Test your Managed Checkout integration

Test the Managed Checkout quickstart. Copy these tables into your test report and record evidence against each result. All cases start Not run.

What this plan verifies

The quickstart verifies a card purchase and a persisted payment. It does not build a fulfillment system, send receipts, or implement refunds. Count those effects only when your launch includes them; record the omission otherwise. Additional launch checks remain required when applicable, but are not evidence that the minimal quickstart already supplies those features.

Setup and inputs

1. Quickstart checkpoints

Run Q1–Q5 in order in the real sandbox. Keep the same order through Q2–Q5.

2. Payment failures and retries

Use a fresh order per case. Within each retry scenario, retain the original order and check for duplicate charges.

3. Payment delivery and order integrity

Use your development harness for fault injection. Label manual replays and mocked responses in the evidence.

4. Merchant-controlled experience

Run on supported desktop browsers and a real mobile device. Include keyboard/screen-reader use and supported in-app browsers. Test merchant-owned screens and transitions; report Bolt-hosted UI defects to Bolt.

5. Launch features

Run after replacing quickstart fixtures with real behavior. Use Not applicable only for features outside your launch, with a reason.

Results and completion

For each result, attach the actual outcome, order/transaction IDs, and redacted evidence. Record an issue, owner, and retest for failures. Duplicate rows for required browser/device runs.

Test notes

Replay a sandbox notification

For F6, F7, and F10, capture a notification received for your own sandbox transaction as sandbox-notification.json. Keep its original transaction reference. Load your sandbox signing secret into the server environment and run this helper against your development receiver:

import { readFileSync } from 'node:fs';
import { createHmac } from 'node:crypto';

const [endpoint, file] = process.argv.slice(2);
if (!endpoint || !file || !process.env.BOLT_SIGNING_SECRET) {
  throw new Error('Provide a development endpoint, payload file, and sandbox signing secret');
}
const body = readFileSync(file);
const signature = createHmac('sha256', process.env.BOLT_SIGNING_SECRET)
  .update(body).digest('base64');
const response = await fetch(endpoint, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json', 'X-Bolt-Hmac-Sha256': signature },
  body,
});
console.log(`Receiver returned HTTP ${response.status}`);
if (!response.ok) process.exitCode = 1;

node replay-webhook.mjs https://your-development-host.example/bolt/webhooks sandbox-notification.json

For the concurrent case, start two instances against the same endpoint and payload. For the older-event case, retain an earlier payload and replay it after a newer state is confirmed. A 200 response alone is not a pass: inspect the stored order, transaction reference, fulfillment count, and notification count.