API documentation

Create payments and refunds from your own systems. Amounts are integers in the smallest currency unit, so 2500 means $25.00.

Authentication

Create a key under Settings, API and webhooks, then send it as a bearer token. Keys are shown once. Keep them on your server.

Endpoints

`POST`	`/api/v1/payments`	Create a payment. Returns checkout_url and client_secret.
`GET`	`/api/v1/payments/:id`	Retrieve a payment.
`GET`	`/api/v1/transactions`	List transactions, newest first. Supports limit and starting_after.
`POST`	`/api/v1/refunds`	Refund a payment in full or part.
`GET`	`/api/v1/webhook-endpoints`	List your webhook endpoints.
`POST`	`/api/v1/webhook-endpoints`	Register an endpoint. The signing secret is shown once.

Idempotency

Send an Idempotency-Key header on every POST. Retrying with the same key and body returns the first response, without one-time values such as client_secret or a webhook secret. The same key with a different body returns 409.

Errors

Errors use standard HTTP status codes and one shape:

{ "error": { "code": "amount_too_small", "message": "Amount is below the minimum charge." } }

Node.js

import crypto from 'node:crypto';

const res = await fetch('https://blazingpayments.com/api/v1/payments', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.BLAZING_API_KEY}`,
    'Content-Type': 'application/json',
    'Idempotency-Key': crypto.randomUUID(),
  },
  body: JSON.stringify({ amount: 2500, currency: 'usd', description: 'Order 1042' }),
});
const payment = await res.json();
// Send your customer to payment.checkout_url

PHP

<?php
$ch = curl_init('https://blazingpayments.com/api/v1/payments');
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => [
    'Authorization: Bearer ' . getenv('BLAZING_API_KEY'),
    'Content-Type: application/json',
    'Idempotency-Key: ' . bin2hex(random_bytes(16)),
  ],
  CURLOPT_POSTFIELDS => json_encode([
    'amount' => 2500, 'currency' => 'usd', 'description' => 'Order 1042',
  ]),
]);
$payment = json_decode(curl_exec($ch), true);
header('Location: ' . $payment['checkout_url']);

Python

import os, uuid, requests

res = requests.post(
    "https://blazingpayments.com/api/v1/payments",
    headers={
        "Authorization": f"Bearer {os.environ['BLAZING_API_KEY']}",
        "Idempotency-Key": str(uuid.uuid4()),
    },
    json={"amount": 2500, "currency": "usd", "description": "Order 1042"},
)
payment = res.json()
# Send your customer to payment["checkout_url"]

Webhooks

We send payment.succeeded, payment.failed, refund.succeeded, refund.failed, dispute.opened, dispute.closed, payout.paid and payout.failed. Failed deliveries are retried with backoff. Verify the Blazing-Signature header against the raw body:

import crypto from 'node:crypto';

function verify(rawBody, header, secret) {
  const parts = Object.fromEntries(header.split(',').map((p) => p.split('=')));
  const expected = crypto.createHmac('sha256', secret)
    .update(`${parts.t}.${rawBody}`).digest('hex');
  const fresh = Math.abs(Date.now() / 1000 - Number(parts.t)) < 300;
  return fresh && crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1));
}