Testing
Use the credentials provided on this page to test your solution.
When you sign up, you will be provided with a “live” account and a “test” account (the latter is prefixed with “test_”).
When testing, ensure requests submitted to Trust Payments reference your test sitereference.
Before you begin testing…
Please be aware of the following notes:
- Most fields submitted to our test system will be accepted. Any data breaching its defined specification will return an error message.
- Any test data that generates a successful response when submitted while a merchant is in test mode, will produce a declined response when a merchant is switched into live mode. In some cases, the test data may return an error response.
- Our test system attempts to simulate responses in a similar fashion to the live system. However, depending on your acquirer you may find some responses differ slightly from those given by the test system.
- In the interest of security, we recommend against using real payment details when using your test account.
- We recommend specifying the main amount “10.50” when testing. Other amounts can be used but may return unexpected responses.
- If you’re unsure where to start with your testing, you may find these resources helpful:
Test card details
The table below lists test card numbers and customer information that can be submitted to our test bank, along with the responses that should be expected in return.
- A baseamount of 70000 (£700.00) will always return a declined response from the test bank.
- A baseamount of 60010 (£600.10) will always return a bank system error from the test bank.
- Using baseamount 1050 (£10.50) will not generate an error.
3-D Secure v2
The following payment credentials can be used for testing 3-D Secure v2 (a form of SCA):
| Test case | Visa | Mastercard | American Express |
| Success frictionless | 4000000000001026 | 5200000000001005 | 340000000001007 |
| Success step-up | 4000000000001091 | 5200000000001096 | 340000000001098 |
| Failed frictionless | 4000000000001018 | 5200000000001013 | 340000000001015 |
| Failed step-up | 4000000000001109 | 5200000000001104 | 340000000001106 |
| Declined | 4242424242424242 | 5100000000000412 | 300000000000512 |
3-D Secure v1
The following payment credentials can be used for testing 3-D Secure v1 (a form of SCA):
Visa-branded cards
| Visa |
|||||
| Credit | Debit | V Pay | Electron | Purchasing | |
| Enrolled (Y) | 4111110000000211 | 4006260000002473 | 4370000000000111 | 4245190000000311 | 4484000000000411 |
| Not enrolled (N) | 4111110000000021 | 4006260000002481 | 4370000000000921 | 4245190000000121 | 4484000000000221 |
| Unknown enrollment (U) | 4111110000000401 | 4006260000002408 | 4370000000002307 | 4245190000000501 | 4484000000000601 |
Mastercard-branded cards
| Test case | Mastercard |
|||
| Credit | Debit | Maestro (Intl.) | Maestro (UK) | |
| Enrolled (Y) | 5100000000000511
2221000000000611 |
5124990000000911 | 5000000000000611 | 6759000000000711 |
| Not enrolled (N) | 5100000000000321
2221000000000991 |
5124990000000721 | 5000000000000421 | 6759000000000521 |
| Unknown enrollment (U) | 5100000000000701
2221000000000801 |
5124990000000101 | 5000000000000801 | 6759000000000901 |
3-D Secure status testing
To test for different 3-D Secure status values, follow the instructions displayed in the authentication prompt shown on the page (an example is shown below). In the textbox provided, you can enter different PIN values to test for different cases.
For Payment Pages:
With 3-D Secure enabled on your site reference, process a payment using one of the card numbers listed above and your browser will display an authentication prompt with instructions.
For JavaScript library implementations:
After your payment form has been updated to reference our JavaScript library, process a payment using one of the card numbers listed above and your browser will display an authentication prompt with instructions.
The authentication prompt will only be displayed for non-frictionless test card details.
Frictionless cards will bypass authentication. In this case, the payment will be processed immediately (without being prompted by the browser for information).
Follow the instructions displayed within the authentication prompt to complete the payment:
Non 3-D Secure
The following card types are not currently processed using 3-D Secure (a form of SCA):
| Card type | Authorisation | Decline | Expiry date | Security code |
| DINERS | 3000000000000111 | 3000000000000012 | 12/2030 | 123 |
| DISCOVER | 6011000000000301 | 6011000000000202 | 12/2030 | 123 |
| JCB | 3528000000000411 | 3528000000000312 | 12/2030 | 123 |
After the payment has been processed, the error code and status values stored with the processed AUTH are used to convey the final outcome.
Testing AVS and security code checks
If you haven’t already, please read our AVS and Security code documentation before testing:
Link to Payment Pages docs / Link to API docs
The following tables list test details that can be submitted to obtain different responses from the AVS and Security Code Checks. These details can be used with most major payment types.
Premise
| Billing premise | Security response | Security response caption |
| No 789 | 2 | Matched |
| No 123 | 4 | Not Matched |
| No 333 | 1 | Not Checked |
| Leave blank | 0 | Not Given |
Postcode / ZIP code
| Billing postcode | Security response | Security response caption | |
| UK | US | ||
| TE45 6ST | 55555 | 2 | Matched |
| TE12 3ST | 12345 | 4 | Not Matched |
| TE33 3ST | 33333 | 1 | Not Checked |
| Leave blank | Leave blank | 0 | Not Given |
Security code
| Security code | AMEX security code | Security response | Security response |
| 123 | 1234 | 2 | Matched |
| 214 | 2144 | 4 | Not Matched |
| 333 | 3333 | 1 | Not Checked |
| Leave blank | Leave blank | 0 | Not Given |
Testing non-card payment methods
Link to Payment Pages docs / Link to API docs
Testing recurring payments
Testing for the acquirer advice code
When processing recurring payments, some acquirers may return an acquirer advice code in the response. The acquirer advice code is a numeric value used to indicate if further recurring payments can be processed for the given card.
| Code | Description | Action |
| 0 | N/A | No action required |
| 1 | New account information available (Mastercard only) | Query customer for updated payment details |
| 2 | Cannot approve at this time | Try again later. If you are continuing to have difficulties, please contact your acquiring bank |
| 4 | Do not try again | Do not process further recurring transactions |
| 8 | Payment blocked by card scheme |
Where to find the acquirer advice code
- This code is returned in your daily subscription email report.
- It’s viewable within MyST by selecting the additional field to be displayed on the transaction search page. It can also be viewed on the single transaction view.
- Additionally, for those who have processed a recurring AUTH transaction using the API, the code is returned in the acquireradvicecode field in the response.
How to test for different acquirer advice codes
You can test that your system responds appropriately to different acquirer advice codes by processing transactions with the following attributes:
| Visa | ||
| Acquirer advice code returned | Card number | Base amount |
| 0 | 4111111111111111 | 1050 |
| 2 | 4000000000000671 | 1002 |
| 4 | 4000000000000671 | 1004 |
| 8 | 4000000000000671 | 1008 |
| Mastercard | ||
| Acquirer advice code returned | Card number | Base amount |
| 0 | 5100000000000511 | 1050 |
| 1 | 5100000000000271 | 1001 |
| 2 | 5100000000000271 | 1002 |
| 4 | 5100000000000271 | 1004 |
| 8 | 5100000000000271 | 1008 |
Testing Protect Plus
If you haven’t already, please read our Protect Plus document before testing:
Link to Payment Pages docs / Link to API docs
Use the following baseamount values in RISKDEC requests to simulate the different possible responses from the Protect Plus checks:
| baseamount | Possible fraudcontrolresponsecode returned | fraudcontrolshieldstatuscode returned |
| 1011, 2011, 3011 | 0100, 0150 | “ACCEPT” |
| 1033, 2033, 3033 | 0300, 0330, 0500 | “CHALLENGE” |
| 1044, 2044, 3044 | 0250, 0400, 0600, 0700, 0800, 1300 | “DENY” |
Testing DCC
If you haven’t already, please read our DCC document before testing:
Link to Payment Pages docs / Link to API docs
The card numbers listed in this test section are associated with specific local currencies. During your integration, you can use the following international test card details in order to test your system for successful and declined DCC transactions.
Successful authorisations
| Country code | Currency code | Visa Credit | Mastercard Credit |
| DE | EUR | 4500000000000007 | 5500000000000004 |
| GB | GBP | 4300000000002211 | 5311110000001511 |
| JP | JPY | 4900400000000005 | 5590410000000006 |
| US | USD | 4900460000000009 | 5590470000000018 |
Declined authorisations
| Country code | Currency code | Visa Credit | Mastercard Credit |
| DE | EUR | 4500000000002482 | 5500000000002422 |
| GB | GBP | 4300000000002492 | 5311110000002402 |
| JP | JPY | 4900400000002472 | 5590410000002432 |
| US | USD | 4900460000002492 | 5590470000002402 |
JavaScript Library (version 1)
If you are integrating with us for the first time, we strongly recommend using the latest version of our JavaScript Library.
Install a library
We provide libraries for the Python and PHP programming languages. Alternatively, it is possible to use cURL in a variety of other languages. These libraries consist of functions that can be referenced within your program body without defining them explicitly.
We recommend that you follow the instructions below to download and install your preferred library on your server.
If you plan on using your own library to process requests, you will need to read “Configuring your own library“.
Python To install our Python library, you can use ‘pip‘, which is a package management system used to install and manage software packages written in Python. Alternatively, you can download the package from https://github.com/Secure-Trading/st-python-api and install the library manually. PHP You can use the following command to install our PHP library. Composer is a tool for dependency management in PHP. It allows you to declare the libraries your project depends on and it will install and update them for you. cURL Provided your system already has cURL installed, no additional installation is required. Please ensure that any additional debugging enabled whilst testing your integration is disabled prior to going live. Failing to do so may contravene the requirements needed to maintain PCI compliance. You have now installed a library on your server, and you can use this to send requests to our gateway. Read on to learn how to process your first request. You can use our JavaScript Client SDK (“st.js”) to process payments without submitting the customer’s card details to your server, thereby simplifying the audit process for PCI DSS. Your server-side payment form must assign all card details with the attribute “data-st-field”. During payment form submission, “st.js” will tokenise all fields with the attribute “data-st-field” to create a unique cachetoken. This cachetoken is then submitted to your server, along with all other fields that do not have the attribute “data-st-field”. The following is an example of a payment form: To use the Client SDK, reference our “st.js” in your webpage’s HTML mark-up, as demonstrated in the payment form example above. You must ensure that your payment form has been assigned the id “st-payment”. The following are required fields and must be included in the payment form: After the customer clicks “Pay”, these fields are used to generate a unique cachetoken that will later be posted to your server, for the purpose of processing requests. Any input fields that have the attribute “data-st-field” are transmitted directly to Trust Payments from the customer’s browser session in a secure manner. This means that these sensitive payment details are never submitted to your server. A “div” element with attribute id=”st-message” is required, in order for invalid field and connection errors to be displayed, in cases when ‘st.js’ fails to generate a cachetoken. If there is an error during the cachetoken generation process, the optional CSS included in the server-side payment form example will highlight any invalid input fields on the form and style the error message returned. Ensure the action in the server-side payment form is a valid URL address hosted on your server. The address specified must be able to take the generated cachetoken and all fields without the “data-st-field” attribute, which are submitted to the Server SDK as a JSON request. If you need to perform additional tasks after the cachetoken has been passed to the customer’s browser session, but before the payment form details are submitted to your server, you can do so by passing the submitFormCallback parameter to the SecureTrading.Standard library. The response messages can be returned to the customer in the following languages: By default, the response is returned in English. In order to change the default language, simply change the locale value in the payment form example above. To return the response in the English language, set the locale to ‘en_gb’. An example of a message returned to the customer – “There has been a problem with your payment, please verify your details and try again.” You can process successful transactions by submitting the following test card numbers: Other cards are supported. Click here for further testing credentials. You should now have a basic form that can be used to collect the customer’s payment details and send a cachetoken to your server. The following describes how you can reference the SDK functions within your program body to submit a request to our servers. You can create a Web Services user using our MyST interface. Your system will need to submit this username in every request, along with the password. In our request examples we use a placeholder username and password, which you will need to replace with your own credentials before testing. If you don’t already have Web Services credentials, click here to learn how to configure this. Your server will now need to generate a request. For example: You must use a valid domain that is accessible by Trust Payments. You will need to submit the generated request to the Trust Payments library installed above. The following are examples of how to perform a request for each tool and programming language we currently support. Your system will be returned numerous fields in the response object. You will need to interpret the contents of these fields to ensure they are the values expected. The following is an example of an AUTH response: It is especially important to check the Error Code and settle status values returned in the response. In addition to processing authorisations, Trust Payments supports numerous other request types. For further information on these request types, please refer to the other pages within our online documents. Summary At this point, you should be able to process a basic request using our Webservices API. Next steps We’re here to help We hope that you find our online help resource to be useful. If you are experiencing issues with your configuration, please visit our Troubleshooting page.
pip install securetrading
composer require securetrading/stpp_json
Collecting payment details using Cachetoken
Server-side payment form
<html>
<head>
<style>
#st-payment input.st-error {
background-color: #ffc6c7;
border: 2px solid #ffb5b5;
}
#st-message .st-error {
background: #ffcdcd;
border: 2px solid #ffb5b5;
padding: 4px 4px 4px 28px !important;
}
</style>
</head>
<body>
<div id="st-message"></div>
<form id="st-payment" action="https://www.example.com">
<!--Ensure all payment details use the data-st-field attribute.-->
Pan:
<input type="text" data-st-field="pan" autocomplete="off" /></br>
Expiry Month:
<input type="text" data-st-field="expirymonth" autocomplete="off" /></br>
Expiry Year:
<input type="text" data-st-field="expiryyear" autocomplete="off" /></br>
Security Code:
<input type="text" data-st-field="securitycode" autocomplete="off" /></br>
<!--You can submit your own custom fields within this form, e.g. discount code-->
Discount Code:
<input type="text" name="discountcode" autocomplete="off" /></br>
<input type="submit" name="mybtn" />
</form>
<script src="https://webservices.securetrading.net/js/st.js"></script>
<script>
new SecureTrading.Standard({
sitereference: "test_site12345", locale: "en_gb"
});
</script>
</body>
</html>
<html>
<!-- If you need to change the names of the identifiers “st-message” and “st-payment”, -->
<!-- because your application doesn’t support the naming convention used -->
<!-- (e.g. no hyphen support), you can use the markup found here to override them. -->
<head>
<style>
#st-payment input.st-error {
background-color: #ffc6c7;
border: 2px solid #ffb5b5;
}
#st-message .st-error {
background: #ffcdcd;
border: 2px solid #ffb5b5;
padding: 4px 4px 4px 28px !important;
}
</style>
</head>
<body>
<div id="stmessage"></div>
<form id="stpayment" action="https://www.example.com">
<!--Ensure all payment details use the data-st-field attribute.-->
Pan:
<input type="text" data-st-field="pan" autocomplete="off" /></br>
Expiry Month:
<input type="text" data-st-field="expirymonth" autocomplete="off" /></br>
Expiry Year:
<input type="text" data-st-field="expiryyear" autocomplete="off" /></br>
Security Code:
<input type="text" data-st-field="securitycode" autocomplete="off" /></br>
<!--You can submit your own custom fields within this form, e.g. discount code-->
Discount Code:
<input type="text" name="discountcode" autocomplete="off" /></br>
<input type="submit" name="mybtn" />
</form>
<script src="https://webservices.securetrading.net/js/st.js"></script>
<script>
new SecureTrading.Standard({
sitereference: "test_site12345",
locale: "en_gb",
messageId: "stmessage",
formId: "stpayment",
});
</script>
</body>
</html>
Callback prior to processing a payment
new SecureTrading.Standard({
sitereference: "test_site12345",
submitFormCallback: function(responseObj){
var cachetoken = responseObj['response'][0]['cachetoken']; <!-- Grab token -->
console.log(cachetoken); <!-- Logs the token to the console (Additional steps can be performed here before submitting to your server) -->
document.getElementById(‘st-payment’).submit(); <!-- Submit the form -->
}
Language support
To return the response in the French language, set the locale to ‘fr_fr’.
To return the response in the German language, set the locale to ‘de_de’.
Test credentials
Payment type
Test PAN
Expiry date
Security code
Visa
4111111111111111
12/2030
123
Mastercard
5100000000000511
12/2030
123
Note: Any expiry date submitted to our test bank is valid, providing the date is in the future.
The cachetoken can be used in conjunction with your installed library to process a request.
Process requests using our Webservices API
"sitereference": "test_site12345",
"requesttypedescriptions": ["AUTH"],
"accounttypedescription": "ECOM",
"currencyiso3a": "GBP",
"baseamount": "1050",
"orderreference": "My_Order_123",
"cachetoken": "<INSERT TOKEN HERE>"
#!/usr/bin/python
import securetrading
stconfig = securetrading.Config()
stconfig.username = "[email protected]"
stconfig.password = "Password1^"
st = securetrading.Api(stconfig)
#Replace the example Web Services username and password above with your own
request = {
"sitereference": "test_site12345",
"requesttypedescriptions": ["AUTH"],
"accounttypedescription": "ECOM",
"currencyiso3a": "GBP",
"baseamount": "1050",
"orderreference": "My_Order_123",
"cachetoken": "<INSERT TOKEN HERE>"
}
strequest = securetrading.Request()
strequest.update(request)
stresponse = st.process(strequest) #stresponse contains the transaction response
<?php
if (!($autoload = realpath(__DIR__ . '/../../../autoload.php')) && !($autoload = realpath(__DIR__ . '/../vendor/autoload.php'))) {
throw new Exception('Composer autoloader file could not be found.');
}
require_once($autoload);
$configData = array(
'username' => '[email protected]',
'password' => 'Password1^',
);
//Replace the example Web Services username and password above with your own
$requestData = array(
'sitereference' => 'test_site12345',
'requesttypedescriptions' => array('AUTH'),
'accounttypedescription' => 'ECOM',
'currencyiso3a' => 'GBP',
'baseamount' => '1050',
'orderreference' => 'My_Order_123',
'cachetoken' => '<INSERT TOKEN HERE>'
);
$api = \Securetrading\api($configData);
$response = $api->process($requestData);
var_dump($response->toArray());
?>
curl --user [email protected]:Password1^ https://webservices.securetrading.net/json/ -H "Content-type: application/json" -H "Accept: application/json" -X POST -d '{
"alias":"[email protected]",
"version": "1.00",
"request": [{
"currencyiso3a": "GBP",
"requesttypedescriptions": ["AUTH"],
"sitereference": "test_site12345",
"baseamount": "1050",
"orderreference": "My_Order_123",
"accounttypedescription": "ECOM",
"cachetoken": "<INSERT TOKEN HERE>"
}]
}'
Handling the response
{
u 'requestreference': u 'A0bxh87wt',
u 'version': u '1.00',
u 'response': [{
u 'transactionstartedtimestamp': u '2016-12-07 11:32:44',
u 'livestatus': u '0',
u 'issuer': u 'SecureTrading Test Issuer1',
u 'splitfinalnumber': u '1',
u 'dccenabled': u '0',
u 'settleduedate': u '2016-12-07',
u 'errorcode': u '0',
u 'orderreference': u 'My_Order_123',
u 'tid': u '27882788',
u 'merchantnumber': u '00000000',
u 'merchantcountryiso2a': u 'GB',
u 'transactionreference': u '23-9-80001',
u 'merchantname': u 'Test Merchant',
u 'paymenttypedescription': u 'VISA',
u 'baseamount': u '1050',
u 'accounttypedescription': u 'ECOM',
u 'acquirerresponsecode': u '00',
u 'requesttypedescription': u 'AUTH',
u 'securityresponsesecuritycode': u '2',
u 'currencyiso3a': u 'GBP',
u 'authcode': u 'TEST36',
u 'errormessage': u 'Ok',
u 'operatorname': u '[email protected]',
u 'securityresponsepostcode': u '0',
u 'maskedpan': u '411111######0021',
u 'securityresponseaddress': u '0',
u 'issuercountryiso2a': u 'US',
u 'settlestatus': u '0'
}]
}
array(3) {
["requestreference"] => string(9) "A3579dkvx"
["version"] => string(4) "1.00"
["response"] => array(1) {
[0] => array(28) {
["transactionstartedtimestamp"] => string(19) "2016-12-09 09:52:19"
["livestatus"] => string(1) "0"
["issuer"] => string(26) "SecureTrading Test Issuer1"
["splitfinalnumber"] => string(1) "1"
["dccenabled"] => string(1) "0"
["settleduedate"] => string(10) "2016-12-09"
["errorcode"] => string(1) "0"
["orderreference"] => string(12) "My_Order_123"
["tid"] => string(8) "27882788"
["merchantnumber"] => string(8) "00000000"
["securityresponsepostcode"] => string(1) "0"
["transactionreference"] => string(10) "72-9-80003"
["merchantname"] => string(13) "Test Merchant"
["paymenttypedescription"] => string(4) "VISA"
["baseamount"] => string(4) "1050"
["accounttypedescription"] => string(4) "ECOM"
["acquirerresponsecode"] => string(2) "00"
["requesttypedescription"] => string(4) "AUTH"
["securityresponsesecuritycode"] => string(1) "2"
["currencyiso3a"] => string(3) "GBP"
["authcode"] => string(6) "TEST31"
["errormessage"] => string(2) "Ok"
["operatorname"] => string(23) "[email protected]"
["merchantcountryiso2a"] => string(2) "GB"
["maskedpan"] => string(16) "411111######1111"
["securityresponseaddress"] => string(1) "0"
["issuercountryiso2a"] => string(2) "US"
["settlestatus"] => string(1) "0"
}
}
}
{"requestreference":"W23-fjgvn3d8","version":"1.00","response":[{"transactionstartedtimestamp":"2016-12-07 15:08:47","livestatus":"0","issuer":"SecureTrading Test Issuer1","splitfinalnumber":"1","dccenabled":"0","settleduedate":"2016-12-07","errorcode":"0","baseamount":"1050","tid":"27882788","merchantnumber":"00000000","merchantcountryiso2a":"GB","transactionreference":"23-9-80006","merchantname":"Test Merchant","paymenttypedescription":"VISA","orderreference":"My_Order_123","accounttypedescription":"ECOM","acquirerresponsecode":"00","requesttypedescription":"AUTH","securityresponsesecuritycode":"2","currencyiso3a":"GBP","authcode":"TEST96","errormessage":"Ok","operatorname":"[email protected]","securityresponsepostcode":"0","maskedpan":"411111######1111","securityresponseaddress":"0","issuercountryiso2a":"US","settlestatus":"0"}],"secrand":"zO9"}
