Payment Intents API

The API base URL is https://checkout.securepayapi.com. All requests use HTTPS.

Endpoints overview

Integrating with SecurePayAPI involves one server-side API call plus two browser-facing URLs:

The full flow:

your server ──POST /api/v1/payment-intents──▶ { client_secret }
     │
     └─ pass client_secret to the browser
                              │
   browser ──GET /embed──▶ widget ──postMessage(client_secret)──▶ { success }

The /embed widget talks to its own internal endpoints to encrypt the card and run 3-D Secure — you don't call those directly. You only ever call POST /api/v1/payment-intents from your backend and listen for the widget's result messages.

Authentication

Authenticate server-to-server calls with your secret key as a Bearer token:

Authorization: Bearer sp_secret_…

Never call the API from the browser — the secret key must stay on your server.

Create a Payment Intent

POST /api/v1/payment-intents

Request body

Example

curl https://checkout.securepayapi.com/api/v1/payment-intents \
  -H "Authorization: Bearer sp_secret_…" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 2000,
    "currency": "USD",
    "reference": "order_123",
    "description": "Pro plan — annual",
    "metadata": { "plan": "pro" }
  }'

Response 200

{
  "id": "abcdef0123456789abcdef01",
  "client_secret": "pi_abcdef0123456789abcdef01_secret_…",
  "amount": 2000,
  "currency": "USD",
  "status": "requires_payment"
}

Pass client_secret to the embedded checkout widget to collect payment. See Payment Intents for statuses and the client-secret lifecycle.

Errors

Errors return a non-2xx status and a JSON body:

{
  "error": {
    "type": "invalid_request",
    "code": "...",
    "message": "..."
  }
}