---
title: "Avoiding test mode tangles with Stripe Sandboxes"
description: "Stripe integrations can become difficult to test when an account has only one test mode, because unrelated work can interfere and sensitive configuration must remain protected. The post presents Stripe Sandboxes as separate testing areas and shows a Node.js Express application authenticating with a sandbox secret key stored in a .env environment variable. It creates payment intents through /create-payment-intent and retrieves account details through /account, then uses Jest and supertest to verify the sandbox identity, including the expected display name dev-sandbox. A GitHub Actions workflow injects STRIPE_API_KEY from repository secrets, installs dependencies, and runs tests on pushes to the main branch, while .gitignore excludes environment files. The conclusion is that isolated sandboxes and automated checks reduce test tangles and help prevent calls to the wrong environment."
---

# Avoiding test mode tangles with Stripe Sandboxes

[Stripe](https://yomu.fyi/company/stripe) · Ben Smith · Sep 16, 2024

**Type:** Tutorial

## Summary

Stripe integrations can become difficult to test when an account has only one test mode, because unrelated work can interfere and sensitive configuration must remain protected. The post presents Stripe Sandboxes as separate testing areas and shows a Node.js Express application authenticating with a sandbox secret key stored in a .env environment variable. It creates payment intents through /create-payment-intent and retrieves account details through /account, then uses Jest and supertest to verify the sandbox identity, including the expected display name dev-sandbox. A GitHub Actions workflow injects STRIPE\_API\_KEY from repository secrets, installs dependencies, and runs tests on pushes to the main branch, while .gitignore excludes environment files. The conclusion is that isolated sandboxes and automated checks reduce test tangles and help prevent calls to the wrong environment.

## Context

Testing a Stripe integration requires balancing isolated environments with protection for sensitive information. The post states that using only one test mode per Stripe account can create test tangles and that requests must be directed to the intended sandbox without exposing secret API keys or affecting live transactions.

## Approach / What changed

The post uses separate Stripe Sandboxes, a Node.js Express example, and a sandbox secret key loaded from an environment variable. It integrates Jest and supertest tests with a GitHub Actions workflow that reads STRIPE\_API\_KEY from GitHub Secrets, runs on pushes to main, and verifies the expected sandbox account details. A .gitignore file excludes environment files from the repository.

## Takeaways

- Stripe API requests authenticate against the sandbox associated with the supplied key; missing keys produce invalid request errors, while incorrect or outdated keys produce authentication errors.
- Secret sandbox API keys should remain in server-side environment variables or credential management systems, must not be committed through files such as .env, and should not be exposed in websites or mobile applications.
- The example test checks the /account response for a 200 status, an account ID, the business profile name Sandbox, and the dashboard display name dev-sandbox.

**Tags:** [Authentication](https://yomu.fyi/topic/authentication), [CI/CD](https://yomu.fyi/topic/ci-cd), [Deployment](https://yomu.fyi/topic/deployment), [Reliability](https://yomu.fyi/topic/reliability), [Testing](https://yomu.fyi/topic/testing)

- Source: [Stripe](https://stripe.dev/blog/avoiding-test-mode-tangles-with-stripe-sandboxes)
- Source URL: https://stripe.dev/blog/avoiding-test-mode-tangles-with-stripe-sandboxes
- Ingested by Yomu: 2026-08-28T08:56:19.267Z

[Read original post](https://stripe.dev/blog/avoiding-test-mode-tangles-with-stripe-sandboxes)