Each scenario aims two messages at the same moment, repeats the run a hundred times or more, and checks what your gateway recorded and told the merchant. The ids run along the payment: M for the 3DS method step, C for the challenge, W for webhooks, S for Stripe.
The demo scenario in the open-source core, with its own demo PSP and demo shop. Both paths send a result to the PSP with the same idempotency key. No PSP account needed.
Correctthe merchant is told one final status. Try it in two minutes.
The issuer confirmed the shopper. The CRes and your timeout's "abandoned" both reach Adyen with the same idempotency key; the loser gets 409 or 422 with error 704. paygate-demo has this race behind a switch.
Correcttreats the 704 as "already submitted": COMPLETED, the merchant told once.
The shopper authorises; the browser comes back (three times at once, as a reload does) while the webhook arrives. paygate-demo has this race behind a switch.
CorrectCOMPLETED, the merchant told once.
C3 and S1 run with the Adyen and Stripe packs; a 30-day trial covers both.
| Id | The race |
|---|---|
| M1 | The issuer's method notification races the browser's "go on without it" after 10 s |
| C1 | The shopper reloads the challenge page, and the issuer posts nothing back |
| C2 | The challenge result arrives after your timeout refused the payment |
| C3 | The challenge result races your timeout, both with the same idempotency key |
| C4 | The same race, without the issuer's confirmation |
| C5 | The challenge result beats the issuer's confirmation to Adyen |
| W1 | A late success webhook after Adyen's own refusal (control) |
| W2 | A success webhook after your gateway gave up on the payment |
| W3 | A success webhook races your failure path |
| W4 | A success webhook races a payment answer that arrived after your read timeout |
| Id | The race |
|---|---|
| S1 | The browser's return races the webhook |
| S2 | The shopper fails the challenge |
| S3 | Stale and duplicate webhooks hours after the final status |
| S4 | Forged and unsigned webhooks |
| S5 | A challenge never opened, your timeout, then a late authorisation |
| S6 | Authorised, but neither the return nor a webhook reaches you in time |
| S7 | Authenticated, then declined by the issuer, then your timeout |
| S8 | The create authorised, but its answer is lost |
| S9 | Frictionless, then duplicate webhooks |
The scenario file, what a correct gateway must have recorded and told the merchant, the PSP behaviour
it relies on (measured in the PSP's test environment, with the date), and the lab.yaml settings it uses.
Your PSP or flow isn't listed? Tell us.