Base URL
All API requests go to a single base path on your OwnPay instance:Replace
your-domain.com with your actual OwnPay domain. All endpoints require HTTPS.Authentication
Every request must include a Bearer token in theAuthorization header. See the full Authentication guide for how to generate, scope, and rotate your API keys.
Three API layers
OwnPay exposes three distinct API layers, each serving a different audience and backed by its own OpenAPI specification.Merchant API
Business operations for your application: create payments, list transactions, manage payment links, and handle refunds. This is the API you will use most often.View Merchant API specMobile API
Used exclusively by the OwnPay Android companion app. Handles SMS verification, device pairing, and push-based transaction approvals.View Mobile API specAdmin API
Platform management operations: manage brands, configure gateways, control users, and administer the system. Requires elevated permissions.View Admin API specRequest and response format
All requests and responses use JSON with UTF-8 encoding.Conventions
Error handling
Every error response follows a consistent JSON structure. See the full Error codes reference for all status codes, error codes, and troubleshooting steps.Idempotency
For write endpoints (POST, PATCH, DELETE), you can include an Idempotency-Key header to prevent duplicate processing:
Rate limiting
All API endpoints enforce rate limits. OwnPay returns standard rate-limit headers on every response:Quick links
Create a payment
Jump to the Merchant API spec and find the POST /payments endpoint.
Verify a webhook
Canonical webhook signature verification with code examples in PHP, Node.js, and Python.
SDKs
Official SDKs for PHP, Laravel, and Node.js to speed up your integration.