sumup-testing

A guide for testing SumUp payment integrations in a sandbox, which is a non-production test environment. It covers test merchants, cards, webhooks, logs, successful payments, and deliberate failures.

In plain words
What is it for?
It is for setting up SumUp integration tests, testing successful and challenged card payments, triggering failures, and verifying checkout callbacks and webhooks.
Why use it?
It provides repeatable test data and scenarios without using real payments or production systems.

Skill for Claude CodeCodex

Part of the sumup-skills plugin — 6 skills, 1 MCP server shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/sumup/sumup-skills/sumup-testing
Any agent
npx skills add sumup/sumup-skills --skill sumup-testing
Clone the repo
git clone --depth 1 https://github.com/sumup/sumup-skills

Made for: Claude Code, Codex.

Or install sumup-skills, the plugin that ships this one along with the rest of its 6 skills, 1 MCP server.

Per session 47 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 699 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00047 $0.00699
Opus 5 $0.00023 $0.00349
Sonnet 5 $0.00009 $0.00140
Haiku 4.5 $0.00005 $0.00070

Measured 3d ago against content hash 679fc7faa8e4, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

sumup-testing scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -X POST "https://api.sumup.com/v0.1/checkouts" \
skills/sumup-testing/SKILL.md · 90 lines

How it starts

The opening of the file, as written. The whole thing — 90 lines — stays where its author put it; the contents beside it link to each section on GitHub.

SumUp Sandbox Testing Guide

Use this skill for test setup, scenario design, and verification of SumUp integrations.

Test Environment Setup

  1. Use a sandbox merchant account only.
  2. Confirm credentials map to sandbox environment.
  3. Prepare webhook endpoint in a non-production environment.
  4. Enable logging for checkout id, reference, status, and error code.

Core Card Test Data

Default values unless docs specify otherwise:

  • CVV: any 3 digits (for example 123)
  • Expiry: any future date (for example 12/30)
  • Cardholder: any name

Happy path cards:

  • VISA 4200 0000 0000 0091
  • Mastercard 5200 0000 0000 0007

3DS challenge cards:

  • VISA 4200 0000 0000 0042
  • Mastercard 5200 0000 0000 0015

Deliberate Failure Conventions

  • For skill-level test recipes, use amount = 11 as the default forced-failure trigger.
  • If an integration already uses canonical amount-based failures (for example 42.01, 42.76, 42.91), run both patterns and document which one is authoritative for that flow.

End-to-End Smoke Test Recipe

  1. Create checkout with unique checkout_reference.
  2. Complete payment with a happy-path card.
  3. Verify frontend callback/result handling.
  4. Verify backend retrieves final paid status before fulfillment.
  5. Verify webhook delivery and idempotent processing.
  6. Repeat with forced-failure amount and confirm order remains unpaid.

cURL Skeleton

curl -X POST "https://api.sumup.com/v0.1/checkouts" \
  -H "Authorization: Bearer $SUMUP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "checkout_reference": "order-12345",
    "amount": 11,
    "currency": "EUR",
    "pay_to_email": "[email protected]",
    "description": "Sandbox test payment"
  }'

Adjust payload fields to the selected flow and auth model.

SDK Smoke Test Guidance

  • Keep one smoke test per integration surface (server SDK, mobile SDK, widget).
  • Assert normalized outcomes: success, pending, failed.
  • Capture and store reconciliation keys: checkout id, transaction id/code, merchant code, reference.

Read the full file on GitHub · 90 lines

Files

What ships with it

3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 90 lines · 47 tokens per session scan A 679fc7faa8e4

Subscribe to this mod's changes

sumup-testing is a skill published in the GitHub repository sumup/sumup-skills (4 stars, last pushed 4d ago), licensed Apache-2.0. It adds 47 tokens to every session and 699 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

limrun-android-emulator

Drive an app running on a Limrun cloud Android emulator: install an APK, launch and terminate apps with crash reports, tap, type, read the UI element tree, screenshot, record video, inject microphone audio, shape network bandwidth, and use adb over the CLI's tunnel for logcat, files, and shell. Use after a build (from…

limrun-inc/skills · 147 tokens

limrun-ios-simulator

Drive an app running on a Limrun cloud iOS simulator: launch, tap, type, read the accessibility element tree, screenshot, record video, connect the app to local services, play a video file as the camera, and run timed action chains. Use after a build (from any builder) when the user wants to see, test, or interact…

limrun-inc/skills · 151 tokens

limrun-detox-testing

Configure, run, or debug Detox on Limrun iOS simulators. Use when attaching the Limrun Detox runtime to an app, wiring Detox mediator connectivity, or validating app/tester connections over destination tunnels.

limrun-inc/skills · 48 tokens

octoperf-auto-correlation

Use when an OctoPerf Virtual User imported from a HAR/Postman/JMX recording fails its validation run because dynamic values (session tokens, CSRF, signed URLs, anti-forgery inputs, auth challenges) captured at recording time are stale on replay. Triggers on requests for "auto-correlation", "correlate the VU", "fix…

OctoPerf/octoperf-claude-plugins · 132 tokens

payram-testnet-testing

Prove a PayRam install works end-to-end on testnet before touching real money — install on testnet, create a payment link, fund a wallet from a faucet, actually pay the link, and confirm the payment reaches FILLED. Covers Base Sepolia / Ethereum Sepolia funding, how a PayRam checkout takes payment, and every way to…

PayRam/payram-mcp · 118 tokens

limrun-maestro-testing

Run Maestro YAML flows against a Limrun cloud iOS simulator with lim ios maestro, from any environment (Linux, Windows, macOS, VM, container). Use when the user wants to run, write, or debug Maestro flows or maestro test on iOS, migrate an existing Maestro suite to remote simulators, or asks for UI testing with…

limrun-inc/skills · 113 tokens