Appearance
Payment gateway code and sandbox reference (v2)
This reference is derived from the gateway implementations under backend/Payments/Gateways/ and the Composer dependencies. It explains what the editor settings become at runtime; it is not a substitute for each provider’s current account documentation.
The checked-in Composer constraints include paypal/rest-api-sdk-php (dev-master), stripe/stripe-php ^6.28, square/connect ^2.20181212, braintree/braintree_php 6.13.*, and bitpay/sdk-light (dev-master). Treat these as the application’s integration contract; do not paste examples for a different SDK major version without checking the implementation.
Common lifecycle
The form creates a payment record, builds a checkout action from the Shopping Cart, redirects or initializes the provider SDK, then accepts a success/failure callback. Gateways that implement the IPN capability also validate an asynchronous provider notification before marking the payment. Never treat a browser redirect alone as proof of payment.
Gateway matrix
| Gateway | Settings/credentials | Sandbox or test mode | Runtime SDK/API path |
|---|---|---|---|
| PayPal REST | clientId, secret | Use Sandbox switches the PayPal REST API context to sandbox; otherwise live. | paypal/rest-api-sdk-php; return and cancel URLs are generated under /api/v1/payments/pay/{success|failure}/.... |
| PayPal Checkout | Client_Id, Use_Sandbox, Pay_Now_Checkout_Flow | Use Sandbox selects the provider sandbox environment. | Server creates checkout configuration for the PayPal Checkout client flow. |
| Stripe Checkout | Secret_Key, Public_Key, ZIP, billing/shipping address, checkout button text | The implementation has no separate sandbox checkbox; use Stripe test keys (sk_test_…, pk_test_…) for test mode. | stripe/stripe-php; server creates Checkout/payment actions and validates the provider result. |
| Square | Personal_Token, Location_Id, detailed invoice, shipping address | No AbcSubmit sandbox toggle is defined; use Square sandbox credentials/location. | square/connect; server creates the checkout request with the configured location and invoice options. |
| Braintree | Merchant_Id, Public_Key, Private_Key, Use_Sandbox, PayPal checkout, button text | Use Sandbox selects Braintree sandbox environment. | braintree/braintree_php; server obtains a client token and initializes the browser checkout. |
| BitPay Checkout | token, action type, Enable Sandbox, donation/buyer/bill mappings, notifications | Enable Sandbox selects BitPay test environment. | bitpay/sdk-light; payment status is also validated through BitPay IPN. |
| EuPlatesc.ro | Merchant_Id, Key | No sandbox toggle is defined in this implementation; use the provider’s test merchant credentials/environment if your contract supplies one. | Server builds the EuPlatesc form/hash and validates the IPN MAC. |
| Cash on Delivery | Label/value mappings for the offline method | Not a remote gateway; no sandbox or provider SDK. | Creates an internal payment action and records the configured delivery fields. |
Sandbox procedure
- Create provider test credentials in the provider dashboard; never paste live secrets into a test form.
- Configure the matching AbcSubmit gateway and explicitly enable its sandbox switch where present. For Stripe, Square, and EuPlatesc use provider test credentials because the AbcSubmit setting has no sandbox flag.
- Use a dedicated unpublished/test form, synthetic customer data, and a zero-value or provider-approved test product.
- Exercise success, cancellation, decline, timeout, duplicate callback, and abandoned checkout paths.
- Confirm the server-side payment status and IPN/webhook verification, not only the browser return page.
- Remove test credentials from the provider account and rotate any secret that was exposed during testing before production activation.
Security and limits
Secrets are server settings; do not put them in Code fields, hidden fields, URLs, screenshots, or client-side JavaScript. Amounts originate from the form’s cart/invoice configuration and should be independently checked by the business owner. IPN-capable gateways validate signed callbacks; a failed signature must not be accepted as paid. Refunds and disputes are provider-account operations and are not implemented as a generic AbcSubmit form action.