Testing developer apps

Current development testing uses controlled local fixtures and synthetic merchant data. The merchant consent journey is implemented and tested locally through real Auth and scoped APIs. A public hosted sandbox and test-merchant self-service remain PLANNED; Marketplace remains disabled in the current release policy.

Current local model

Use an isolated local/test environment provided or authorized by the platform. Keep test app versions, installations, tokens, webhook endpoints, and merchant records synthetic. Never copy production data, provider credentials, merchant secrets, or platform internals into fixtures.

Authentication cases

Test exact redirect matching, S256 verifier failure, state validation in your app, one-time code use, expired code, token expiration, refresh rotation, refresh reuse detection, invalid client ID, revoked installation, and missing scope. In an authorized enabled test environment, also verify actual login, explicit store selection, approve/decline, callback, code exchange, expiry, membership changes and cross-store denial.

API cases

Test all eleven documented operations, pagination at bounds, invalid cursors, the actual nested error envelope, 401, 403 where applicable, 404, 413, 429, 500, and 503. Verify RateLimit-* values per installation and route key and respect Retry-After.

Webhook cases

Test one-time secret capture, signature verification over the raw body, timestamp tolerance, event-ID deduplication, idempotent processing, non-2xx responses, 15-second timeout behavior, bounded retry, terminal dead, SSRF rejection, DNS changes, and no redirect following. Exercise actual resource mutations, transaction rollback, no-op changes and both revocation race orders. Verify the final uninstall receipt separately from ordinary data delivery.

Release evidence

Before submission, record what ran, what was skipped, and why. Missing credentials or unavailable hosted infrastructure means SKIPPED, not passed. Do not weaken authorization, tenant isolation, validation, or security controls to make a test succeed.