Quickstart

Sign up — during the private preview, workspace access is provisioned through the design-partner program; the sandbox is available immediately once you're in, no activation required. In Developers → API keys, create a secret key. It starts with apx_sk_test_ and is shown exactly once.

Amounts are strings of integer base units ("4900" = €49.00) — never floats. Send an Idempotency-Key header on every create so a retried request can never double-charge.

curl https://api.apxrails.com/v1/checkout/sessions \
  -H "Authorization: Bearer apx_sk_test_…" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: order-1042" \
  -d '{
    "amount": "4900",
    "currency": "EUR",
    "country": "NO",
    "success_url": "https://store.example/thanks",
    "line_items": [{ "name": "Sticker pack", "quantity": 1, "amount": "4900" }]
  }'

{
  "id": "cs_01J…",
  "object": "checkout.session",
  "state": "open",
  "url": "https://pay.apxrails.com/c/cs_01J…?t=…",
  "amount": "4900",
  "currency": "EUR",
  "expires_at": 1783539464
}

Send the buyer to url. Treat it like a secret link — it carries the session's one-time token. On the hosted page, pay with the magic test card 4242 4242 4242 4242. Other magic values: …0002 declines, …3220 triggers 3DS, an amount ending 66 fails asynchronously, and an amount ending 77 creates a dispute after capture.

In Developers → Webhooks, add your endpoint and subscribe to checkout.session.completed. The webhook is a nudge — re-query the session before fulfilling; the API is the truth.

import { verifyWebhookSignature } from '@apxrails/sdk-node';

app.post('/webhooks/apxrails', express.raw({ type: '*/*' }), (req, res) => {
  const ok = verifyWebhookSignature({
    payload: req.body,                     // RAW bytes, never re-serialized JSON
    header: req.headers['apx-signature'],
    secret: process.env.APX_WEBHOOK_SECRET, // whsec_… from the endpoint create
  });
  if (!ok) return res.status(401).end();

  const event = JSON.parse(req.body.toString('utf8'));
  if (event.type === 'checkout.session.completed') {
    // Re-query, then fulfill.
  }
  res.status(200).end();
});

Full signature details (including the PHP verifier) are on the webhooks page.

During the private preview, live activation runs through the design-partner program. Live keys mint after activation: Settings → Activate live payments in the dashboard (company details, payout destination, expected volume). Review is manual and usually done within one business day. Test and live data never mix — the key prefix picks the mode.

Payment Links — a checkout URL with no code at all · Embedded checkout — the two-line overlay · API reference — every endpoint, generated from the OpenAPI spec.