Take your first payment

1. Get your API keys

Sign up for a free Paytab account. Your secret key lives under Dashboard → Developers → API keys and starts with sk_live_. It is scoped to one workspace and shown only once.

• Never expose your secret key in client-side code.
• Rotate keys any time from the dashboard — old keys keep working for 24 hours to allow rollout.
• Scope keys per environment: separate keys for staging, CI and production.

2. Install the SDK

Use the official Node.js SDK. Every other language works the same way.

npm install paytab

3. Create your first payment

This creates a hosted checkout session and returns a URL to redirect the customer to. Once they pay, they're redirected back to your success_url.

import Paytab from 'paytab';
const paytab = new Paytab(process.env.PAYTAB_SECRET_KEY);

const session = await paytab.checkout.sessions.create({
  line_items: [{ price_data: {
    currency: 'gbp',
    product_data: { name: 'Pro plan – monthly' },
    unit_amount: 4900,
  }, quantity: 1 }],
  mode: 'payment',
  success_url: 'https://example.com/thanks',
  cancel_url:  'https://example.com/cart',
});

// Redirect the browser to session.url

4. Handle the webhook

Rely on webhooks — never the browser redirect — to fulfil the order. Verify the signature to prove the request came from Paytab.

import express from 'express';
const app = express();

app.post('/webhook',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const event = paytab.webhooks.constructEvent(
      req.body,
      req.headers['paytab-signature'],
      process.env.PAYTAB_WEBHOOK_SECRET,
    );

    if (event.type === 'checkout.session.completed') {
      fulfilOrder(event.data.object);
    }

    res.sendStatus(200);
  });

5. Test with a real card number

Use these card numbers while your account is still in review. Every scenario — success, decline, SCA challenge, refund — has a dedicated card.

• 4242 4242 4242 4242 — succeeds without authentication
• 4000 0025 0000 3155 — requires 3D Secure 2 authentication
• 4000 0000 0000 9995 — always declines with 'insufficient funds'
• Any future expiry, any 3-digit CVC, any UK postcode

6. Go live

Complete verification in the dashboard (upload one ID document and one proof of address). Once approved, charges and payouts switch on and money settles into your bank.