Payment Sessions

Create a redirect payment session and return the provider checkout_url to send the customer to. The session expires 15 minutes after creation if the customer does not complete the hosted payment page.

Merchant API keys act on their own account. Partner API keys must include merchant_id for a linked merchant.

Sessions never accept card data. Requests carrying card, token, CVV or voucher fields are rejected with HTTP 422. Duplicate requests reusing an active reference are rejected with HTTP 409. See the duplicate protection guide.

Send customer.country_code and customer.ip_address (the shopper's IP as seen by your server). The provider risk-checks the shopper's IP; without customer.ip_address it receives the IP of the server calling this API, which can get every payment refused when that server is in a country the method does not serve. Country availability is checked before the provider is called.

Follow the alternative payment guide for the full flow.

Retrieve the current state of a payment session. Poll this endpoint after the customer returns to your success URL or rely on webhooks for the final outcome. A session is only complete when its status is paid.

Merchant API keys can read their own sessions. Partner API keys can read sessions belonging to linked merchants.

List the alternative (redirect) payment methods enabled for a merchant and, when country and/or currency are given, whether each one can be offered to that shopper. Use it to decide which methods to show at checkout before calling POST /api/v1/payment-sessions: a method with available: false would be refused there with the matching error (ERR_PAYMENT_METHOD_NOT_AVAILABLE_IN_COUNTRY, ERR_PAYMENT_METHOD_NOT_ENABLED).

The answer is computed from your enablement and the provider's published availability; it never contacts the provider to open a payment and has no side effects, so it is safe to call per checkout. It is advisory: the create call still runs the full provider preflight. Card payments are not listed; they are routed by your acquirer configuration and accepted on POST /api/v1/transactions.

supported_countries and supported_currencies are the restrictions in force for each method; an empty list means no restriction is known. unavailable_reasons is one or more of country_not_supported, currency_not_supported, provider_not_offering.

Merchant API keys list their own methods. Partner API keys must include merchant_id for a linked merchant.