Get your merchant credentials
Register, add your site and send it for moderation. Once approved, your merchant ID and secret password are in the dashboard.
Developers
Six endpoints, one signature, no SDK.
Signed HTTP requests against plain endpoints. Take the hosted payment page, or pull the requisites as JSON and build your own checkout — either way the result reaches you as one signed webhook.
GET/api/new/api.php
# Request payment requisites - the signature is built from your merchant password # hash = md5(id : summ : password : sistems : order_id) HASH=$(printf '%s' "5:100.00:$PAYOU_PASSWORD:card_RUB:4444" | md5sum | cut -d' ' -f1) curl -G https://payou.pro/api/new/api.php \ --data-urlencode id=5 \ --data-urlencode sistems=card_RUB \ --data-urlencode summ=100.00 \ --data-urlencode order_id=4444 \ --data-urlencode user_code=1 \ --data-urlencode user_email=[email protected] \ --data-urlencode hash="$HASH"
Request
AUTH
WEBHOOKS
Sign and send
Build the hash from your merchant ID, amount, secret, method and order ID, then call the endpoint. The amount is a decimal string with a dot.
Receive the webhook
Payou posts the result to your URL with a signature. Verify it, answer MERCHANT_ORDER_ID|success and credit the order once.
AUTH
Merchant ID and secret
Requests are signed, not bearer-authenticated. The hash is md5 over your merchant ID, the amount, your secret password, the method and your order ID, so the secret itself never travels. Payouts use a separate API key signed with HMAC-SHA256.
AMOUNTS
Decimal string with a dot
The amount is sent as a decimal string with a period separator — 100.00, never 100,00. The same string goes into the signature, so a formatting difference breaks the hash rather than the payment.
ORDER ID
Your reference is the key
order_id is your own identifier. It is what the status endpoint looks up, what the webhook returns to you and what you reconcile against — so it has to be unique on your side.
WEBHOOKS
Signed form POST
Payou posts AMOUNT, status, intid, MERCHANT_ORDER_ID and SIGN to your URL as application/x-www-form-urlencoded. Verify SIGN, then answer MERCHANT_ORDER_ID|success — any other body is treated as undelivered.
STATUS
Poll or wait for the webhook
Two lookups: one keyed on the Payou transaction id, one on your order_id. Both answer with id, order_id, status, paysys and summ, so a reconciliation job needs nothing else.
PRODUCTION
Integration happens in production
There is no separate sandbox host. You integrate against the live endpoints with a merchant account that is enabled after moderation.
Endpoints
The whole surface for a first integration. Payment calls are signed with your merchant password; payouts use a separate API key and HMAC-SHA256.
| Method | Endpoint | Purpose |
|---|---|---|
| GET | /sci/v1/ | Hosted payment page — send the payer here |
| GET | /api/new/api.php | Payment requisites as JSON, for your own checkout |
| GET | /api/status | Payment status by Payou transaction id |
| GET | /api/status2 | Payment status by your order_id |
| POST | /api/new/confirm_payment.php | Payer confirms or cancels a payment |
| POST | /api/payout_create.php | Create a payout to a card or account |
API
One signed request. Requisites back as JSON.
Country and method are parameters of the same call, not separate integrations. The route behind them is chosen by the layer.
GET/api/new/api.php
Request
# Request payment requisites - the signature is built from your merchant password # hash = md5(id : summ : password : sistems : order_id) curl -G https://payou.pro/api/new/api.php \ --data-urlencode id=5 \ --data-urlencode sistems=card_RUB \ --data-urlencode summ=100.00 \ --data-urlencode order_id=4444 \ --data-urlencode user_code=1 \ --data-urlencode hash="$HASH"
Response
# HTTP 200 · application/json { "id": "3874512", "card": "0000 0000 0000 0000", "wallet_owner": "CARDHOLDER NAME", "sbp_bank": "BANK NAME", "amount": "100.00" }
Illustrative response. Nothing is sent and no funds move.
Credentials, reference, first request.
The documentation is open — no sales call is required to start reading or to build against the endpoints.