PayPal · Testing & Go-Live
PayPal has rebuilt the Developer Dashboard since most sandbox tutorials were written — the menus, the account dialog and the credentials page all moved. This is the current flow, end to end: developer login, a funded test buyer, a test seller, and the sandbox Client ID and Secret you paste into your gateway.
Those two colors run through the whole page. Anything marked in sand is test-only and safe to break; anything in blue touches your real PayPal account.
- Log in to the Developer Dashboard
- Switch the dashboard to Sandbox
- Open Testing Tools › Sandbox Accounts
- Create a test buyer (Personal)
- Create a custom account with a set balance
- Reveal the generated email and password
- Log in at sandbox.paypal.com
- Copy your sandbox Client ID and Secret
- Run a test payment
What changed, and why old guides mislead you
If you followed a sandbox tutorial written before 2019 you were told to register a separate “developer account”, hunt for a Sandbox › Accounts menu, and copy an API Username, Password and Signature. All three of those steps have moved on.
| Old guides say | Today it is |
|---|---|
| Sign up for a separate developer account | Sign in to developer.paypal.com with your ordinary PayPal login |
| Menu: Dashboard › Sandbox › Accounts | Menu: Testing Tools › Sandbox Accounts |
| You create both test accounts yourself | PayPal pre-creates one Personal and one Business account for you |
| Copy API Username / Password / Signature | Copy a Client ID and Secret from Apps & Credentials |
| Classic NVP/SOAP endpoints | REST (Orders v2) — NVP/SOAP still answers but takes no new integrations |
A complete duplicate of PayPal running on play money. Test accounts have their own logins, their own balances and their own transaction history, and they never touch your real account. You can refund the same $500 forty times and nobody bills you.
You will need: a PayPal account (a Business account if you plan to go live later), an email address you can reach, and about ten minutes.
Every dashboard image below is a faithful recreation of the PayPal Developer Dashboard, drawn to match the current layout, labels and menu names. Recreations stay legible when PayPal shifts a pixel, and they never leak a real account ID. Labels in bold in the text match the labels you will see on screen.
Get into the Developer Dashboard
Everything sandbox lives in one place, and you already have the login for it.
Log in at developer.paypal.com
Go to developer.paypal.com and choose Log in to Dashboard in the top-right corner. Sign in with the same email and password you use for ordinary PayPal — there is no separate developer registration any more.
If you do not have a PayPal account yet, use Sign Up and pick Business Account. A Personal account is enough to explore the sandbox, but only a Business account can take live payments or test from outside the US later, so starting there saves you a migration.
The credentials you type on this screen are your genuine PayPal credentials. Everything after this point is sandbox — but the front door is real, so turn on two-factor authentication if you have not.
Confirm the dashboard is set to Sandbox
The dashboard carries a Sandbox / Live toggle. It controls which set of API credentials and which transaction data you are looking at, and it is the single most common source of “my keys don’t work” support tickets. Set it to Sandbox and leave it there for the rest of this guide.
The left navigation is where you will spend the next few minutes. Apps & Credentials holds your API keys. Testing Tools holds everything else: sandbox accounts, sandbox emails, the webhooks simulator, the card generator and negative testing.
Welcome back
You are viewing sandbox data. Nothing here moves real money.
Create your test buyer and test seller
A realistic test needs two sides: a Business account that receives the money and a Personal account that spends it. PayPal makes one of each for you the first time you open the dashboard, so often you are already done — you just need to find them.
Open Testing Tools › Sandbox Accounts
In the left navigation choose Testing Tools, then Sandbox Accounts. You should already see two rows with machine-generated addresses in this shape:
sb-a1b2c34567890@business.example.com— your test sellersb-x9y8z76543210@personal.example.com— your test buyer
The example.com domain is deliberate: it is a reserved domain that can never receive real mail, which
is how PayPal guarantees a sandbox account can never be confused with a live one.
Sandbox Accounts
Test accounts for buying and selling. No real money moves.
| Account name | Type | Country | Date created | Manage accounts |
|---|---|---|---|---|
| sb-a1b2c34567890@business.example.com | Business | US | Aug 20, 2026 | … |
| sb-x9y8z76543210@personal.example.com | Personal | US | Aug 20, 2026 | … |
Check the environment toggle first — the table is empty in Live mode by design. If Sandbox is selected and the table is still empty, create the accounts manually in the next step.
Create a test buyer with Create account
Click Create account. The dialog asks two questions:
- Account Type — Personal for a buyer, Business for a merchant.
- Country/Region — pick the country you actually sell in. This is not cosmetic: it fixes the account’s currency and which funding options appear at checkout, and you cannot change it afterwards. Testing a UK store against a US test buyer is a classic way to chase a currency bug that does not exist.
Click Create Account and PayPal generates an email address, a password and a starting balance for you. Repeat with Business if you need a second merchant.
Use Create Custom Account when you need a specific balance or email
Generated addresses like sb-x9y8z76543210@personal.example.com are impossible to type from memory and
the default balance may not suit what you are testing. Choose Create Custom Account and you can set:
- First name and Last name — these appear on the checkout page and in transaction records.
- Email — still forced onto a sandbox domain, but you choose the readable part.
buyer@personal.example.combeats a random string every time. - Password — set your own so you are not digging it out of the dashboard later.
- PayPal balance — the play money in the account.
- Payment card — attach a test card so you can exercise the card flow, not just the wallet balance.
Create a second Personal account with a balance of $0 and no card. Half of the bugs worth catching live in the failure path — declined payment, abandoned return to the store, order left in Pending — and you cannot reach any of them from an account holding $5,000.
Reveal the generated email and password
For accounts PayPal created, you still need the password. On the account’s row click the … button under Manage accounts, choose View/Edit Account, and open the Profile tab. The email address and a System-generated password are both there, with a copy button. Change password on the same tab lets you set something memorable.
The same panel has an API Credentials tab. That one carries the legacy NVP/SOAP Username, Password and Signature. You only need it for an older integration — modern gateways use the Client ID and Secret from step 8 instead.
- Account type
- Personal
- Email ID
- sb-x9y8z76543210@personal.example.com
- System-generated password
- P4ssw0rd!x9 Copy
- Country
- United States
- PayPal balance
- $5,000.00 USD
- Account status
- Verified
Log in at sandbox.paypal.com to prove it works
Open www.sandbox.paypal.com in a private window and sign in with the test email and password. You will land in a PayPal account that looks exactly like the real one, down to the balance and the activity feed — because it is the same interface pointed at test data.
Use a private or separate browser profile. The sandbox and live sites share cookie behaviour closely enough that signing into both in one window is a reliable way to confuse yourself about which account you are looking at.
Get the sandbox Client ID and Secret
The test accounts are the actors. The Client ID and Secret are the keys your store uses to talk to PayPal on their behalf — this is the pair your plugin’s settings screen is asking for.
Apps & Credentials › Default Application
Open Apps & Credentials from the left navigation and make sure the Sandbox toggle is still selected. Under REST API apps you will find a Default Application that PayPal created with your account. Open it and copy the Client ID, then click Show next to Secret key and copy that too.
Every sandbox app is bound to one business sandbox account — shown as Sandbox account in the app header. If you created a second merchant to test with, use Create App and pick that account, otherwise your payments will keep landing in the default seller’s balance.
Default Application
Sandbox account — sb-a1b2c34567890@business.example.com
Features: Accept payments · Vault · Subscriptions · Payouts
Flipping the toggle to Live shows a completely different Client ID and Secret. Pasting a live key into a sandbox-mode store (or the reverse) produces an authentication failure with no useful message, and it is the cause of most “PayPal button won’t load” reports. Label the pair before you paste it, and never commit a Secret to a repository.
Run a payment through your store
In your gateway settings, switch to Sandbox or Test mode, paste the sandbox Client ID and Secret, and save. Then place a real order on your own site and pay with the test buyer credentials from step 5.
Check all three sides afterwards — a payment can succeed at PayPal and still fail to record on your store:
- The order in your store moved to Processing or Completed and shows a transaction ID.
- The buyer’s balance at
sandbox.paypal.comwent down. - The seller’s balance went up by the same amount, minus the test fee.
Then do it again badly: cancel at the PayPal screen, close the window mid-payment, and pay with a declining card. Those three paths are where real integrations break.
Sandbox test cards
For card payments rather than the PayPal wallet, use one of PayPal’s published test numbers. Any future expiry date works, with a three-digit CVV — four digits for American Express. Real card numbers are rejected in the sandbox.
| Brand | Number | CVV | Use it for |
|---|---|---|---|
| Visa | 4032 0356 8578 4487 | Any 3 digits | Standard approval |
| Visa | 4012 8888 8888 1881 | Any 3 digits | Long-standing test number |
| Mastercard | 2223 0000 4840 0011 | Any 3 digits | 2-series BIN range |
| American Express | 3714 4963 5398 431 | Any 4 digits | 15-digit / 4-digit CVV handling |
| Discover | 6011 1111 1111 1117 | Any 3 digits | Discover routing |
Need a card in a specific country or brand? Testing Tools › Credit Card Generator mints one on demand, and any card you attached in step 5 shows up on the account’s Funding tab.
Forcing a decline
Approvals are the easy half. To make a card fail on purpose, type a trigger keyword into the cardholder name field instead of a name — the amount and card number stay valid:
| Cardholder name | Result |
|---|---|
| CCREJECT-REFUSED | Generic issuer decline |
| CCREJECT-SF | Declined as suspected fraud |
| CCREJECT-EC | Declined as expired card |
Pair these with Testing Tools › Negative Testing, which forces specific API error responses so you can see how your store handles a timeout or a rejected order — not just a happy path.
Five things that waste an afternoon
PayPal will not let an account pay itself. If checkout dies at the login screen with a vague error, confirm the test buyer is not the same sandbox account the app is bound to.
A GBP order shown to a US test buyer may hide funding options or fail outright. Create a buyer in the country you actually sell to.
It never will — example.com cannot receive mail. Sandbox emails are captured in the dashboard
under Testing Tools › Sandbox Notifications.
PayPal has to reach your site from the public internet. Use a tunnel such as ngrok, or the Webhooks Simulator to fire an event by hand.
It happens, and it is not always your code. Check paypal-status.com before you start rewriting anything.
Frequently asked
Do I need a PayPal Business account to use the sandbox?
No. A Personal account gets you into the Developer Dashboard and lets you create sandbox accounts. You will need a Business account before you can go live, or to test from outside the United States, so most people create one at the start.
Does anything here cost money or touch my real balance?
No. Sandbox balances are play money in a separate environment. The only real credential involved is the PayPal login you use to reach the dashboard.
How many sandbox accounts can I create?
Enough for any realistic test plan. A good set is one merchant, one funded buyer, one empty buyer, and one buyer per extra country you sell to. Bulk upload is available if you need dozens.
Can I delete the accounts PayPal created for me?
Not the two originals ending in @business.example.com and @personal.example.com —
those are permanent. Accounts you create yourself can be deleted from the … menu.
Why does my sandbox account keep getting logged out?
Sandbox sessions are short by design and share cookie space with live PayPal. Keep the sandbox in its own private window or browser profile.
My Client ID works in the sandbox but fails on the live site. Why?
Sandbox and live credentials are entirely separate. Switch the dashboard toggle to Live, open your app there, and copy that Client ID and Secret. Your store must be out of test mode as well — both sides have to agree.
Where do the legacy API Username, Password and Signature live now?
On the sandbox account itself: … › View/Edit Account › API Credentials. They still work for existing NVP/SOAP integrations, but new work should use REST with the Client ID and Secret.