Introduction

The Payments API runs card checkouts. It charges cards, Google Pay and Apple Pay through Azul, runs the 3D Secure flow, and tells your server about each payment with a signed webhook.

Base URLs

Environment	Base URL
Production	`https://payments.rapidotickets.com`
Development	`https://dev-payments.rapidotickets.com`

How a payment works

Your server creates a checkout with POST /checkout and gets back its id.
Your checkout page submits the payment details to POST /checkout/{id}.
The page polls GET /checkout/{id}. While the status is method or challenged, it shows the 3D Secure form the status carries.
The checkout ends as complete, failed or errored. On complete, your server has already received the webhook.

Sign your requests

POST /checkout, POST /customer and GET /payment/evidence require an x-hub-signature header. Its value is the hex HMAC-SHA256 digest, keyed with the shared secret, of

the raw request body, for a POST
the query string without the leading ?, for a GET

import { createHmac } from 'node:crypto';

const body = JSON.stringify({
  amount: 100_00,
  ITBIS: 18_00,
  currency: 'DOP',
  metadata: 'order-12345',
  webhookURL: 'https://example.com/webhooks/payment',
  forceNo3DS: false
});
const signature = createHmac('sha256', process.env.PAYMENTS_SECRET).update(body).digest('hex');

const response = await fetch('https://payments.rapidotickets.com/checkout', {
  method: 'POST',
  headers: {
    'content-type': 'application/json',
    'x-hub-signature': signature
  },
  body
});
const { id } = await response.json();

Sign the exact bytes you send. For a GET, build the query with URLSearchParams and sign params.toString().

Receive the webhook

After a successful charge, the API sends a POST to the checkout’s webhookURL.

{
  "paymentId": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
  "amount": 10000,
  "metadata": "order-12345",
  "azulOrderId": "44012345"
}

The x-hub-signature header carries the HMAC-SHA256 hex digest of the raw body, keyed with the same shared secret. Verify it before you trust the payload. Reply with any 2xx once the order is recorded. A failed delivery is retried for about two hours, so make your handler idempotent on paymentId. If the order can no longer be fulfilled, reply 409 with { "error": "ORDER_CANNOT_BE_FULFILLED" }. The checkout then ends as errored and the payment is flagged for review.

Get started

API reference

Base URLs

How a payment works

Sign your requests

Receive the webhook

​Base URLs

​How a payment works

​Sign your requests

​Receive the webhook

Base URLs

How a payment works

Sign your requests

Receive the webhook