topic Re: Sandbox tokenization returning 403 Forbidden using Node.js SDK in cybersource APIs

Sandbox tokenization returning 403 Forbidden using Node.js SDK

samAndrew — Sun, 07 Dec 2025 13:31:56 GMT

Hi, I’m working on integrating CyberSource in sandbox with the Node.js SDK and I’m consistently getting a 403 Forbidden response when attempting to create a payment token.

Basic setup:

Sandbox environment
Node.js REST SDK
Tokenization endpoint per docs

I’ve verified credentials, merchant ID, and environment configuration. No useful error body is returned, so debugging is difficult.

Questions:

Is this a known issue with the sandbox environment?
Are there additional headers or configuration steps required for tokenization?
Any working Node.js example would be very helpful.

Thanks.

Re: Sandbox tokenization returning 403 Forbidden using Node.js SDK

zackkev — Mon, 08 Dec 2025 11:09:37 GMT

I hit the same 403 problem a while back and it drove me nuts because the sandbox gives you zero useful error info. What finally fixed it was checking the boring setup details instead of the code.

For me the sandbox only accepts Flex keys for tokenization. I was sending requests with my normal API keys and the sandbox just kept throwing 403 with no hint why. The other thing that tripped me up was the merchant ID not matching the key file I downloaded. CyberSource will not warn you about that, it just blocks the request. Also make sure the host is exactly apitest.cybersource.com and don’t add any extra headers because the sandbox silently rejects them.

Once I regenerated the Flex key pair and cleaned my config, the token call worked instantly. If you want to confirm fast, run the curl example from their docs. If curl succeeds, the issue is somewhere in the Node setup, not the sandbox.

Re: Sandbox tokenization returning 403 Forbidden using Node.js SDK

aurden_amily — Tue, 09 Dec 2025 19:43:09 GMT

A 403 in the sandbox usually means a problem with credentials or setup. Double-check your API keys, merchant ID, and environment configuration. Make sure all required headers are included. Sandbox accounts sometimes block requests if they’re not fully activated. Using the Node.js examples from CyberSource can help confirm your setup.

Re: Sandbox tokenization returning 403 Forbidden using Node.js SDK

diegolopez — Wed, 10 Dec 2025 10:28:46 GMT

It's always a good idea to double-check the documentation for any additional configuration steps specific to tokenization. If possible, sharing a working Node.js example could really help clarify the process and ensure smoother integration.