Embedded testing guide

Automated tests

• Reject emails, empty values, overlong values, and invalid characters as external_user_id.
• Start token exchange only on the App backend and verify that AppClient secrets are absent from client artifacts.
• Fail safely when an access token is expired, revoked, or belongs to another Application, without exposing response bodies.
• Ensure /users/me/* paths, parameters, and cursors cannot access another user or Application.
• Keep Credits and money as decimal strings and return pagination cursors unchanged.
• Reuse the same Idempotency-Key for duplicate order attempts and prevent repeated business effects.
• Cover valid webhook signatures, body tampering, stale timestamps, duplicate events, and the secret-rotation window.

Pre-production checks

In an approved environment, verify Secret Manager injection, TLS, inbound and outbound network policy, device secure storage, clock synchronization, durable idempotency storage, alerts, and key rotation. Test logs and analytics must not contain credentials, short-lived tokens, prompts, responses, signatures, or full webhook bodies.

Passing local SDK tests and builds verifies client code behavior only. It does not replace acceptance of real networking, key management, and event delivery.