Checkout API reference#

The reference is generated from the OpenAPI 3.1 contract on every build of this site, so it cannot drift from what the API validates.

• Interactive referenceEvery endpoint with a request builder and generated client code. Rendered by Scalar in your browser.
• Static referenceThe same paths, operations and schemas as plain HTML — no JavaScript, printable, indexable.
• checkout-v1.yamlThe contract itself. Feed it to your generator, linter or mock server.

Reading it#

• Tags group the endpoints: Sessions, Payment methods, Refunds, Webhook endpoints, Events, Customers (Phase 2), Public (used by the hosted page and the drop-in), Health.
• Security on each operation tells you which credential it takes — secretKey for the merchant surface, publishableKey (plus customerToken after phone verification) for /public/*, none for /health and vendor callbacks.
• Schemas are the source of truth for every JSON shape on this site. Where a guide shows an example, the schema wins if they ever disagree — and please tell us.
• x-povito at the end of the file records the webhook signature format and retry schedule so tooling can read them.

Servers#

GET /v1/health needs no key and returns { "status": "ok", "version", "gateways": [...] } — the names of the registered gateways, never their configuration.

Generating a client#

The contract lints clean under Spectral's spectral:oas ruleset with operationId on every operation, so any OpenAPI 3.1 generator will produce a usable client. @povito/checkout-node is Povito's own, hand-checked against the API.

Collections#

Postman and Bruno collections exported from the same file are on the way; until then, both tools import checkout-v1.yaml directly (Postman: Import → File; Bruno: Import collection → OpenAPI V3). Set a collection variable for the bearer token and an Idempotency-Key pre-request script that generates a UUID.