webhook-settings.
6. Call POST /webhooks/test, verify the signature from raw bytes, and inspect the delivery through GET /dashboard/webhook-deliveries.
7. Replay a deliberately dead-lettered delivery only after it reaches dead_lettered.
8. Exercise timeouts and confirm the same idempotency key does not create duplicate sessions or rails.

Generated artifacts

• OpenAPI: openapi/gate.yaml
• Postman: postman/gate.postman_collection.json
• Per-operation snippets: snippets/code_samples/

The Postman collection contains all 37 callable partner operations. Set baseUrl, secretKey, and publishableKey before use.

Repository checks

node scripts/generate-postman.mjs --check
node scripts/generate-code-samples.mjs --check

The Gate backend also validates the OpenAPI schema and compares documented paths with current Nest routes. Test assertions should use sandbox responses as integration evidence, not as proof that the same rail is configured in production.