API Documentation

Accept and send payments programmatically

Secure Fast Developer Friendly

🚀 Getting Started

1
Request an API Key

Create a key request from the merchant dashboard and wait for admin approval. The API Secret is shown only once when created or regenerated, so store it securely.

2
Set Permissions

Choose which endpoints your API key can access. Minimum one permission required.

3
Go Live

Test with small amounts, then scale up. Always use HTTPS.

🔐 Authentication

Both X-API-Key and X-API-Secret are REQUIRED for all protected API endpoints. Provider and merchant webhook callbacks use their own verification rules.

Required Headers:

X-API-Key: oes_your_api_key_here
X-API-Secret: sk_your_secret_here
Important: Never expose your API credentials in client-side code. Always use server-side requests.

🔑 Permissions

Each API key can have one or more permissions. The all permission grants full access.

PermissionDescriptionEndpoints
payinCreate and manage payment invoices/create-invoice, /check-status, /merchant/payins
payoutCreate and manage payout requests/payout/create, /merchant/payouts
balanceCheck balance and statistics/merchant/balance, /merchant/stats
allFull access to all endpointsAll endpoints

🌐 Base URL

https://chash.app/api

All endpoints are relative to this base URL.

📝 Create Invoice

POST /create-invoice Requires: payin

📤 Request

Required Headers:

Content-Type: application/json
X-API-Key: oes_your_api_key_here
X-API-Secret: sk_your_secret_here
{
    "amount": 100.00,
    "pay_way": "cashapp",
    "customer_email": "customer@example.com",
    "customer_name": "John Doe"
}
ParameterTypeRequiredDescription
amountnumeric✅ YesNormally Min: 1, Max: 10000. eCashApp, Apple Pay and Google Pay accept only the exact preset amounts listed below.
pay_waystring✅ Yescashapp, ecashapp, applepay, googlepay, chime, btcpay, paypal, venmo
customer_emailstring❌ NoValid customer email, maximum 255 characters
customer_namestring❌ NoCustomer name, maximum 255 characters
redirect_urlURL❌ NoHTTPS return URL after checkout, maximum 2048 characters
Restricted invoice amounts: For ecashapp, applepay, and googlepay, the amount must exactly match one of: 9.99, 14.99, 17.99, 19.99, 24.99, 29.99, 30.99, 39.99, 49.99, 59.99, 99.99, 124.99, 129.99, 149.99, or 199.99 USD. Other amounts return PAYIN_007 with HTTP 422.

Fee and net values vary according to the authenticated merchant's effective rate.

✅ Response (Auto Wallet)

{
    "success": true,
    "data": {
        "order_id": 123,
        "order_no": "API_1788264000_abc123",
        "amount": "99.99",
        "fee": "14.80",
        "net": "85.19",
        "pay_way": "applepay",
        "payment_url": "https://provider.example/checkout/xxx",
        "expires_at": "2026-09-01T12:00:00Z",
        "status": "processing"
    }
}

✅ Response (Manual Wallet)

{
    "success": true,
    "data": {
        "order_id": 124,
        "order_no": "API_1788264000_def456",
        "amount": "100.00",
        "fee": "10.30",
        "net": "89.70",
        "pay_way": "chime",
        "manual_code": "W6X-F1",
        "wallet_address": "$ExampleTag",
        "checkout_url": "https://chash.app/checkout/124",
        "expires_at": "2026-09-01T20:00:00Z",
        "status": "pending_manual"
    }
}

🔍 Check Order Status

GET /check-status/{order_id} Requires: payin

✅ Response

{
    "success": true,
    "data": {
        "order_id": 123,
        "order_no": "API_1788264000_abc123",
        "amount": "99.99",
        "real_amount": "99.99",
        "fee": "14.80",
        "net": "85.19",
        "pay_way": "applepay",
        "payment_url": "https://provider.example/checkout/xxx",
        "manual_code": null,
        "status": "success",
        "created_at": "2026-09-01T10:00:00Z",
        "success_time": "2026-09-01T10:05:00Z",
        "expires_at": "2026-09-01T12:00:00Z"
    }
}

📊 Status Values

pending processing success failed pending_manual expired

💰 Get Balance

GET /merchant/balance Requires: balance

✅ Response

{
    "success": true,
    "data": {
        "merchant_id": 123,
        "merchant_name": "My Store",
        "balance": "1500.00",
        "bonus_balance": "50.00"
    }
}

📋 Get PayIns

GET /merchant/payins Requires: payin

Query Parameters:

?limit=20&status=success

✅ Response

{
    "success": true,
    "data": {
        "total": 45,
        "payins": [
            {
                "id": 123,
                "order_no": "API_1706000000_abc123",
                "amount": "100.00",
                "fee": "11.00",
                "net": "89.00",
                "pay_way": "cashapp",
                "status": "success",
                "created_at": "2026-01-15 10:00:00"
            }
        ]
    }
}

📋 Get Payouts

GET /merchant/payouts Requires: payout

Query Parameters:

?limit=20&status=approved

✅ Response

{
    "success": true,
    "data": {
        "total": 12,
        "payouts": [
            {
                "id": 456,
                "transaction_id": "POU-123456",
                "amount": "50.00",
                "fee": "3.50",
                "pay_way": "paypal_payout",
                "recipient": "merchant@example.com",
                "status": "approved",
                "created_at": "2026-01-15 10:00:00"
            }
        ]
    }
}

📊 Get Stats

GET /merchant/stats Requires: balance

✅ Response

{
    "success": true,
    "data": {
        "balance": "1500.00",
        "bonus_balance": "50.00",
        "payin": {
            "total_count": 45,
            "total_amount": "5000.00",
            "total_success": "4500.00",
            "total_pending": "500.00",
            "total_failed": "0.00"
        },
        "payout": {
            "total_count": 12,
            "total_amount": "1200.00",
            "total_approved": "1100.00",
            "total_pending": "100.00",
            "total_failed": "0.00"
        }
    }
}

👤 Get Profile

GET /merchant/profile Requires: all

✅ Response

{
    "success": true,
    "data": {
        "id": 12,
        "name": "Example Merchant",
        "email": "merchant@example.com",
        "status": "active"
    }
}

📤 Create Payout (API)

POST /payout/create Requires: payout
The Idempotency-Key header is required. Reuse the same key only when retrying the exact same payout request; use a new key for every new payout.

📤 Headers

X-API-Key: oes_your_api_key
X-API-Secret: sk_your_secret
Idempotency-Key: unique_request_id_123

📤 Request Body

{
    "amount": 50.00,
    "pay_way": "paypal_payout",
    "account_info": "merchant@example.com"
}
ParameterTypeRequiredDescription
amountnumeric✅ YesMin: 10, Max: 5000
pay_waystring✅ Yescashapp_payout, paypal_payout, ach_payout, card_payout, chime_payout
account_infostring✅ YesEmail, tag, or handle

✅ Response (201 Created)

{
    "success": true,
    "data": {
        "payout_id": 456,
        "transaction_id": "POU-20260901-A1B2C3D4E5F6-1788264000",
        "amount": "50.00",
        "fee": "3.50",
        "total_deducted": "53.50",
        "pay_way": "paypal_payout",
        "recipient": "merchant@example.com",
        "status": "pending",
        "created_at": "2026-09-01 10:00:00"
    }
}

🔄 Merchant Webhooks

Coming Soon: Outgoing merchant webhooks are not enabled yet. Until they are enabled, use the status endpoints to check payment and payout updates.

This section describes the planned OESPay-to-merchant callback format. It is separate from provider callbacks received by OESPay from BTCPay Server or other payout providers.

📤 Planned Request Headers

Content-Type: application/json
X-OESPay-Event-Id: evt_01JABCDEF123456789
X-OESPay-Timestamp: 1788264000
X-OESPay-Signature: sha256=generated_hmac_signature

📦 Planned Payout Event

{
    "event_id": "evt_01JABCDEF123456789",
    "event": "payout.approved",
    "created_at": "2026-09-01T10:00:00Z",
    "data": {
        "payout_id": 456,
        "transaction_id": "POU-20260901-A1B2C3D4E5F6-1788264000",
        "amount": "50.00",
        "fee": "3.50",
        "total_deducted": "53.50",
        "pay_way": "paypal_payout",
        "status": "approved"
    }
}

Planned verification: Calculate HMAC-SHA256 over timestamp.raw_request_body using a separate webhook signing secret, then compare it with X-OESPay-Signature using a timing-safe comparison.

Acknowledgement: Return any HTTP 2xx response after safely recording the event.

Duplicate protection: Store X-OESPay-Event-Id and ignore an event that has already been processed.

Retry policy: The production retry schedule will be published when outgoing webhooks are enabled.

💳 Supported Wallets

PayIn

cashapp ecashapp applepay googlepay chime btcpay paypal venmo

Payout

cashapp_payout paypal_payout ach_payout card_payout chime_payout

⚠️ Error Codes

CodeHTTP StatusMessage
AUTH_001401API key required
AUTH_002401Invalid API credentials
AUTH_003401API key is inactive or expired
AUTH_004401Invalid API credentials
AUTH_005403Request IP is not allowed
AUTH_006403Permission denied for this endpoint
AUTH_007401API secret required
AUTH_008403Merchant account is inactive
AUTH_009403API permission configuration missing
AUTH_010401Merchant not authenticated
PAYIN_001422Payment method is unavailable
PAYIN_002422Calculated fee exceeds the invoice amount
PAYIN_003502Upstream payment provider could not create the invoice
PAYIN_004422Unsupported payment method
PAYIN_005404Order not found for the authenticated merchant
PAYIN_006503No active manual wallet is available
PAYIN_007422Invalid restricted amount; response includes allowed_amounts
PAYOUT_002500Temporary payout processing error. Please retry safely with the same Idempotency-Key.
PAYOUT_003400Payment method not available for payout
PAYOUT_004422Valid Idempotency-Key header is required
PAYOUT_005409Idempotency key was already used with different payout data
PAYOUT_006422Insufficient balance or merchant inactive
RATE_001429Rate limit exceeded (5000/min)
500500Internal server error

⏱️ Rate Limit

5000 requests per minute per API key.

If you exceed this limit, you will receive a 429 Too Many Requests response.

Rate Limit Headers:

X-RateLimit-Limit: 5000
X-RateLimit-Remaining: 4999
X-RateLimit-Reset: 1706000000

Need Help?

Contact our support team for integration assistance.

Get API Keys →