Documentation

Everything you need to take your first payment: quickstarts, API reference, webhooks and plugins.

Quickstart

1. Create an account and complete onboarding.
2. Grab your test API key from the dashboard (API keys).
3. Create your first test payment on the sandbox:

curl https://sandbox.cardencer.com/payments \
  -H "api-key: snd_REPLACE_WITH_YOUR_FULL_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 4900,
    "currency": "EUR",
    "confirm": true,
    "capture_method": "automatic",
    "description": "Order 58211",
    "payment_method": "card",
    "payment_method_type": "credit",
    "payment_method_data": { "card": {
      "card_number": "4242424242424242",
      "card_exp_month": "12", "card_exp_year": "2030",
      "card_holder_name": "Test", "card_cvc": "123"
    } }
  }'

Testing

Test keys work only on https://sandbox.cardencer.com; live keys work only on https://api.cardencer.com. The sandbox uses a test processor: no bank is involved and no real money moves. Use any future expiry date and any 3-digit CVC.

• 4242 4242 4242 4242 — succeeds (Visa)
• 5555 5555 5555 4444 — succeeds (Mastercard)
• 4000 0000 0000 0002 — declined
• 4000 0000 0000 9987 — declined, lost card
• 4000 0000 0000 9979 — declined, stolen card
• 4000 0038 0000 0446 — 3-D Secure challenge, then succeeds

Production secret keys start with prd_; sandbox secret keys start with snd_. A value containing ******** is only a masked identifier and cannot authenticate API calls.

API reference

• POST /payments — create and optionally confirm a payment
• GET /payments/:id — retrieve a payment
• POST /payments/:id/confirm — confirm a payment
• POST /payments/:id/capture — capture an authorized payment
• POST /payments/:id/cancel — cancel an uncaptured payment
• POST /refunds — refund a payment, fully or partially
• GET /payouts/list — list settlement payouts to your SEPA account

Webhooks

Subscribe to payment_intent_success, payment_intent_failure, payment_intent_capture_success, refund_success and payout_success. Treat deliveries as idempotent by persisting each webhook event_id before updating an order.

Configure your plugin's HTTPS callback as webhook_details.webhook_url on the matching business profile. Cardencer signs the exact JSON body with the profile's payment_response_hash_key and sends the lowercase hexadecimal HMAC-SHA512 in X-Webhook-Signature-512.

Plugins & SDKs

Official plugins for WordPress / WooCommerce, Magento, PrestaShop, Shopware and OpenCart, plus native iOS and Android SDKs. Install, paste your API key, and start accepting payments.