Skip to main content
Base URL — https://server.hypermid.io The same host serves sandbox and production. Which one you are in is decided by your key, not the URL. See Environments.

​
Authentication at a glance

Full detail in Authentication.

​
Fiat payments

For a merchant payment, use the session-scoped Cash flow. Create a Checkout or Deposit session first, then the payer-facing page uses these endpoints: These routes take no API key. The session binds the destination; the payer cannot replace the payout address, chain, token, or a fixed Checkout amount in the request. The request supplies the payer’s srcCurrency, paymentMode, orderType: "buy", and srcChain: "fiat"; srcAmount is used for a Deposit or open-amount session and is ignored for a fixed Checkout. The provider account and its credentials are configured by Hypermid per environment and are never sent by the merchant. The generic /onramp/* endpoints remain available as direct reference/proxy routes, but they are not the new session-bound payment flow. New integrations should use the session-scoped endpoints above so the payout destination is server-authoritative.
The Payments SDK is the easiest way to create and read sessions, but the same merchant-facing operations are also available in this API reference. Send your secret key only as Authorization: Bearer sk_… from your server. Payer-facing routes and publishable-key routes that are not live are intentionally omitted.

​
Response envelope

Errors always carry the same shape, on every route:
Branch on code, which is stable, rather than on error, whose wording may change. Quote traceId in any support request — it is how we find your exact call. See Error codes. Successes come in two shapes, and which one you get depends on the route. Reference and status routes wrap their result in { traceId, code, error, data } — the result is in data. The POST /quote route returns its executable quote body directly, with no wrapper, so your frontend can submit transactionRequest as-is. One unwrap helper tolerates both:
The SDK does this for you — the quote and read clients return the result either way. Payment session responses are handled entirely inside @hypermid/sdk.

​
Amounts

Every amount is a decimal string in the token’s smallest unit. Never a JSON number: an 18-decimal amount exceeds the IEEE-754 safe integer range, and the failure mode is silent truncation of the low digits rather than a parse error.
Parse with a bigint. parseFloat will appear to work right up until it does not.

​
Trying it

Every endpoint on these pages has an interactive playground — fill in a key and send a real request. For a local collection, see Postman.

​
Webhooks

The API also calls you. Those are documented alongside the endpoints, under Webhooks, and are part of the same OpenAPI document — so a generated client covers both directions.