Authentication

Create an application in Applications and issue its API token. Keep the token on your server and send it with every API request:

Authorization: Bearer YOUR_APPLICATION_TOKEN

Each application can only access its own payments and refunds.

Permission	Access
payments:create	Request a collection
payments:read	Read payments, check status and read refunds
refunds:create	Request a full refund

The API token and webhook signing secret have different uses. The token authenticates requests to the gateway. The signing secret verifies requests from the gateway to your application.

Configure your callbacks

Set a result webhook URL for payment and refund events. For refunds, also set a Reserve funds URL. An administrator must approve the callback hostname on the gateway. Use HTTPS, port 443 and a publicly reachable address.

Rotate a token

In Applications, choose Issue API token. This replaces the previous API token. Update your application immediately. The webhook signing secret stays unchanged.