Redsys sandbox for integrators
Build the Ds_MerchantParameters for your order, check that the fields match the format Redsys expects, and keep the sandbox test cards at hand. Everything runs in your browser: nothing is sent to any server.
Order parameters
In euros. Redsys expects cents; we handle the conversion.
Between 4 and 12 characters. The first 4 must be numeric.
Valid parameters
JSON before encoding
{
"DS_MERCHANT_AMOUNT": "1000",
"DS_MERCHANT_ORDER": "1234TEST",
"DS_MERCHANT_MERCHANTCODE": "999008881",
"DS_MERCHANT_CURRENCY": "978",
"DS_MERCHANT_TRANSACTIONTYPE": "0",
"DS_MERCHANT_TERMINAL": "1",
"DS_MERCHANT_MERCHANTURL": "https://ejemplo.com/api/redsys/notificacion",
"DS_MERCHANT_URLOK": "https://ejemplo.com/pago/ok",
"DS_MERCHANT_URLKO": "https://ejemplo.com/pago/ko"
}Ds_MerchantParameters
eyJEU19NRVJDSEFOVF9BTU9VTlQiOiIxMDAwIiwiRFNfTUVSQ0hBTlRfT1JERVIiOiIxMjM0VEVTVCIsIkRTX01FUkNIQU5UX01FUkNIQU5UQ09ERSI6Ijk5OTAwODg4MSIsIkRTX01FUkNIQU5UX0NVUlJFTkNZIjoiOTc4IiwiRFNfTUVSQ0hBTlRfVFJBTlNBQ1RJT05UWVBFIjoiMCIsIkRTX01FUkNIQU5UX1RFUk1JTkFMIjoiMSIsIkRTX01FUkNIQU5UX01FUkNIQU5UVVJMIjoiaHR0cHM6Ly9lamVtcGxvLmNvbS9hcGkvcmVkc3lzL25vdGlmaWNhY2lvbiIsIkRTX01FUkNIQU5UX1VSTE9LIjoiaHR0cHM6Ly9lamVtcGxvLmNvbS9wYWdvL29rIiwiRFNfTUVSQ0hBTlRfVVJMS08iOiJodHRwczovL2VqZW1wbG8uY29tL3BhZ28va28ifQ==The signature is computed server-side
This tool only builds Ds_MerchantParameters, which is Base64-encoded JSON and carries no secrets. Ds_Signature is computed by deriving a per-order key (3DES over the order number with your merchant key) and signing it with HMAC-SHA256. That key must never reach the browser: if you ship it to the frontend, anyone can sign payments on your behalf. Always do that step in your backend.
Sandbox test cards
| Number | Expiry | CVV | CIP (3DS) | Note |
|---|---|---|---|---|
| 4548 8120 4940 0004 | 12/34 | 123 | 123456 | Standard card, authenticates with 3DS |
How to use it
Fill in the order details
Amount, order number, merchant code and terminal. The tool validates the format as you type: the order number, for example, must start with four digits and stay under twelve characters.
Copy the Ds_MerchantParameters
It is the operation JSON encoded in Base64. That value goes as-is into the form you post to the virtual POS.
Compute the signature in your backend
Ds_Signature needs your merchant key and must never be computed in the browser. Derive the per-order key with 3DES and sign with HMAC-SHA256 from your server.
Test with the sandbox cards
Use the test card against the sis-t.redsys.es endpoint before touching production.
Frequently asked questions
Does this tool send my data anywhere?
No. Everything is computed in your browser. There are no server requests and nothing you type is stored.
Why does it not compute Ds_Signature?
Because signing requires your merchant secret key. If that key reached the browser, anyone could inspect it and sign payments on your behalf. The signature is always computed in the backend.
What is the Redsys test card?
The most common sandbox card is 4548 8120 4940 0004, with any future expiry date, CVV 123 and authentication code 123456 when the flow requires 3-D Secure. The current, complete list lives on the Redsys developer portal.
Is the amount in euros or cents?
Redsys expects the amount in cents with no separators. Here you type it in euros and the tool converts it when generating the parameters.
You may also be interested in
Integrating payments and hitting walls?
We have integrated Redsys, Stripe and Adyen into ecommerce and marketplaces with awkward requirements: recurring payments, split payments, reconciliation and partial refunds. If you are stuck, tell us about it.