# Keep testnet payments out of live orders and revenue

> Testnet and live payments need distinct records, credentials, environments and fulfillment effects. A shared token symbol or similar-looking address must never let a test transfer satisfy a live customer order.

Publisher: Coinvay | Published: 2026-10-27 | Updated: 2026-10-27 | Category: Security
Canonical: https://coinvay.com/articles/separate-testnet-and-live-payments

Keep testnet transfers, webhook events, credentials and fulfillment effects outside live orders, revenue and invoice usage.

## Identify the environment explicitly

Base and Base Sepolia use different chain identities, even though both can display ETH and USDC. A token’s symbol is not an adequate environment boundary. Mark test screens, receipts and payloads clearly, and validate the selected chain and token contract on the server. Coinvay’s merchant Sandbox restricts its payment flow to Base Sepolia ETH or test USDC, while normal live invoice checkout rejects testnets.


## Separate records and downstream effects

The sandbox stores checkouts and webhook events in separate tables, outside live invoices, payments and monthly usage. For example, a merchant can run repeated visual and transaction tests without changing reported sales or exhausting the Free plan’s live invoice allowance. That isolation must continue in your own integration: a sandbox event with livemode false should go to a test fulfillment system, not grant a paid production service.


## Test the boundaries rather than the happy path alone

Use an intentionally wrong network, a live token reference in a test request and an unrelated transaction hash. Confirm that each case stays unpaid. Sandbox management requires an interactive merchant session and does not accept live API keys. Downloadable commerce modules are not automatically connected to the interactive sandbox, so a successful test screen does not certify their production order mappings. Keep test webhook secrets, endpoints and customer accounts separate, and preserve the environment field when exporting receipts for troubleshooting.


## Practical checklist

- Use explicit chain IDs and token contracts rather than matching only symbols.
- Keep test orders, webhooks, entitlements and analytics outside production business records.
- Verify that test credentials and payment evidence cannot authorize a live checkout.

## Questions and answers

### Can I pay a live invoice with Base Sepolia USDC?

No. The live invoice flow rejects testnets. Test USDC belongs in the separate sandbox checkout.

### Is a different database table enough for my whole integration?

It is one boundary. Your webhook receiver, product access jobs, credentials and reporting also need to preserve the test environment distinction.

## Sources and further reading

- [Coinvay merchant API documentation](https://coinvay.com/docs)

## Related guides

- [Protect the wallet keys that receive merchant payments](https://coinvay.com/articles/protect-merchant-wallet-keys)
- [Use Google Authenticator to protect a merchant account](https://coinvay.com/articles/google-authenticator-for-merchants)
- [Reduce phishing risk in crypto payment checkout](https://coinvay.com/articles/crypto-payment-phishing-prevention)

Published by Coinvay with AI-assisted drafting. Product claims were checked against the implementation and linked primary sources. Provider facts and pricing can change; verify the current terms before choosing a service. Examples are illustrative, not customer results. No ranking or AI citation is guaranteed.