Introduction

The FlexPay API lets your server create checkout sessions, redirect customers to a hosted FlexPay Checkout, and receive webhook events when payments complete. You integrate only with FlexPay.

Access to the API is available to approved merchants. Use FlexPay Checkout for the fastest setup, or build directly on the API.

Quickstart

The intended integration flow:

1. 01Merchant server
2. 02Create a FlexPay Checkout Session
3. 03Receive the checkout URL
4. 04Redirect the customer
5. 05Wait for the payment.succeeded webhook
6. 06Fulfill the order

Always fulfill orders from the webhook, not from the customer returning to your success_url.

Authentication

Requests are authenticated with a secret API key sent as a bearer token in the Authorization header. Secret keys must only be used from your server — never in browser or mobile code.

Checkout Sessions

Create a session for each order. Amounts are in the smallest currency unit (for USD, cents).

POST /v1/checkout/sessions
Authorization: Bearer <secret_key>
Content-Type: application/json

{
  "amount": 14900,
  "currency": "USD",
  "order_id": "ORDER-8291",
  "customer_email": "john@example.com",
  "description": "Premium package",
  "success_url": "https://merchant.com/success",
  "cancel_url": "https://merchant.com/cart",
  "metadata": {
    "product_id": "premium",
    "discord_id": "123456"
  }
}

{
  "id": "cs_nx_...",
  "checkout_url": "https://checkout.example/c/..."
}

Redirect the customer to checkout_url. After payment they return to your success_url; if they abandon checkout they return to cancel_url.

Webhooks

FlexPay sends signed events to an HTTPS endpoint you configure. Verify the signature before trusting an event, and respond with a 2xx status once processed.

{
  "type": "payment.succeeded",
  "data": {
    "checkout_session": "cs_nx_...",
    "order_id": "ORDER-8291",
    "amount": 14900,
    "currency": "USD"
  }
}

API Keys

Approved merchants will be able to create and revoke API keys from the FlexPay dashboard. Keep secret keys out of source control and rotate them if exposed.