[guyfromfargo]

I work in this space and can tell you it’s fairly common to test on real cards. Stripe knows this and they don’t care as long as it’s very infrequent tests.

But there is no reason to test a dozen times with a real card. Stripe is the gold standard of a test environment that exactly matches the real world. On top of a test environment they also have test clocks so you can run tests over time.

There is only one test in my opinion that warrants using a real card. The very first time you go live. When you’re first swapping the test keys to a live environment. There isn’t a good way to be 100% sure your system is working correctly without a real card test. The front end has a “test” badge, but there is no 100% way to verify the webhook and webhook secret are configurable properly without some sort of a test.

You only have to do this the first time. I often see devs want to use real cards to test updating a webhook secret, but you can usually replay a previous webhook to ensure your changes are working as expected.

For your specific situation I wouldn’t do any more real tests, but I wouldn’t panic about your previous tests. The odds of them taking action against you are extremely low.