Create Payment Intent
POST/payment_intents
Approve a charge from your backend before any card is collected.
The intent locks the amount, currency, description and callback_url, and
returns a client_secret that your frontend uses to fulfill it. A new intent is
always created and expires one hour after creation.
This endpoint accepts the secret key only — that is what makes the intent an authorization your backend granted, rather than something the browser can mint on its own.
Request
- application/json
Body
required
- 1.00 SAR = 100
- 1.00 KWD = 1000
- 1 JPY = 1
Possible values: >= 100
A positive integer representing the payment amount in the smallest currency unit.
Examples:
Default value: SAR
ISO-4217 three-letter currency code.
Possible values: <= 8000 characters
Human readable description for the payment. This is shown to the merchant only and is not shown to the payer.
A valid URL that is used to return the payer back to the merchant website after the payment is done.
This field is required when the intent is fulfilled with a creditcard or
token source.
Responses
- 201
- 400
- 401
- 403
Successful operation
- application/json
- Schema
- Example (from schema)
Schema
- 1.00 SAR = 100
- 1.00 KWD = 1000
- 1 JPY = 1
created— awaiting fulfillment. Fulfillable untilexpires_atpasses.fulfilled— the intent was used to create a payment. Whether that payment was approved or declined is tracked on the payment, not here.canceled— canceled before use; theclient_secretno longer works.
Unique identifier of the payment intent.
Possible values: >= 100
A positive integer representing the payment amount in the smallest currency unit.
Examples:
ISO-4217 three-letter currency code.
Possible values: [created, fulfilled, canceled]
The intent's own lifecycle, not the payment's outcome.
Expiry is not a status. An intent past its expires_at stays created but can no
longer be fulfilled or canceled.
Possible values: Value must match regular expression ^pi_secret_
Single-use token that authorizes fulfillment of this intent. Pass it to your frontend and treat it as a credential — it is all a browser needs, alongside your publishable key, to create this one payment.
Fulfillment deadline. Set automatically to one hour after creation.
Date and time when the intent was fulfilled. null until then.
{
"id": "8f4d1c3e-6a52-4f0b-9a1e-2c7b5d8e0f31",
"amount": 100,
"currency": "SAR",
"description": "Order",
"callback_url": "https://example.com/checkout/payer-return",
"status": "created",
"client_secret": "pi_secret_7Kq2mXbN9vT4wPzR1sYcHdLjF6aGuE8oQ3iK5nB0xVtZrWyM",
"expires_at": "2024-07-29T15:51:28.071Z",
"fulfilled_at": "2024-07-29T15:51:28.071Z",
"created_at": "2024-07-29T15:51:28.071Z"
}
Business Error or validation error.
- application/json
- Schema
- Example (from schema)
Schema
Contains the error type
Human readable error message for the error
Contains string-array pair representing a field and list of validation errors.
{
"type": "invalid_request",
"message": null,
"errors": {
"foo": "this is returned for validation errors only"
}
}
Invalid authorization credentials
- application/json
- Schema
- Example (from schema)
Schema
Possible values: [authentication_error]
Possible values: [Invalid authorization credentials]
{
"type": "authentication_error",
"message": "Invalid authorization credentials",
"errors": null
}
The request was not authenticated with the secret key.
- application/json
- Schema
- Example (from schema)
Schema
Possible values: [api_error]
Possible values: [User not authorized]
{
"type": "api_error",
"message": "User not authorized",
"errors": null
}