For developers
One request, one payment link
A simple REST API with API keys, signed webhooks for every status change and a separate test environment to try things without real money.
Quick start
Create a payment
Grab your site’s API key from the panel and create a payment with a single POST request. Send the buyer to payment_url — the checkout page handles the rest.
Send the key in the
X-API-Key or Authorization: Bearer header.
With redirect_url the buyer returns to your store after paying.
Check the status any time with GET /payments/{id}/status.
curl -X POST https://account.paymenting.io/api/v1/payments \ -H "X-API-Key: sk_test_••••" \ -H "Content-Type: application/json" \ -d '{ "amount": 100, "currency": "USD", "order_id": "48213", "callback_url": "https://shop.ir/hook", "redirect_url": "https://shop.ir/thanks" }' // response { "payment_url": "https://account.paymenting.io/pay/9b2e41c7", "status": "awaiting", "expires_at": "…" }
Webhooks
Get notified when a payment is confirmed
When a payment is confirmed, a POST request is sent to callback_url. Compare the X-Gateway-Signature header with an HMAC-SHA256 of the raw request body using your site’s secret key.
The signature is computed over the raw body bytes; don’t re-encode the JSON before verifying.
Acknowledge with a 2xx response; otherwise delivery is retried.
Use
order_id to find the order and process it only once.
$body = file_get_contents('php://input'); $expected = hash_hmac('sha256', $body, API_SECRET); $signature = $_SERVER['HTTP_X_GATEWAY_SIGNATURE'] ?? ''; if (!hash_equals($expected, $signature)) { http_response_code(401); exit; } $event = json_decode($body, true); // $event['event'] → "payment.completed" // $event['order_id'] → your order ID markOrderPaid($event['order_id']); http_response_code(200);
Test environment
Test everything before real money moves
With a test key, payments are created on the test network (Testnet). See the full flow — checkout page, network confirmations and webhook — without moving real money.
Separate test and live keys
Same API, same webhooks
Restrict keys to your server IPs
Technical questions
Do you have a WooCommerce plugin?
Yes. Download the plugin from the panel, enter your API key and the gateway appears on your store’s checkout page.
How does the test environment work?
In the test environment (Testnet) payments run on a test network and no real money moves. Once everything works, switch to your live API key.
How do I verify webhooks?
Every webhook carries an HMAC signature. Recompute it with your site’s secret key and compare; reject any request without a valid signature.