1 Create Order
All Create Order endpoints accept a POST request with Content-Type: application/json. The tables below describe the JSON fields in the request body.
1.1 Create Credit Card Order (Direct)
POST https://api.stripay.io/v1/direct/pay
Request body:
1.2 Create Credit Card Order (Inline)
POST https://api.stripay.io/v1/inline/pay
Request body:
Trigger submit payment
iframeElement.contentWindow.postMessage({ action: 'pay' })
Listen iframe events
window.addEventListener('message', (e) => {
if (e.data.sender === 'stripay') {
if (e.data.action === 'pay_success') {
location.href = e.data.value // successUrl
} else if (e.data.action === 'pay_fail') {
errorElement.innerHTML = e.data.value // error message
} else if (e.data.action === 'pay_3ds') {
location.href = e.data.value // 3ds url
} else if (e.data.action === 'pay_validate_error') {
errorElement.innerHTML = e.data.value // error message
} else if (e.data.action === 'height') {
iframeElement.style.setProperty('height', e.data.value + 'px')
}
}
})
1.3 Create Credit Card Order (Checkout)
POST https://api.stripay.io/v1/checkout/pay
Request body:
1.4 Create PayPal Order
POST https://api.stripay.io/v1/paypal/pay
Request body:
1.5 Create Order Response
Response body (JSON):
1.6 Example
POST https://api.stripay.io/v1/checkout/pay
Request body:
{
"key": "098f6bcd4621d373cade4e832627b4f6",
"merchantOrderId": "1",
"amount": 0.99,
"successUrl": "https://stripay.io/v1/success.html",
"failUrl": "https://stripay.io/v1/fail.html",
"ip": "38.94.109.229",
"email": "[email protected]"
}
Successful response:
{ "status": "success", "statusNote": null, "redirectUrl": "https://stripay.io/v1/success.html" }
Failed response:
{ "status": "fail", "statusNote": "No account avaliable", "redirectUrl": "https://stripay.io/v1/fail.html" }
3DS redirect:
{ "status": "3ds", "statusNote": null, "redirectUrl": "https://checkout.stripe.com/c/pay/cs_test_xxx" }
2 Get Order
2.1 Get Multiple Orders
POST https://api.stripay.io/v1/orders
Request body:
{
"key": "098f6bcd4621d373cade4e832627b4f6",
"page": 1,
"limit": 20 // range [20, 100]
}
Response body:
{
"total": 90,
"orders": [{
"id": 1,
"merchantId": 1,
"merchantOrderId": "your order id",
"amount": 1.99,
"currency": "USD",
"email": "[email protected]",
"ip": "102.171.177.216",
"riskScore": 65,
"status": "completed",
"statusNote": null,
"is3ds": false,
"createdAt": "2023-02-14T12:39:13.000Z",
"updatedAt": "2023-02-14T12:39:21.000Z"
}]
}
2.2 Get One Order
POST https://api.stripay.io/v1/order
Request body:
{
"key": "098f6bcd4621d373cade4e832627b4f6",
"merchantOrderId": "merchant order id", // merchantOrderId or orderId
"orderId": "stripay order id" // recommend. merchantOrderId or orderId
}
Response body:
{
"order": {
"id": 1,
"merchantId": 1,
"merchantOrderId": "your order id",
"amount": 1.99,
"currency": "USD",
"email": "[email protected]",
"ip": "102.171.177.216",
"riskScore": 0,
"status": "rejected",
"statusNote": "No valid payment method types for this Checkout Session.",
"is3ds": false,
"createdAt": "2023-01-10T03:39:53.000Z",
"updatedAt": "2023-01-10T03:43:37.000Z"
}
}
2.3 Order Status
- pending — Order created, not paid
- rejected — Order rejected (risk control triggered)
- 3ds — 3ds triggered, user did not complete verification
- 3dsSuccess — 3ds verification succeeded, payment failed (insufficient funds, expired card, bank rejection, etc.)
- 3dsFail — 3ds triggered, verification failed
- completed — Order paid
- canceled — Order canceled
- expired — Order expired
- refunded — Order refunded
- disputed — Order disputed
3 Webhook
If you pass notifyUrl when creating an order, a POST request will be sent on status change (completed/refunded/disputed):
{
"id": 1,
"merchantId": 1,
"merchantOrderId": "your order id",
"amount": 1.99,
"currency": "USD",
"email": "[email protected]",
"ip": "102.171.177.216",
"riskScore": 0,
"status": "completed",
"statusNote": null,
"is3ds": false,
"createdAt": "2023-01-10T03:39:53.000Z",
"updatedAt": "2023-01-10T03:43:37.000Z",
"sign": "4a04cdd85f623f3785fe29655b03854f"
}
notifyUrl must return an OK string, otherwise considered failed. Stripay retries up to 5 times: immediately, 10min, 30min, 60min, 1 day.
3.1 Verify Sign
Sort all parameter keys lexicographically, concatenate their values, append the merchant key, then calculate md5:
function genSign (key, data) {
let signStr = ''
Object.keys(data)
.sort()
.forEach(key => {
if (key === 'sign') return
const value = data[key]
if (value === '' || value == null) return
signStr += value
})
return md5(signStr + key)
}
4 Testing
Test account and test credit card reference:
© 2025 Stripay. All rights reserved.