Developers

One signed call. One callback. One entry.

The whole integration is a REST endpoint you sign, a callback you verify, and a status you can always ask for again.

Create a payment

Sign the JSON body with HMAC-SHA256 over the path — note the signature middleware strips the /api prefix, so you sign /v2/payins even though you POST to /api/v2/payins.

Code samples use api.example.com — your production endpoint is issued at onboarding.

RequestResponse

create-payment.sh

curl -X POST https://api.example.com/v2/payins \
  -H "Content-Type: application/json" \
  -H "X-API-Key: <your-api-key>" \
  -H "X-Timestamp: <unix-timestamp>" \
  -H "X-Signature: <hmac-sha256-of-path>" \
  -d '{
    "merchant_ref_id": "unique-order-ref-id-2025001",
    "currency_code": "THB",
    "request_amount": 1000,
    "customer_id": "0198cbc6-fd02-7459-a671-78c306d0a1ad",
    "customer_account_id": "0198cbc7-35ec-7c8c-8994-d3ac3e7f5255",
    "redirect_url": "https://merchant.example.com/payment/success"
  }'

{
  "id": "0198cbff-db9b-7b6a-9f82-6a55fdfb6575",
  "merchant_ref_id": "unique-order-ref-id-2025001",
  "status": "pending",
  "request_amount": 1000,
  "paypage_url": "https://pay.example.com/pay/0198cbff-db9b-7b6a-9f82-6a55fdfb6575"
}

Handle the webhook — verified & idempotent

We retry until your server answers HTTP 200. The signature is computed over the raw body, so re-serialising the parsed JSON will not match.

Reference

API surface

Endpoint	Description
/v2/payins	Create a payin (recommended)
/v1/payins/:id	Read one payin
/v2/payins/:id/cancel	Cancel a pending payin
/v1/payouts	Create a payout
/v1/payouts/:id	Read one payout
/v1/settlements	Settle to your own account
/v1/payins/:id/slip	Submit a transfer slip
/me/balances	Your balance per currency
/me/limits	Your settlement and transaction limits
/me/issues	Raise and track an issue

Sandbox

Dedicated debug endpoints for payins and payouts, so an integration can be exercised end to end before going live.

Production endpoints are issued at onboarding

Create an account and your application is reviewed before it goes live — credentials and production endpoints follow once approved.

Request access