Integrate CanPay checkout with a merchant website

Core flow

1. Obtain merchant credentials for the intended environment.
2. From your server, call the documented v1 initiate-payment endpoint with a unique merchant reference, amount, customer details and return or notification information required by the current API docs.
3. Redirect the customer to the signed or hosted checkout URL returned by CanPay.
4. Treat a browser return as navigation, not proof of payment.
5. Verify the transaction using the verify-payment endpoint and the CanPay transaction reference before fulfilment.

Security rules

• Never place secret credentials in browser JavaScript, a mobile bundle, source control or public screenshots.
• Use HTTPS and generate a unique reference for each attempt.
• Make fulfilment idempotent so repeated callbacks cannot create duplicate orders.
• Validate the environment and current webhook-signature guidance in the live API documentation.

Use the live documentation

The merchant API documentation is available from the pay.canpaybnpl.com documentation area and is the source of truth for headers, parameters, response fields and current sandbox behaviour. Some bundled example pages may be older than the running endpoints, so test in sandbox and confirm with integration support before launch.