Test Cards & Phone Numbers
Card numbers and mobile-money phone numbers for testing approvals and declines in test mode.
Test Card Numbers (Visa / Mastercard)
Cards are processed through RohoPay's card processing network. Use the card below with a test_ API key. No real
card is charged.
| Brand | Number | CVV | Expiry | Outcome |
|---|---|---|---|---|
| Mastercard | 5531 8866 5214 2950 | 564 | 09/32 | ✅ Approved — completes via OTP |
In test mode, submit this card and RohoPay will return next_action.type: "otp".
The test-mode OTP code is 12345 — submit it to
POST /api/v1/checkout/{reference}/verify-card-otp
to complete the payment.
Use only the card numbers RohoPay publishes in this doc — we don't fabricate additional ones here, and numbers from other sources aren't guaranteed to work against RohoPay's test environment.
Older sandbox card numbers you may have seen elsewhere (4111 1111 1111 1111, 4000 0000 0000 0002,
5500 0000 0000 0004, 5200 8282 8210 0001) no longer apply to card payments.
The mobile-money sandbox numbers below are unaffected.
Test cards only work with test_ keys. Never use test card numbers with a live_ key.
Test Mobile Money Numbers
Use these with a test_ API key for mobile-money collections (mtn, airtel,
etc.). These are RohoPay's sandbox numbers — the last digit selects the outcome.
You can send them either in short form (0111...) or with the
256 country prefix (256111...); RohoPay accepts both in test mode.
RohoPay automatically routes each mobile-money collection through the most reliable available channel, with automatic failover to a backup channel if the primary is temporarily unavailable — which channel is used is an internal implementation detail (see Reliability & automatic failover). These sandbox numbers are guaranteed to work regardless of which internal channel ultimately handles the request.
| Phone (short form) | Phone (256 prefix) | Outcome |
|---|---|---|
011177777(0-9) | 25611177777(0-9) | ✅ Success |
011177799(0-9) | 25611177799(0-9) | ❌ Failed |
011177778(0-9) | 25611177778(0-9) | ⏳ Pending |
011177779(0-9) | 25611177779(0-9) | 🔄 SentToVendor |
Examples: 0111777771 (success) or 256111777771 (same number, success);
0111777995 (failed).
The public hosted checkout requires a 256/254/255/250 country prefix
even in test mode — send 256111777771, not 0111777771, there. Direct API
calls to /api/v1/collect accept the short form too.
Mobile-money test numbers only work with test_ keys. Never use sandbox phone
numbers with a live_ key.
Testing an Approval
curl -X POST https://api.rohopay.com/api/v1/checkout \
-H "Content-Type: application/json" \
-d '{
"api_key": "test_YOUR_KEY",
"amount": 10000,
"currency": "UGX",
"customer_name": "Test User",
"customer_email": "test@example.com",
"return_url": "https://your-site.com/checkout/return",
"card_number": "5531886652142950",
"card_expiry": "09/32",
"card_cvv": "564"
}'
You'll get back next_action.type: "otp". Submit the test-mode OTP (12345) to
POST /api/v1/checkout/{reference}/verify-card-otp to complete the payment.
Testing a Decline
RohoPay doesn't currently publish a dedicated decline-outcome test card number —
reach out to RohoPay support if you need to exercise a card-decline path in test
mode. Regardless of card, a decline surfaces as status: "failed" on the
transaction, and the webhook fires with deposit.failed.
Testing Expired Card Validation
RohoPay validates expiry server-side before hitting any provider. Submit a past date to test:
-d '{ ..., "card_expiry": "01/23" }'
# Response: 400 VALIDATION_ERROR — card has expired
Pre-Launch Checklist
Test the success path
Use a Visa/MC success card number and confirm your return URL and webhook both fire correctly.
Test the decline path
Use a decline card and confirm your error UI handles it gracefully.
Test expired card validation
Submit a past expiry date and confirm your frontend shows an appropriate error.
Verify webhook signature
Confirm your webhook handler verifies x-rohopay-signature before processing.
Switch to live_ key
Replace your test_ key with live_ in production environment variables.