Quickstart

Complete your first sandbox checkout in minutes. This guide covers credentials, hash computation, session creation, and the redirect flow so you have a working end-to-end payment by the last step.

Get the Postman collection

Use the pre-built Postman collection to test Checkout API requests without writing code.

1. Install Postman

Download and install Postman for your platform if you do not already have it.

2. Import the collection

Download the collection file below, then import it in Postman: File > Import > Upload Files and select the downloaded .json file.

Postman collection →

3. Configure environment variables

After importing, create a Postman environment (Environments > Create Environment) and set the following variables. These names match the Postman collection exactly — enter them as shown, they are case-sensitive.

Variable	Value	Where to find it
CHECKOUT_HOST	Your sandbox base URL	Provided by your account manager
merchant_key	Your merchant key	Admin panel > Merchants > your merchant > Test key
merch1_pass_post	Your merchant password	Admin panel > Merchants > your merchant > Password

merch1_pass_post is the name the Postman collection uses for the merchant password. It maps to the password credential in your admin panel.

Select the environment from the dropdown in the top-right corner of Postman before sending requests.

4. Send a test request

Open the Authentication request in the collection, verify the variables are populated, and click Send. A successful response contains a redirect_url that points to the hosted checkout page. Open that URL in a browser to verify the session was created.

tip

If the request fails, open View > Show Postman Console to inspect the raw request and response. Common issues include a missing or mistyped CHECKOUT_HOST, merchant_key, or merch1_pass_post in your Postman environment, or an expired session.

Get your sandbox credentials

You need three values to call the Checkout API. Obtain them once from the admin panel (or ask your account manager):

Variable	Where to find it	Example
CHECKOUT_URL	should be provided by the system admin	https://BASE_URL.example.com
merchant_key	Admin panel → Merchants → your merchant → Test key	27106696-656c-...-7e11ae873370
password	Admin panel → Merchants → your merchant → Password	2fc46f1f...bd45th

warning

The password is used only to compute hashes locally. Never send it in a request body or store it in the browser.

Go to Authentication and credentials for more information.

Authentication and credentials →

Compute the hash

The Checkout API authenticates each request with a hash field calculated as SHA1(MD5(uppercase(concat_of_fields))).

For Authentication, the input is equal to order.number + order.amount + order.currency + order.description + password.

Node.js (no dependencies):

const crypto = require("crypto");
const md5  = s => crypto.createHash("md5").update(s).digest("hex");
const sha1 = s => crypto.createHash("sha1").update(s).digest("hex");

const password = process.env.CHECKOUT_PASSWORD;
const order = { number: "order-1234", amount: "0.19", currency: "USD", description: "Important gift" };

const hash = sha1(md5(
  (order.number + order.amount + order.currency + order.description + password).toUpperCase()
));

Python:

import hashlib, os

password = os.environ["CHECKOUT_PASSWORD"]
order = {"number": "order-1234", "amount": "0.19", "currency": "USD", "description": "Important gift"}

raw = (order["number"] + order["amount"] + order["currency"] + order["description"] + password).upper()
hash_value = hashlib.sha1(hashlib.md5(raw.encode()).hexdigest().encode()).hexdigest()

PHP:

$raw  = strtoupper($order["number"] . $order["amount"] . $order["currency"] . $order["description"] . $password);
$hash = sha1(md5($raw));

Go to Hash signature for more information.

Hash signature →

Create a payment session

curl -X POST "$CHECKOUT_URL/api/v1/session" \
  -H "Content-Type: application/json" \
  -d '{
    "merchant_key": "'"$MERCHANT_KEY"'",
    "operation": "purchase",
    "order": {
      "number": "order-1234",
      "amount": "0.19",
      "currency": "USD",
      "description": "Important gift"
    },
    "success_url": "https://example.com/success",
    "cancel_url":  "https://example.com/cancel",
    "hash": "'"$HASH"'"
  }'

Response:

{
  "redirect_url": "https://checkout-sandbox.example.com/p/abc123",
  "redirect_method": "GET"
}

Redirect the customer

Send the customer to redirect_url. They enter card data, authenticate (if required), and are redirected back to your success_url or cancel_url.

For sandbox testing use the following test card information:

Variable	Information
Number	4111 1111 1111 1111
Expiry	01/38
CVV	any CVV

Go to Testing and Sandbox for more scenarios.

Testing and Sandbox →

Receive the callback

Payment Platform sends an HTTP POST to your notification_url on every transaction state change. Use status and type together to determine finality — see Callbacks for the full decision table. Body is application/x-www-form-urlencoded.

You can configure notification_url in two ways:

• Per-request: include it in the authentication request body — that value takes priority for that session. It must be a valid, reachable URL or session creation returns HTTP 400.
• Admin panel default: pass your sandbox and production URLs to your account manager to configure a fallback; it applies when no notification_url is in the request.

warning

A callback with status=success does not always mean the payment is final. You must check both status AND type.

Go to Callbacks for more information.

Callbacks →

Support

info

For additional support, contact your account manager.