Quickstart

This walks through a card payment end to end: create an intent, then commit it to capture funds. All amounts are integers in the currency’s minor units — 1000 means $10.00 for USD.

Authenticate. Send your secret key as a bearer token on every request. Use a sk_test_… key while you build — see Authentication.

Create a card payment intent. Start with a bare draft — just the amount and currency. Card details aren’t sent here; you attach them as a client-side encrypted block at the authorize step, so the raw card number never touches your server. See encrypting card data for how to build the block.

curl https://api.paygasus.com/payments/card \
  -H "Authorization: Bearer sk_test_…" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 1000,
    "currency": "USD",
    "capture_method": "automatic",
    "description": "first intent"
  }'

The response is a card payment intent in the created state — payment_method is null until you authorize:

{
  "id": "pi_card_9Z3K01ARZ3NDEKTSV4RRFFQ69G5FAV",
  "amount": 1000,
  "amount_captured": 0,
  "amount_refunded": 0,
  "currency": "USD",
  "status": "created",
  "status_at": null,
  "processor_ref": null,
  "failure_reason": null,
  "cancellation_reason": null,
  "capture_method": "automatic",
  "payment_method": null,
  "description": "first intent",
  "statement_descriptor": null,
  "metadata": {},
  "created": 1746500000,
  "updated": 1746500000,
  "livemode": false
}

created does not authorize the payment method. This is by design to allow a customer experience step (e.g. some kind of “You authorize the institution to charge this payment method for X amount”)

Authorize to charge the payment method. Reference the intent ID and attach the client-side encrypted card block. The amount was fixed at create.
Authorize the intent
```
curl -X POST https://api.paygasus.com/payments/card/pi_card_9Z3K01ARZ3NDEKTSV4RRFFQ69G5FAV/authorize \
  -H "Authorization: Bearer sk_test_…" \
  -H "Content-Type: application/json" \
  -d '{
    "payload": "eyJhbGciOiJSU0Et…ENCRYPTED…",
    "key_id": "key_…",
    "layout": [{ "field": "Pan", "len": 16 }, { "field": "Cvc", "len": 3 }]
  }'
```
Because we set capture_method: "automatic" in step 1, this returns as committed. A committed intent comes back with status.status = "committed". You’ve taken your first payment.

If the card declines, you still get a 200, the intent comes back in failed with a reason. Declines are outcomes, not errors. See Test mode to simulate one.

Next steps

Browse the full, always-current API reference for every field.
- Learn the error envelope so your integration handles declines and retries.