Define the status transition rules
Describe when an order becomes pending, paid, canceled or refunded. Don't equate any provider response with success. The order ID, amount and currency must match the store data; the signature is verified on the server. The payment module secret should not be leaked into JavaScript or the request log.
Continue with: Laravel API retries: prevent duplicate operations.
Replay the message
The provider can send the callback again if it has not received confirmation. In the test environment, repeat the same event: payment, warehouse operations and messages to the manager should not be duplicated. Separately, check for messages with a delay when the buyer has already closed the browser and messages with an incorrect signature.
Continue with: OpenCart checkout errors: a diagnostic sequence.
Compare the final result
After the test, compare payment history, order history and CRM record. For cancellations and returns, check the agreed product reserve rules. The log should allow you to find a transaction by its ID, but not contain unnecessary payment or personal data. Perform the final test in a manner agreed upon with the store owner.
Is it possible to check with real payment?
Only in an agreed scenario with a defined amount and return rules. For most checks, a sandbox of the payment provider is sufficient first.