This is the API your account actually runs on. No SDK required — every endpoint is plain HTTPS and JSON, authenticated with a key you create yourself in the dashboard.
Go to Dashboard → Developers and click Create key. The key belongs to the workspace you are in and is shown once — store it as an environment variable, never in your frontend or a git repo.
Every request goes to https://paytab.co.uk/api/v1 with your key in the Authorization header as a Bearer token. Send JSON bodies with Content-Type: application/json.
Add an endpoint URL in the dashboard. We POST a signed JSON event whenever a payment succeeds or is refunded, so you can fulfil orders reliably.
Send your secret key as a Bearer token on every request. Keys starting sk_live_ never move real money; keys starting sk_live_ do.
curl https://paytab.co.uk/api/v1/account \
-H "Authorization: Bearer sk_live_..."/api/v1/accountYour account, its country, currency and which payment capabilities are live.
curl https://paytab.co.uk/api/v1/account \
-H "Authorization: Bearer sk_live_..."{
"object": "account",
"id": "acct_...",
"business_name": "Ada's Coffee",
"country": "GB",
"default_currency": "gbp",
"charges_enabled": true,
"payouts_enabled": true,
"capabilities": { "card_payments": "active" }
}/api/v1/paymentsCreate a payment. Returns a client_secret you confirm in the browser, or a completed payment when a saved method is passed.
curl https://paytab.co.uk/api/v1/payments \
-H "Authorization: Bearer sk_live_..." \
-H "Content-Type: application/json" \
-d '{
"amount": 4999,
"currency": "gbp",
"description": "Pro plan",
"metadata": { "order_id": "4102" }
}'{
"object": "payment",
"id": "pay_...",
"amount": 4999,
"currency": "gbp",
"status": "requires_payment_method",
"client_secret": "pi_..._secret_...",
"metadata": { "order_id": "4102" },
"created": "2026-01-08T10:22:41.000Z"
}/api/v1/paymentsList payments, newest first.
curl "https://paytab.co.uk/api/v1/payments?limit=10&status=succeeded" \
-H "Authorization: Bearer sk_live_..."{
"object": "list",
"data": [ { "object": "payment", "id": "pay_...", "amount": 4999 } ],
"has_more": false
}/api/v1/payments/:idRetrieve a single payment by its Paytab id.
curl https://paytab.co.uk/api/v1/payments/pay_123 \
-H "Authorization: Bearer sk_live_..."{ "object": "payment", "id": "pay_123", "status": "succeeded" }/api/v1/payments/:id/refundRefund a payment in full, or partially by passing an amount.
curl https://paytab.co.uk/api/v1/payments/pay_123/refund \
-H "Authorization: Bearer sk_live_..." \
-H "Content-Type: application/json" \
-d '{ "amount": 1500, "reason": "requested_by_customer" }'{
"object": "refund",
"id": "re_...",
"payment": "pay_123",
"amount": 1500,
"status": "succeeded"
}/api/v1/customersCreate a customer you can reuse across payments.
curl https://paytab.co.uk/api/v1/customers \
-H "Authorization: Bearer sk_live_..." \
-H "Content-Type: application/json" \
-d '{ "email": "ada@example.com", "name": "Ada Lovelace" }'{
"object": "customer",
"id": "cus_...",
"email": "ada@example.com",
"name": "Ada Lovelace"
}/api/v1/customersList customers, newest first.
curl "https://paytab.co.uk/api/v1/customers?limit=25" \
-H "Authorization: Bearer sk_live_..."{ "object": "list", "data": [ { "object": "customer", "id": "cus_..." } ] }/api/v1/customers/:idRetrieve one customer.
curl https://paytab.co.uk/api/v1/customers/cus_123 \
-H "Authorization: Bearer sk_live_..."{ "object": "customer", "id": "cus_123" }Add an HTTPS endpoint under Dashboard → Developers. Each event is POSTed as JSON with aPaytab-Signatureheader: an HMAC-SHA256 of the raw request body, keyed with your endpoint's signing secret. Always verify it before trusting the payload, and reply 2xx quickly.
{
"id": "evt_...",
"type": "payment.succeeded",
"created": "2026-01-08T10:22:41.000Z",
"data": {
"object": {
"object": "payment",
"id": "pay_...",
"amount": 4999,
"currency": "gbp",
"status": "succeeded"
}
}
}import express from "express";
import { createHmac, timingSafeEqual } from "crypto";
app.post("/webhooks/paytab",
express.raw({ type: "application/json" }),
(req, res) => {
const signature = req.headers["paytab-signature"];
const expected = createHmac("sha256", process.env.PAYTAB_WEBHOOK_SECRET)
.update(req.body)
.digest("hex");
if (!signature ||
!timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
return res.status(400).send("Invalid signature");
}
const event = JSON.parse(req.body.toString());
if (event.type === "payment.succeeded") {
// fulfil the order
}
res.json({ received: true });
});Errors return a JSON body shaped { "error": { "type", "message" } }.