Take your first payment

1. Get your API keys

Sign up for a free Paytab account. Your test keys are in the dashboard under Developers → API keys. Test keys start with sk_test_ — live keys, once you finish KYC, start with sk_live_.

• Never expose your secret key in client-side code.
• Rotate keys any time from the dashboard — old keys keep working for 24 hours to allow rollout.
• Scope keys per environment: separate keys for staging, CI and production.

2. Install the SDK

Use the official Node.js SDK. Every other language works the same way.

npm install paytab

3. Create your first payment

This creates a hosted checkout session and returns a URL to redirect the customer to. Once they pay, they're redirected back to your success_url.

import Paytab from 'paytab';
const paytab = new Paytab(process.env.PAYTAB_SECRET_KEY);

const session = await paytab.checkout.sessions.create({
  line_items: [{ price_data: {
    currency: 'gbp',
    product_data: { name: 'Pro plan – monthly' },
    unit_amount: 4900,
  }, quantity: 1 }],
  mode: 'payment',
  success_url: 'https://example.com/thanks',
  cancel_url:  'https://example.com/cart',
});

// Redirect the browser to session.url

4. Handle the webhook

Rely on webhooks — never the browser redirect — to fulfil the order. Verify the signature to prove the request came from Paytab.

import express from 'express';
const app = express();

app.post('/webhook',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const event = paytab.webhooks.constructEvent(
      req.body,
      req.headers['paytab-signature'],
      process.env.PAYTAB_WEBHOOK_SECRET,
    );

    if (event.type === 'checkout.session.completed') {
      fulfilOrder(event.data.object);
    }

    res.sendStatus(200);
  });

5. Test with a real card number

Use these test card numbers in test mode. Every scenario — success, decline, SCA challenge, refund — has a dedicated card.

• 4242 4242 4242 4242 — succeeds without authentication
• 4000 0025 0000 3155 — requires 3D Secure 2 authentication
• 4000 0000 0000 9995 — always declines with 'insufficient funds'
• Any future expiry, any 3-digit CVC, any UK postcode

6. Go live

Complete KYC in the dashboard (upload one ID document and one proof of address). Once approved, swap your test keys for live keys and start settling real money into your bank.