REST API. JSON in, JSON out. Idempotent by key. Real webhooks with retry. Every request signed with HMAC-SHA256, so a leaked key on its own gets an attacker nowhere. Card data never touches your server, so you stay out of PCI scope. Sandbox and production share one base URL, switched by the key you send.
The reference, the guides and the controls, all in one developer hub.
Every endpoint, every field, every error code, with a worked example for each call. Sent to you when your keys are issued.
HMAC-SHA256 on every call. Working helper functions in Node, Python and PHP, ready to paste into your codebase.
Test cards and test webhooks against the same base URL as production. The key prefix decides which world you are in, so nothing moves for real.
Signed deliveries with a 5 minute freshness window, and up to 8 retries backing off across roughly 17 hours until you return a 2xx.
Share a URL and get paid, no checkout to build. Fixed or open amount, a cap on uses, an expiry date, and a QR code for print.
WooCommerce, Shopify, Magento, BigCommerce, PrestaShop, Wix and 65+ PMS platforms, plus 100+ more through our processing partners.
Store a card once and charge it later without the customer present. Setup intents and mandates handle the consent and the record.
Swapping test keys for live ones, scoping restricted keys down to what each service needs, and the checklist before you take real money.
We do not ship client libraries, because for this API you do not need one. There is one thing a library would do for you, which is sign the request, and it is about 20 lines. Take the helper for your language, drop it in, and call the API with the HTTP client you already use.
crypto.createHmac('sha256', key)hmac.new(key, msg, sha256)hash_hmac('sha256', $msg, $key, true)HMAC-SHA256 + base64METHOD PATH QUERY TS NONCE BODYHASHX-Timestamp within 300sX-Nonce is single useapi.cxpay.net/v1/RESTful endpoints organised by resource, on https://api.cxpay.net. Amounts are in the smallest unit of the currency, across 157 currencies including XCG. Writes take an Idempotency-Key, so a retry after a timeout cannot charge twice.
Shown in short. Most resources also take GET for listing, PATCH for updates, and the cancel routes their type allows. Customers and payment methods support DELETE.
Hosted checkout fires 4 events: payment_intent.succeeded, payment_intent.payment_failed, checkout_session.completed and checkout_session.expired. Each delivery carries an X-CXPay-Signature header you verify against the raw body. Make your endpoint idempotent, since a retry can arrive after you have already handled the event, and if a delivery never lands you can always read the truth from GET /v1/payment-intents/:id.
Ask your account manager for keys. They arrive as ak_test_ keys, with the reference and the signing helper, and most teams have a test payment going through the same day. You are early, and you will have us on the phone rather than a ticket queue.