CORS block on /v2/card-payments in Sandbox Mode

[DiegoNogueiraDev]

Description

When using the AbacatePay hosted checkout page in Sandbox Mode (dev API key abc_dev_*), credit card payments fail due to a CORS policy error. PIX payments work correctly with the "Simular Pagamento" button.

Steps to Reproduce

1. Create a billing using the dev API key (abc_dev_*)
2. Open the hosted checkout URL (e.g., https://app.abacatepay.com/pay/bill_xxx)
3. Page correctly shows "Sandbox Mode - Ambiente de teste"
4. Fill in customer info and click "Continuar"
5. Select "Crédito" payment method
6. Fill in card details (name, number, expiry, CVC, CEP, residential number)
7. Click "Pagar agora"

Expected Behavior

The sandbox should either:

• Process the test card payment (like PIX does with "Simular Pagamento")
• Show a "Simular Pagamento" button for card payments as well

Actual Behavior

The browser console shows:

Access to fetch at 'https://api.abacatepay.com/v2/card-payments' from origin 'https://app.abacatepay.com' 
has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Failed to load resource: net::ERR_FAILED @ https://api.abacatepay.com/v2/card-payments

The button shows "Trabalhando nisso..." and nothing happens. No error message is displayed to the user.

Workaround

Use PIX payment method instead, which works correctly in sandbox with the "Simular Pagamento" simulation button.

Environment

• Browser: Chromium (Playwright)
• API Key type: abc_dev_* (sandbox/dev)
• Checkout URL: https://app.abacatepay.com/pay/bill_*
• Date: 2026-02-17