Kutanapay Merchant API
    • Getting Started
    • Authentication
    • Use the API in your application
    • Webhooks
      • Webhooks Events
    • Merchant Checkout
      • Create checkout
        POST
      • List checkouts
        GET
      • Get checkout
        GET
      • Cancel checkout
        POST
      • Create checkout button embed session
        POST
    • Webhook Events
      • Checkout created
      • Checkout paid
      • Customer says they paid
      • Checkout approved
      • Checkout rejected
      • Checkout failed
      • Checkout timed out
      • Checkout expired
      • Checkout refunded
      • A second collection arrived
      • Test event
    • Schemas
      • RequestBodies
        • CheckoutEvent
      • DetailError
      • WebhookEnvelope
      • CheckoutEventData

    Authentication

    Every Checkout API request uses API key authentication. Your application (server, worker, or backend service) sends the key on each HTTP call to create checkouts, cancel them, or read payment status.

    Header#

    Send this header on all documented endpoints. Missing or invalid keys return 401.

    Where keys come from#

    Create and revoke keys in the merchant platform, not via this public API reference.
    Your first key is often issued during merchant onboarding.
    Use separate keys for staging and production when possible.
    Store keys in secrets management (environment variables, vault). Never commit keys to git or expose them in client-side code.

    Apidog setup#

    1.
    Environment variables: apiKey = your sandbox or production key.
    2.
    Auth: Type API Key, name x-api-key, add to Header.
    3.
    Try it: Run Create checkout with the environment selected.

    Security#

    Only call the Checkout API from your server.
    Do not embed x-api-key in mobile apps, browser JavaScript, or public repos.
    Rotate keys in the platform if a key is exposed.
    Modified at 2026-09-26 20:22:12
    Previous
    Getting Started
    Next
    Use the API in your application
    Built with