WinPay Integration DocsTürkçe →

Testing, FAQ and troubleshooting

Test list — all of it before going live

Identity and signature

Requests

Idempotency

Callback

End to end

Test scenarios

# Scenario Expected
1 100.00 deposit, member pays exactly that Callback approved, approved_amount = "100.00", balance +100
2 1000.00 deposit, member picks 950.00 on the page and pays Callback approved_amount = "950.00", balance +950
3 Deposit created, member never pays After 20 min callback expired, no balance change
4 Second request with the same request_id 201, same transaction_id, idempotent: true, no second transaction
5 Same request_id, different amount 409 CONFLICT
6 Callback delivered twice No balance change the second time, you still return 200
7 500.00 withdrawal, completed Callback completed; reservation final, withdrawal closed
8 500.00 withdrawal, rejected Callback rejected; reserved amount returned to the member
9 Your callback endpoint down for 5 minutes The notification is retried; processed once you are back, never lost
10 Clock 10 minutes ahead 401, message mentions "zaman damgasi ... pencerenin disinda"

FAQ

Can I query a transaction's status? There is no polling endpoint in this version. Results arrive by callback. If you think a callback was lost, resend the request with the same request_id; the existing transaction with its status is returned.

When does the callback arrive? When the payment is verified. If it cannot reach you, it is retried with growing intervals (up to 1 hour apart, for hours). Never discard a late notification as "old"; dedupe on event_id.

Is there a sandbox? Offline signature test vectors are in the Integration guide, steps 3 and 4. For a live trial you can open a low-amount test request with your real credentials; tell us in advance.

What if the member pays a different amount? Credit approved_amount. The original amount is informational.

Do you validate the IBAN? Format (26 characters, check digits) is validated. Whether the account belongs to the member is your check.

Amount format? String, dot decimal, max 2 decimals: "1000.00". 1000, "1.000,00", 1e3 are rejected.

How many requests can I send? 600 per minute on the init endpoints (per API key). Above that you get 429; back off exponentially.

Our key leaked. Write to us immediately; a new api_secret / callback_secret is issued and the old one stops working.

Troubleshooting

Symptom Cause Fix
Every request 401 Istek imzasi dogrulanamadi Body re-serialized after signing, or wrong api_secret One JSON.stringify, send that same string; check the key
401 zaman damgasi ... pencerenin disinda Clock off by more than 5 min Set up NTP
401 X-WinPay-Signature basligi gerekli Header missing or not 64 hex Check header names and hex output
403 Bu IP site API erişimine izinli değil Your outbound IP is not allow-listed (may have changed) Tell us the new IP
403 İşlem kabul edilmedi Member or IBAN blacklisted Ask us
400 Tutar: ondalık ayırıcı nokta... Format like "1.000,00" "1000.00"
400 Tutar sitenin yatırım limitleri dışında Amount outside the min/max set for your site Ask us for the limits
400 IBAN kontrol basamakları hatalı IBAN wrong Ask the member for the correct one
409 CONFLICT Same request_id, different body Inspect the existing transaction; do not generate a new request_id
429 Limit exceeded Wait and retry with exponential backoff
503 Bu tutar için uygun IBAN yok No account fits the amount / maintenance Show "try again shortly"; tell us if it persists
Callback never arrives URL not HTTPS, not publicly reachable, or redirects HTTPS, direct answer, 2xx within 10 s
Callback arrives but you return 401 You parse and re-stringify the JSON Verify over the raw body
Balance credited twice No unique event_id record UNIQUE column + same transaction
Wrong balance amount amount used approved_amount

Support

When reporting a problem, have ready: your request_id, the exact time of the request (with time zone), the HTTP status and code you received, your server's outbound IP. Never send secrets — no keys in messages, screenshots or logs.