Getting started
Use this with the Pay API reference in the sidebar. For browser checkout, continue to Embedded checkout — this page only covers server credentials and your first request.
1. Get credentials
From the Amos dashboard (sandbox: dashboard-sandbox.amos.com):
- Create an API key. Server only. Never ship it to the browser.
- Create a render template with allowed payment methods and billing geography.
- Add each parent origin you will mount from (exact scheme + host, e.g.
https://checkout.example.com). - Issue a render token from that template. Safe for the client; it encodes env, origins, methods, and amount range.
An account id is assigned after your application is approved. It is not an HTTP header.
2. Base URL and headers
Call the Pay API at https://api-sandbox.amos.com (sandbox) or https://api.amos.com (production). Paths in the spec have no /v1 prefix.
X-Api-Key: <secret>
X-Api-Version: 1
Content-Type: application/json
| Header | Required | Notes |
|---|---|---|
X-Api-Key |
Yes | Authenticates the request. Account scope is inferred from the key. |
X-Api-Version |
Yes on Pay routes | Use 1 until the API publishes a bump. @amos.com/node exports AMOS_API_VERSION. |
X-Idempotency-Key |
When the operation documents it | Refunds, payouts, voids. |
X-Account-Id |
No | Removed from the contract. Do not send it. |
Embed confirm routes (/embed/...) use Authorization: Embed <embedToken>. Partners using the iframe SDKs never call those themselves.
3. First request
List payment intents:
curl -sS "https://api-sandbox.amos.com/payment_intents?page=1&per_page=5" \
-H "X-Api-Key: $AMOS_API_KEY" \
-H "X-Api-Version: 1"
A successful list is JSON with data and meta.
Create a payment intent (amount is integer cents; currency is account-level):
curl -sS -X POST "https://api-sandbox.amos.com/payment_intents" \
-H "X-Api-Key: $AMOS_API_KEY" \
-H "X-Api-Version: 1" \
-H "Content-Type: application/json" \
-d '{"payment_intent":{"amount":5000,"capture_method":"automatic"}}'
200 body is an embed token:
{ "token": "<jwt>", "ttl": 3600 }
Return only token to the browser. Confirm immediately — after ttl the iframe confirm fails with Signature has expired.
Node
import {
createPayApiClient,
AMOS_API_BASE_URL_SANDBOX,
AMOS_API_VERSION,
} from "@amos.com/node";
const pay = createPayApiClient({
baseUrl: AMOS_API_BASE_URL_SANDBOX,
headers: {
"X-Api-Key": process.env.AMOS_API_KEY!,
"X-Api-Version": AMOS_API_VERSION,
},
});
const { data, error } = await pay.POST("/payment_intents", {
body: {
payment_intent: { amount: 5000, capture_method: "automatic" },
},
});
if (error || !data?.token) throw new Error("Failed to create payment intent");
// data.token → browser confirmPayment
capture_method is "automatic" (sale), "automatic_async" (auth then async capture), or "manual" (auth only). Client { status: "succeeded" } means authorization (or sale for automatic). Verify settlement with a webhook or GET /payment_intents/{id}.
4. Errors
The API uses standard HTTP status codes and a structured Error body when one is documented.
| Status | Typical cause |
|---|---|
401 |
Missing or inactive API key |
403 |
Key cannot access the resource |
422 |
Validation (including expired embed token: Signature has expired) |
429 |
Rate limit — backoff and retry |