Authentication
Every request carries the API key issued for your app, sent as a bearer credential:
Authorization: Bearer YOUR_API_KEY
API keys are scoped to a single app, and the app is identified separately in the path (/api/apps/{appId}/…). A key for your sandbox app cannot touch live data, and vice versa.
Rules
- Server-side only. The key authorises payment operations — never ship it to a browser, a mobile app or a public repository.
- Rotate on exposure. Create a replacement key in the Console and delete the old one; it stops working immediately.
- One key per integration. Separate keys make it possible to revoke a single store or service without taking the rest down.
- Team access is role-based. Console users have roles and permissions; API keys act with the permissions granted to them.
Missing or invalid credentials return 401 Unauthorized; a valid key without permission for that app returns 403 Forbidden.
Environments
Sandbox and live are fully isolated: separate apps, separate credentials, separate provider configuration, and no crossover of data between them.
Base URLs
| Service | Base URL | What it is for |
|---|---|---|
| Payment API | https://api.paymenthood.com |
Payments and customers — everything in this reference |
| App API | https://appapi.paymenthood.com |
App settings, webhook signing secret, provider profiles, fraud policies |
| Console | https://console.paymenthood.com |
The dashboard: credentials, providers, payments, webhook logs |
Both APIs publish an OpenAPI document and a browsable UI at /swagger/index.html — for example api.paymenthood.com/swagger (opens in new tab). The spec is the authoritative contract; this page documents the endpoints you need day to day.
Sandbox behaviour
- Use your provider's own test credentials and test cards — no live money moves.
- Undelivered sandbox webhooks are abandoned after one hour; live webhooks keep retrying.
- A sandbox webhook URL must still be reachable from the internet. On a local machine use a tunnel such as Cloudflare Tunnel or ngrok —
localhostcan never receive a webhook.
Supported currencies
A payment is created in one of these currencies; which ones you can actually charge depends on the provider profiles configured for your app.
- USD
- EUR
- GBP
- AED
- SAR
- QAR
- AUD
- CAD
- NZD
- CHF
- SEK
- NOK
- DKK
- CZK
- HUF
- PLN
- RON
- MXN
- INR
- BDT
- MYR
- SGD
- THB
- NGN
- GHS
- KES
- ZAR