Authentication

Every request carries the API key issued for your app, sent as a bearer credential:

HTTP
Authorization: Bearer YOUR_API_KEY

API keys are scoped to a single app, and the app is identified separately in the path (/api/apps/{appId}/…). A key for your sandbox app cannot touch live data, and vice versa.

Rules

  • Server-side only. The key authorises payment operations — never ship it to a browser, a mobile app or a public repository.
  • Rotate on exposure. Create a replacement key in the Console and delete the old one; it stops working immediately.
  • One key per integration. Separate keys make it possible to revoke a single store or service without taking the rest down.
  • Team access is role-based. Console users have roles and permissions; API keys act with the permissions granted to them.

Missing or invalid credentials return 401 Unauthorized; a valid key without permission for that app returns 403 Forbidden.

Environments

Sandbox and live are fully isolated: separate apps, separate credentials, separate provider configuration, and no crossover of data between them.

Base URLs

Service Base URL What it is for
Payment API https://api.paymenthood.com Payments and customers — everything in this reference
App API https://appapi.paymenthood.com App settings, webhook signing secret, provider profiles, fraud policies
Console https://console.paymenthood.com The dashboard: credentials, providers, payments, webhook logs

Both APIs publish an OpenAPI document and a browsable UI at /swagger/index.html — for example api.paymenthood.com/swagger (opens in new tab). The spec is the authoritative contract; this page documents the endpoints you need day to day.

Sandbox behaviour

  • Use your provider's own test credentials and test cards — no live money moves.
  • Undelivered sandbox webhooks are abandoned after one hour; live webhooks keep retrying.
  • A sandbox webhook URL must still be reachable from the internet. On a local machine use a tunnel such as Cloudflare Tunnel or ngrok — localhost can never receive a webhook.

Supported currencies

A payment is created in one of these currencies; which ones you can actually charge depends on the provider profiles configured for your app.

  • USD
  • EUR
  • GBP
  • AED
  • SAR
  • QAR
  • AUD
  • CAD
  • NZD
  • CHF
  • SEK
  • NOK
  • DKK
  • CZK
  • HUF
  • PLN
  • RON
  • MXN
  • INR
  • BDT
  • MYR
  • SGD
  • THB
  • NGN
  • GHS
  • KES
  • ZAR