Skip to main content
Gcashier Pay provides two fully isolated environments — a sandbox for integration testing and a production environment for live transactions. Both environments share the same API surface, the same encryption scheme, and the same request/response envelope. The only differences are the base URL, the RSA key pair you use, and the merchant credentials tied to each account. Moving from sandbox to production is a matter of swapping those three values.

​
Sandbox (test) environment

The sandbox lets you exercise every API operation without touching real money. Responses follow predictable mock rules (described below) so you can write deterministic automated tests against specific outcome scenarios.

​
Setting up for testing

1

Generate a test RSA key pair

Create a dedicated 2048-bit RSA key pair specifically for the test environment. Do not reuse your production keys in the sandbox — keeping them separate prevents accidental cross-environment credential leaks.
mkdir -p tmp
openssl genrsa -out tmp/tmp_rsa_private_key_2048.pem 2048
openssl pkcs8 -topk8 \
  -in tmp/tmp_rsa_private_key_2048.pem \
  -out rsa_private_key_2048_test.pem \
  -nocrypt
openssl rsa \
  -in tmp/tmp_rsa_private_key_2048.pem \
  -out rsa_public_key_2048_test.pem \
  -pubout
2

Send your test public key to Gcashier Pay

Provide the contents of rsa_public_key_2048_test.pem to the Gcashier Pay onboarding team. They will register it against your test merchant account and return their sandbox RSA public key for you to store.
3

Apply for a test merchant account

Request a sandbox merchantNo from Gcashier Pay. This identifier is separate from your production merchantNo. You will use it in the merchantNo POST parameter and, where required, inside the encrypted body of test requests.
4

Receive your sandbox base URL

Gcashier Pay will provide you with the {baseUrl} hostname for the sandbox. All test endpoint calls follow the pattern:
https://{baseUrl}/api/<endpoint-path>
Store this value in your environment configuration (e.g. an .env file or a secrets manager) so you can switch between environments without code changes.
The sandbox processes requests through the same encryption pipeline as production. A decryption or signature failure in the sandbox reflects a real implementation bug, not a sandbox limitation.

​
Production environment

When your integration tests pass and you are ready to accept live transactions, follow the go-live steps below. Gcashier Pay reviews your production application before granting access.

​
Going live

1

Generate a production RSA key pair

Create a fresh 2048-bit RSA key pair for production. These keys must be generated on infrastructure you control and stored with appropriate access controls.
mkdir -p tmp
openssl genrsa -out tmp/tmp_rsa_private_key_2048.pem 2048
openssl pkcs8 -topk8 \
  -in tmp/tmp_rsa_private_key_2048.pem \
  -out rsa_private_key_2048_prod.pem \
  -nocrypt
openssl rsa \
  -in tmp/tmp_rsa_private_key_2048.pem \
  -out rsa_public_key_2048_prod.pem \
  -pubout
2

Provide your production public key to Gcashier Pay

Send the contents of rsa_public_key_2048_prod.pem to Gcashier Pay through the secure channel they designate. You will receive Gcashier Pay’s production RSA public key in return.
Do not transmit your production private key through any external channel. If you suspect your private key has been exposed, contact Gcashier Pay immediately to invalidate the key and rotate to a new pair.
3

Provide your server IP address

Gcashier Pay allowlists the IP addresses from which your servers will call the production API. Provide the static egress IP address (or CIDR block) for each production server or gateway that will make API calls.
4

Apply for your production merchant account

Request a production merchantNo from Gcashier Pay. Once approved, you receive the production {baseUrl} and your live merchantNo. Update your environment configuration to point at the production base URL and use the production key pair.

​
Environment configuration summary

SettingSandboxProduction
Base URLhttps://{sandboxBaseUrl}/api/...https://{productionBaseUrl}/api/...
merchantNoTest merchant numberLive merchant number
Your RSA private keyTest private keyProduction private key
Gcashier Pay’s RSA public keySandbox public keyProduction public key
Real money movementNoYes
Mock testing rulesYesNo
Structure your code so that the base URL, merchantNo, and both RSA key paths are injected at runtime from environment variables. A single config change should be all it takes to flip between environments — no code modifications required.

​
Mock testing rules

The sandbox uses deterministic rules to drive automated test outcomes. By choosing specific field values, you can reliably trigger success, rejection, or pending states in your test suite without manual intervention.

​
sp1101 — Merchant access application

The outcome is determined by the last digit of merNameEn (the merchant’s English name field).
Last digit of merNameEnSimulated outcome
0 – 3✅ Approved
4 – 6❌ Rejected
7 – 9🕐 Under review
{ "body": { "merNameEn": "Test Company A3" } }
The example above ends in 3 → the application will be approved.

​
sp1202 — FX trading

The outcome is determined by the single digit of amount (i.e. the units digit of the trade amount).
Units digit of amountSimulated outcome
0 – 3✅ Success
4 – 6❌ Failed
7 – 9⏳ Processing
{ "body": { "amount": "500.00" } }
The units digit is 0 → the FX trade will succeed.

​
sp1303 — International remittance confirm

The outcome is determined by the units digit of either debitAmount or arriveAmount.
Units digit of amountSimulated outcome
0 – 3✅ Success
4 – 6❌ Rejected
7 – 9— No action (pending)

​
sp1305 — Withdrawal

The outcome is determined by the last digit of bankAccountNo (the beneficiary bank account number).
Last digit of bankAccountNoSimulated outcome
0 – 3✅ Success
4 – 6❌ Rejected
7 – 9— No action (pending)
{ "body": { "bankAccountNo": "6217001234567892" } }
The last digit is 2 → the withdrawal will succeed.

​
sp1105 — Flow-order association

This API associates a flow order from a prior sp1104 call. The outcome is determined by the units digit of the amount from the referenced sp1104 transaction.
Units digit of sp1104 amountSimulated outcome
0 – 3✅ Success
4 – 6❌ Rejected
7 – 9— No action (pending)

​
sp1301 — RMB payment

The sandbox applies specific mock rules for RMB payment requests. Contact Gcashier Pay’s integration support team for the full mock value matrix for sp1301, as the triggering field depends on the collection method you are testing.
Mock rules only apply in the sandbox environment. Production responses reflect actual processing outcomes and are never deterministic in the same way.