​
Test the full lifecycle

Every integration should exercise:
  1. Session or payment creation.
  2. Customer redirect or embedded checkout.
  3. Successful confirmation.
  4. Decline or failure.
  5. Customer cancellation.
  6. Session expiry.
  7. Duplicate create request with the same idempotency key.
  8. Duplicate and delayed webhook delivery.
  9. Refund and subscription cancellation.

​
What to assert

  • The expected amount, currency, order ID, and metadata are retained.
  • The API rejects invalid amounts, methods, origins, tokens, and webhook signatures.
  • A retry with an idempotency key does not create a second payment.
  • A browser return does not fulfill an order by itself.
  • Webhook processing is safe to repeat.
  • Fulfillment happens only after a verified confirmation event.

​
Local development

Use the repository’s local merchant and integration test commands from zahlo-app. Keep test credentials and database URLs outside committed files. Use a disposable database for integration tests.