Build thecheckout.

01Getting started

1. 1. Open an account. Apply through our contact page. Once your business is reviewed, you receive test and live keys.
2. 2. Work in test mode. Test keys create payments that never move money, with test cards for each state.
3. 3. Create a payment. Your server creates a payment and redirects the buyer to the returned checkout URL.
4. 4. Listen for webhooks. Fulfil the order when you receive payment.captured, not when the buyer comes back to your site.

const res = await fetch(`${process.env.SORRELT_API_BASE}/v1/payments`, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.SORRELT_SECRET_KEY}`,
    "Content-Type": "application/json",
    "Idempotency-Key": order.id,
  },
  body: JSON.stringify({
    amount: 7900,            // minor units: €79.00
    currency: "eur",
    reference: order.id,
    customer: { email: order.email },
    return_url: "https://shop.example/thanks",
  }),
});

const payment = await res.json();
// payment.state === "ordered"
redirect(payment.checkout_url);

02API reference

All requests are authenticated with your secret key as a bearer token and sent over HTTPS. Amounts are integers in the currency’s minor unit. Every payment carries a state: ordered, screened, captured, paid_out, or failed / refunded.

03Libraries

4 SDKs — JavaScript, Python, PHP, Ruby — wrap the API, and it also works with any HTTP client. Access to the SDKs is given with your keys when your account is approved. With plugins for e-commerce platforms such as Shopify, WooCommerce, PrestaShop or Magento, 25+ integrations are available; our team shares the connection steps for your store during onboarding.

04Guides

05Webhooks

Register an HTTPS endpoint in your dashboard. Each event is signed with your webhook secret in the Sorrelt-Signature header; verify it before trusting the body. Events are retried if your endpoint does not answer with a 2xx status, so handle them idempotently.

import crypto from "node:crypto";

export function verify(rawBody, header, secret) {
  const [ts, sig] = header.split(",").map((p) => p.split("=")[1]);
  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${ts}.${rawBody}`)
    .digest("hex");
  return crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected));
}

// event.type: payment.screened | payment.captured | payment.failed
//             payout.paid | dispute.opened | dispute.closed

06Best practices

• Keep secret keys on your server only. Never ship them in a browser or app bundle.
• Send an Idempotency-Key with every create request, so a retry never charges twice.
• Fulfil orders from webhooks, not from the buyer’s return to your site.
• Store the payment id against your order to reconcile payouts line by line.
• Show prices in the buyer’s currency on your product pages too, not only at checkout.
• Keep proof of delivery: it is your strongest evidence if a payment is disputed.