Development Environment

Sandbox vs Production Mode

Yabetoo provides two distinct environments for safe development and testing.

Sandbox (Test)

Test environment for development. No real transactions are made.Key prefix: sk_test_

Production (Live)

Production environment for real transactions.Key prefix: sk_live_

API Keys Configuration

Never share your secret API keys. Use environment variables to store them securely.

Recommended Environment Variables

Create a .env file at the root of your project:

.env

# Test environment
YABETOO_SECRET_KEY=sk_test_XXXXXXXXXXXXXXXXXXXXXXXX
YABETOO_ACCOUNT_ID=acct_xxxxxxxx

# Callback URLs
YABETOO_SUCCESS_URL=http://localhost:3000/checkout/success
YABETOO_CANCEL_URL=http://localhost:3000/checkout/cancel
YABETOO_WEBHOOK_URL=http://localhost:3000/webhooks/yabetoo

Usage in Your Code

import Yabetoo from "@yabetoo/sdk-js";

const yabetoo = new Yabetoo(process.env.YABETOO_SECRET_KEY);

import os
from yabetoo import Yabetoo

yabetoo = Yabetoo(os.environ.get("YABETOO_SECRET_KEY"))

<?php
$yabetoo = new Yabetoo\Yabetoo($_ENV['YABETOO_SECRET_KEY']);

import com.yabetoo.Yabetoo;

Yabetoo yabetoo = new Yabetoo(System.getenv("YABETOO_SECRET_KEY"));

Test Phone Numbers

In sandbox mode, use these phone numbers to simulate different scenarios:

Number	Operator	Behavior
`242000000001`	MTN	Payment succeeds
`242000000002`	MTN	Fails (insufficient funds)
`242000000003`	MTN	Pending 30s, then succeeds
`242000000004`	Airtel	Payment succeeds
`242000000005`	Airtel	Fails (invalid number)

Test mode transactions don’t involve real money. You can test as much as needed.

Testing Webhooks Locally

To receive webhooks locally, use a tunneling tool like ngrok:

Install ngrok

# macOS
brew install ngrok

# or download from https://ngrok.com

Expose your local server

ngrok http 3000

You’ll get a URL like https://abc123.ngrok.io

Configure the webhook in the Dashboard

Go to Settings > Webhooks and add your ngrok URL:

https://abc123.ngrok.io/webhooks/yabetoo

Verify Webhook Signatures

Always verify webhook signatures to ensure they come from Yabetoo:

import crypto from 'crypto';

function verifyWebhookSignature(payload, signature, secret) {
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  );
}

import hmac
import hashlib

def verify_webhook_signature(payload: str, signature: str, secret: str) -> bool:
    expected_signature = hmac.new(
        secret.encode(),
        payload.encode(),
        hashlib.sha256
    ).hexdigest()

    return hmac.compare_digest(signature, expected_signature)

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.security.MessageDigest;

public boolean verifyWebhookSignature(String payload, String signature, String secret) {
    try {
        Mac mac = Mac.getInstance("HmacSHA256");
        SecretKeySpec secretKeySpec = new SecretKeySpec(secret.getBytes(), "HmacSHA256");
        mac.init(secretKeySpec);
        byte[] hash = mac.doFinal(payload.getBytes());
        String expectedSignature = bytesToHex(hash);
        return MessageDigest.isEqual(
            signature.getBytes(),
            expectedSignature.getBytes()
        );
    } catch (Exception e) {
        return false;
    }
}

Best Practices

Error Handling

Always implement robust error handling:

from yabetoo import Yabetoo, YabetooError
from yabetoo.errors import ValidationError, APIError

try:
    payment = yabetoo.payments.create(data)
except ValidationError as e:
    # Invalid data
    print(f"Validation error: {e.errors}")
except APIError as e:
    # API error
    print(f"API error: {e.message}")
except YabetooError as e:
    # Other Yabetoo error
    print(f"Error: {e}")

Idempotency

Use idempotency keys to avoid duplicates on retry:

payment = yabetoo.payments.create(
    data,
    idempotency_key="order_12345_payment"
)

Logging and Monitoring

Log all transactions for debugging:

import logging

logging.basicConfig(level=logging.INFO)
logger = logging.getLogger("yabetoo")

# Yabetoo SDKs log automatically

Pre-Production Checklist

Before going live, verify:

Complete Testing

Test all payment scenarios (success, failure, pending)
Test webhook reception and processing
Test refunds and cancellations

Security

API keys stored in environment variables
Webhook signature verification implemented
HTTPS enabled on all endpoints

Configuration

Production callback URLs configured
Webhooks pointing to production server
Production keys (sk_live_) in place

Useful Resources

Postman Collection

Quickly test the API with our Postman collection

API Reference

Complete API documentation

Error Handling

List of error codes and solutions

Webhooks

Webhook configuration and management

​Sandbox vs Production Mode

Sandbox (Test)

Production (Live)

​API Keys Configuration

​Recommended Environment Variables

​Usage in Your Code

​Test Phone Numbers

​Testing Webhooks Locally

​Verify Webhook Signatures

​Best Practices

​Pre-Production Checklist

​Useful Resources

Postman Collection

API Reference

Error Handling

Webhooks

Sandbox vs Production Mode

API Keys Configuration

Recommended Environment Variables

Usage in Your Code

Test Phone Numbers

Testing Webhooks Locally

Verify Webhook Signatures

Best Practices

Pre-Production Checklist

Useful Resources