How do I test my integration in the sandbox?

Last reviewed: 04.11.2026

What can I test?

• Payments: card only.
• Crypto: BTC testnet and ETH Sepolia only.
• Test cards are listed on the Sandbox page. One of them can simulate a declined payment by CVV.
• Other outcomes, such as a cancellation by our risk checks, have no test trigger. To test how you handle those statuses, use the callback examples in the docs.

How do I test KYC?

Your integration manager approves KYC reviews manually. To skip manual review, use the SumSub test documents linked on the Sandbox page. Liveness (selfie) is required in the sandbox too. If the EEA questionnaire appears, complete it as well.

Why does the sandbox return 403, and how do I get my IP whitelisted?

The sandbox (sandbox-api, sandbox-exchange, sandbox-widget and sandbox-dashboard) accepts requests only from IP addresses on our whitelist. Any other IP gets HTTP 403. To get access, send your integration manager the public IPs your requests actually come from. Production needs no IP whitelist.

1. Find your public IP on the machine that sends the requests. Use your server for API calls and your laptop for the widget and the Dashboard:

   curl -4 https://ifconfig.me
   curl -6 https://ifconfig.me

   The second command prints an IPv6 address if your network has one. Send both addresses: many systems, macOS included, switch between IPv4 and IPv6 on their own.

2. Check what can change your IP. A VPN, a corporate proxy or a cloud NAT gateway each give you a different public IP. Run step 1 with the same VPN or proxy setup you will use for testing. Home and office connections can also get a new IP after a router restart.
3. Send the list to your integration manager. We add single addresses only. If your traffic comes from a range of IPs or an IPv6 prefix, route it through one fixed exit IP, for example a VPN with a static address.

4. Wait about 15 minutes and test:

   curl -i https://sandbox-api.mrcr.io/v1.6/lib/currencies

   • HTTP 200 with JSON: you are on the whitelist.
   • HTTP 403 with a short HTML page "403 Forbidden": the IP that reached us is outside the whitelist. Repeat step 1 on the same machine and compare.

Details: https://widget.docs.mercuryo.io/guide/getting-started/sandbox