Testing Your Mobile Integration

Run the whole chain against the sandbox environment before you ship. Sandbox and production behave identically — same API surface, same event model, same Svix delivery — so anything that works here works live.

Run-through

1. Create a session in the sandbox with a sandbox key.

   Bash

   curl -X POST https://sandbox.api.inflowpay.com/api/checkout/sessions/subscription/sub_offer_xxx \
     -H "X-Inflow-Api-Key: inflow_sandbox_your_key" \
     -H "Content-Type: application/json" \
     -d '{
       "successUrl": "https://app.yourbrand.com/purchase/return",
       "returnMode": "APP_RETURN",
       "metadatas": { "appUserId": "usr_123", "platform": "ios" }
     }'

   The sandbox checkout is served from sandbox.checkout.inflowpay.com.

2. Pay with a test card — see Test Cards for success, decline, and 3DS scenarios.

3. Check that the webhook was received:

   Bash

   curl https://sandbox.api.inflowpay.com/api/webhook/events \
     -H "X-Inflow-Api-Key: inflow_sandbox_your_key"

   Inspect a single delivery with GET /api/webhook/events/{eventId}/delivery.

4. Replay an event to validate your idempotency — processing it twice must be a no-op:

   Bash

   curl -X POST https://sandbox.api.inflowpay.com/api/webhook/events/{eventId}/replay \
     -H "X-Inflow-Api-Key: inflow_sandbox_your_key"

5. Test the "webhook never received" case. Disable your endpoint, pay, then check that reconciliation by sessionId catches the state up. This is the path your users will hit on a flaky network, so exercise it deliberately.

Checklist

• The session is created server-side only — no API key in the binary.
• metadatas.appUserId comes back in every webhook payload you handle.
• Access is granted on payment.authorized / subscription.active, never on payment.settled.
• A free-trial offer grants access via subscription.trial_started — no payment.* event is expected.
• Replaying the same delivery twice grants access once.
• Out-of-order deliveries do not flip a canceled subscription back to active.
• Returning to the foreground refreshes the entitlement, even without a deep link.
• A session still open right after payment shows "validation in progress", not a failure.
• Refund and dispute.lost revoke access.

Related

• Sandbox Environment — access, base URLs, sandbox keys.
• Test Cards — simulate every payment outcome.
• Managing webhooks — list, replay, and inspect deliveries.
• Webhook Best Practices — the general reliability checklist.