- Is there an API?Yes, a REST API with live and staging keys, a hosted checkout, signed webhooks, API logs and a PHP SDK.
- How do I test my integration?Use staging mode with a sk_test_ key and the simulator or your provider's test credentials. Simulate both success and failure.
- Should I fulfil orders on the return page?No. Use the signed webhook (or check the order status from your server). The return page can be closed or skipped by the customer.
- What if my webhook endpoint is down?Deliveries are retried automatically with increasing gaps, and you can retry any delivery from Developers › Webhooks.
- How do I verify a webhook?Compute an HMAC-SHA256 of timestamp.body with your signing secret and compare it with the signature header in constant time.
- Can I send the same order twice?Sending the same order_id and amount again returns the existing order, so retries are safe. A different amount with the same order_id is refused.
- Are there rate limits?Yes, a limit of requests per minute per API key set by the platform. Slow down and retry when you receive 429.
- Can I restrict an API key to my server?Yes, when your package includes the IP whitelist you can limit keys to your server's IP addresses.