A clean, idempotent payment API
A REST API designed the way integrators expect: bearer API keys, mandatory idempotency on writes, HMAC-signed requests and webhooks, stable machine-readable error codes, and tenant-scoped resources. A full OpenAPI specification ships with it.
Endpoints, in one sentence each
- Create a payment / invoice — quote a fiat amount in an asset and get a deposit address.
- Create an order — charge first and let the customer choose the currency on the hosted checkout.
- Payment & order status — the authoritative record of what has been paid and credited.
- Payouts — send single or batch transfers on-chain, under policy limits.
- Refunds — return funds against a payment.
- Assets — the catalog of currencies your deployment supports.
See the full documentation or the OpenAPI spec.
Correct by construction
Every write endpoint requires an Idempotency-Key; replaying it returns the original result instead of creating a duplicate invoice or payout, so a network retry can never double-charge. Errors use stable codes rather than prose, and every resource is scoped to your tenant so one merchant can never read another’s data.
POST /v1/invoices with {"price_usd":"100.00","asset_id":"USDC"} returns an invoice id, status, and a payment address — see the create-payment guide.Webhooks you can trust
Payzuno posts a signed event at each state change. Each carries an HMAC signature over the raw body plus a timestamp; you verify it with your webhook secret and reject anything outside a small time window. Crediting in your system should always follow the on-chain confirmation, with the webhook as the trigger. Details in the webhooks guide.
Test before you go live
Issue keys, run the entire deposit → confirm → webhook → payout flow on a testnet, then switch to mainnet keys. The quick start takes you from zero to a live testnet invoice in minutes.
Frequently asked questions
Is there an OpenAPI specification?
Yes, published at /openapi.yaml. You can generate a typed client for most languages from it, and a TypeScript SDK is available.
How does the API prevent duplicate charges?
Write endpoints require an Idempotency-Key. Replaying the same key returns the original result rather than creating a second invoice or payout.
How is the API authenticated?
With bearer API keys. Signed deployments can additionally require HMAC-signed requests, and every resource is tenant-scoped.
What formats do errors use?
Stable, machine-readable error codes with a type and message, so your integration can branch on the code rather than parse prose.
Can I try the API without real money?
Yes. Run the full flow against a testnet with test keys, then switch to mainnet keys when ready.
Related
Ready to accept crypto on your own terms?
Spin up a testnet integration in minutes, then switch to mainnet when you are ready. No lock-in.