One line, five stops
A payment is one object that only moves forward. It is checked before any money moves, debited from the payer's bank, settled by the bank, released to your balance, and paid out to your bank account. Two sidings leave the line: a payment the checks decline is never sent to the bank, and a debit the payer's bank sends back is netted from your next payout. Select a stop to read exactly what it means.
Start here
- Your first sandbox payment
A key from the first page of the free application, then a payer, a test bank account, the payer's authorization, a payment, a settled status and a signed event: seven calls.
- Going live
Apply free, build in the sandbox, send your build for review, and go live on your one website or app.
- The drop-in Pay by bank button
Bank payments on any checkout page: a session from your server, the button from
smp.js. - Invoices paid by bank transfer
Large business payments, sent by the customer to the invoice's own account number.
- The payment line
Every status, what moves a payment between them, and the risk checks that run before any debit.
- Signed webhooks
The events, their signature, and verification code in Node, PHP and Python.
- Idempotency
Retry money-moving requests without ever debiting twice.
- Errors
One error shape and every code the API returns.
- Returns and payouts
When a payer's bank sends a debit back, and how released money reaches you.
- The sandbox
Test bank accounts, a clock you can move, and return codes on demand.
- The partner program API
For partners and agents who bring merchants and share our fee.
How every call works
Keys
Send your secret key as a bearer token: Authorization: Bearer sk_sandbox_…. Keys that start sk_sandbox_ work only on the sandbox, and keys that start sk_live_ only on the live API. Keep secret keys on your server; never put one in a browser or an app. You can hold more than one, such as one per site, and rotate a key with an overlap (API keys).
Responses
A successful response from the payments API puts the resource in data. Lists add pagination with total, limit, offset and has_more; page through them with limit (1 to 100, default 25) and offset. The partner and dashboard APIs return their own shapes, shown on their reference pages. Errors always look like { "error": "…", "message": "…" }.
Money
Every amount is a whole number of cents in US dollars: 8400 is $84.00. No amount anywhere in the API has a decimal point.
Times and IDs
Timestamps are ISO 8601 in UTC. IDs are opaque strings: store them exactly as you receive them.
Rate limit
The payments API takes up to 100 requests per minute per merchant. Responses carry X-RateLimit-Limit and X-RateLimit-Remaining; a 429 adds Retry-After, in seconds.
Hosts
None of these addresses answer yet. The sandbox opens first.
| What | Address |
|---|---|
| Payments API, sandbox | https:// |
| Payments API, live | https:// |
| Drop-in button script | https:// |
| Bank accounts | The same two hosts: they forward /v1/bank-accounts/… to the bank-linking service |
| Partner program | https:// |
| Merchant dashboard | https:// |
| Applications (the free application, and the onboarding API) | https://: the application is at /apply/ |
