Skip to main content
Base URL — https://server.hypermid.io The same host serves sandbox and production. Which one you are in is decided by your key, not the URL. See Environments.

​
Authentication at a glance

Full detail in Authentication.
The Payments SDK is the easiest way to create and read sessions, but the same merchant-facing operations are also available in this API reference. Send your secret key only as Authorization: Bearer sk_… from your server. Payer-facing routes and publishable-key routes that are not live are intentionally omitted.

​
Response envelope

Errors always carry the same shape, on every route:
Branch on code, which is stable, rather than on error, whose wording may change. Quote traceId in any support request — it is how we find your exact call. See Error codes. Successes come in two shapes, and which one you get depends on the route. Reference and status routes wrap their result in { traceId, code, error, data } — the result is in data. The POST /quote route returns its executable quote body directly, with no wrapper, so your frontend can submit transactionRequest as-is. One unwrap helper tolerates both:
The SDK does this for you — the quote and read clients return the result either way. Payment session responses are handled entirely inside @hypermid/sdk.

​
Amounts

Every amount is a decimal string in the token’s smallest unit. Never a JSON number: an 18-decimal amount exceeds the IEEE-754 safe integer range, and the failure mode is silent truncation of the low digits rather than a parse error.
Parse with a bigint. parseFloat will appear to work right up until it does not.

​
Trying it

Every endpoint on these pages has an interactive playground — fill in a key and send a real request. For a local collection, see Postman.

​
Webhooks

The API also calls you. Those are documented alongside the endpoints, under Webhooks, and are part of the same OpenAPI document — so a generated client covers both directions.