Payment API

A clean, idempotent payment API

A REST API designed the way integrators expect: bearer API keys, mandatory idempotency on writes, HMAC-signed requests and webhooks, stable machine-readable error codes, and tenant-scoped resources. A full OpenAPI specification ships with it.

Endpoints, in one sentence each

  • Create a payment / invoice — quote a fiat amount in an asset and get a deposit address.
  • Create an order — charge first and let the customer choose the currency on the hosted checkout.
  • Payment & order status — the authoritative record of what has been paid and credited.
  • Payouts — send single or batch transfers on-chain, under policy limits.
  • Refunds — return funds against a payment.
  • Assets — the catalog of currencies your deployment supports.

See the full documentation or the OpenAPI spec.

Correct by construction

Every write endpoint requires an Idempotency-Key; replaying it returns the original result instead of creating a duplicate invoice or payout, so a network retry can never double-charge. Errors use stable codes rather than prose, and every resource is scoped to your tenant so one merchant can never read another’s data.

Example: POST /v1/invoices with {"price_usd":"100.00","asset_id":"USDC"} returns an invoice id, status, and a payment address — see the create-payment guide.

Webhooks you can trust

Payzuno posts a signed event at each state change. Each carries an HMAC signature over the raw body plus a timestamp; you verify it with your webhook secret and reject anything outside a small time window. Crediting in your system should always follow the on-chain confirmation, with the webhook as the trigger. Details in the webhooks guide.

Test before you go live

Issue keys, run the entire deposit → confirm → webhook → payout flow on a testnet, then switch to mainnet keys. The quick start takes you from zero to a live testnet invoice in minutes.

Frequently asked questions

Is there an OpenAPI specification?

Yes, published at /openapi.yaml. You can generate a typed client for most languages from it, and a TypeScript SDK is available.

How does the API prevent duplicate charges?

Write endpoints require an Idempotency-Key. Replaying the same key returns the original result rather than creating a second invoice or payout.

How is the API authenticated?

With bearer API keys. Signed deployments can additionally require HMAC-signed requests, and every resource is tenant-scoped.

What formats do errors use?

Stable, machine-readable error codes with a type and message, so your integration can branch on the code rather than parse prose.

Can I try the API without real money?

Yes. Run the full flow against a testnet with test keys, then switch to mainnet keys when ready.

Ready to accept crypto on your own terms?

Spin up a testnet integration in minutes, then switch to mainnet when you are ready. No lock-in.