A clean REST interface, signed requests and signed webhooks — the same for sandbox and production. Card, wallet, iDEAL and Sentoo, settled locally in USD, ANG and EUR.
From a two-line payment link to a full API integration — card data never touches your servers.
Create a session and redirect. We handle the payment page, 3-D Secure and PCI scope.
POST /v1/checkout-sessions
Generate a shareable link or QR with an amount, expiry and usage cap — send via WhatsApp or e-mail.
POST /v1/payment-links
Tap-to-Pay on iPhone/Android and PAX/Ingenico terminals through one session endpoint.
POST /v1/pos-sessions
Tokenize cards with setup intents and charge later for subscriptions and no-shows.
POST /v1/setup-intents
Drop-in modules for WooCommerce, Shopify, Magento, PrestaShop, Wix and BigCommerce.
Connect your PMS or booking platform for pre-auths, deposit holds and check-in links.
Create a checkout session server-side, then redirect the customer to the returned URL.
// create a hosted checkout session const res = await cariopay.post("/v1/checkout-sessions", { amount: 12500, // $125.00, in cents currency: "USD", reference: "BON-10241", methods: ["card","ideal","sentoo","applepay"], success_url: "https://shop.example/thanks", cancel_url: "https://shop.example/cart" }); // redirect the customer redirect(res.url);
{
"id": "cs_test_8Kd93h2...",
"status": "open",
"url": "https://pay.cariopay.com/c/8Kd93h2",
"amount": 12500,
"currency": "USD",
"expires_at": "2026-09-22T18:00:00Z"
}Every request is signed with HMAC-SHA256. No card data reaches your servers, keeping you out of PCI scope.
import crypto from "crypto"; function sign(keyId, secret, body) { const ts = Date.now(); const nonce = crypto.randomUUID(); const base = [keyId, ts, nonce, body].join("."); const sig = crypto.createHmac("sha256", secret) .update(base).digest("hex"); return { ts, nonce, sig }; }
Signed, retried event deliveries keep your systems in sync — verify the signature header before you trust a payload.
| Event | Fires when |
|---|---|
| payment.succeeded | A payment is authorized & captured |
| payment.failed | A payment is declined or errors |
| checkout.completed | A hosted session finishes successfully |
| checkout.expired | A session expires unpaid |
| refund.succeeded | A refund is processed |
Use these in the sandbox with any future expiry and any CVC. No real money moves.
| Card number | Brand | Result |
|---|---|---|
| 4111 1111 1111 1111 | Visa | Approved |
| 5555 5555 5555 4444 | Mastercard | Approved |
| 4000 0000 0000 0002 | Visa | Declined |
| 4000 0000 0000 3220 | Visa | 3-D Secure |
Tell us what you’re building and we’ll issue test keys and the signing helpers. Same-day testing is typical.