Allpay API Reference

API for Israel-based businesses. All requests are POST to https://allpay.to/app/?show=<endpoint>&mode=api16 with a JSON body. The show and mode parameters are passed in the URL query string — not in the JSON body — and are not included in the signature. Authentication uses your API login and a SHA256 signature.

Integration Flows

Choose the flow that matches your use case. Each links to the relevant endpoints.

Most common

Redirect Payment

Call Create Payment → receive payment_url
Redirect the customer to payment_url
Customer enters card details on the Allpay payment page
Allpay POSTs a webhook to your server → verify signature → fulfill order

Best for: standard e-commerce checkout.

Embedded form

Hosted Fields

Call Create Payment with client_name and client_email → receive payment_url
Embed the Hosted Fields iframe on your page using that URL
Customer enters card details directly on your site
Allpay POSTs a webhook → verify signature → fulfill order

Best for: keeping customers on your site. Hosted Fields guide →

Platform-managed billing

Token Billing

Obtain an allpay_token: use Capture Token to save a card without charging, or Get Token from a completed payment
Store the token securely on your side
Whenever you need to charge, call Create Payment with allpay_token
The charge is processed immediately — result returned synchronously; a webhook is sent to webhook_url (if provided)

Best for: SaaS, marketplaces — when you control the billing schedule and amounts.

Allpay-managed billing

Native Allpay Subscription

Call Create Subscription → redirect customer to payment_url
Customer authorizes the first charge
Allpay charges automatically every month and sends a webhook for each charge
Manage via Cancel, Status, and List endpoints

Best for: fixed monthly subscriptions — no billing logic needed on your side.

Two-step payment

Pre-authorization (J5)

Call Create Payment with preauthorize: 1 → customer authorizes the reservation
Allpay sends a webhook — amount is reserved on the card, not charged
Within 7 days: call Charge Pre-auth to capture (up to reserved amount) — or Refund to void

Best for: deliveries, rentals, variable-weight goods — when the final amount is unknown at authorization time.

Getting Started

Authentication

Every request must include two fields in the JSON body:

Field · Type · Description

sign^*

string required

SHA256 signature of the request body (see algorithm below)

Signature Algorithm

The signature is generated from the request parameters using your private API key.

Remove the sign field from the request.
Exclude parameters whose value is an empty string "" or null (and, naturally, parameters you do not send). 0 and false are values and stay — see the value rules below.
Sort the remaining keys in alphabetical order (A–Z). Alphabetical sorting must be applied everywhere — to top-level parameters, to the keys of an object parameter (such as subscription), and to the keys inside each object of an array parameter (such as items). Array elements themselves keep the order in which you send them.
From the sorted list, take only the parameter values and join them into a single string using a colon : as the separator. Values are not escaped — a colon inside a value is used as is.
Append your API key to the end of the string, preceded by a colon.
Apply SHA256 to the final string encoded as UTF-8.

How values are written into the string

The signature is calculated over the values as they arrive in your JSON body. Non-string values are converted as follows:

Value in JSON	In the signature string	Note
"abc"	abc	Strings are used exactly as sent — no trimming, no case change.
"", null	— (skipped)	Left out of the string, exactly like a parameter you do not send.
0, "0"	0	Zero is a value, not an empty field — it is included.
100 / 100.0 / 100.00	100	A JSON number is written in its shortest exact form, without trailing zeros: `100.50` → `100.5`, `99.89999999999999` stays as is. This matches `String(n)` in JavaScript and `json_encode()` in PHP. A string keeps its exact text: `"100.00"` → `100.00`.
true	1	Not `true` — JavaScript's `String(true)` and Python's `str(True)` give a different result.
false	0	Not `false` and not skipped — the same as passing `0`.
[ ] (empty array)	— (nothing)	An empty array adds nothing to the string.

Tip Send numbers as JSON numbers and flags as 1 / 0. Round amounts to 2 decimals before signing and sending — e.g. 0.1 + 0.2 is 0.30000000000000004, not 0.3. Allpay rounds amounts and prices to 2 decimals anyway. The functions below already follow all of these rules.

Worked Example

Request body (before signing):

{
  "items": [
    {
      "name": "Test payment",
      "price": 1000,
      "qty": 1,
      "discount_val": 0,
      "discount_type": "fixed",
      "vat": 1
    }
  ],
  "order_id": "1589758an",
  "client_name": "Jason Statham",
  "client_email": "jason@company.io",
  "client_tehudat": "000000000",
  "currency_display": "ILS",
  "currency_payment": "ILS",
  "lang": "AUTO",
  "preauthorize": 0,
  "allpay_token": "",       ← excluded (empty string)
  "inst": "",               ← excluded (empty string)
  "receipt_type": "",       ← excluded (empty string)
  "button_title": "pay",
  "success_url": "https://example.com/success",
  "webhook_url": "https://example.com/hook/allpay",
  "backlink_url": "",       ← excluded (empty string)
  "login": "pp1008795"
}

Sorted keys A–Z with their values as text, the way they go into the string — numbers too (items[] fields also sorted A–Z and flattened inline):

button_title      → "pay"
client_email      → "jason@company.io"
client_name       → "Jason Statham"
client_tehudat    → "000000000"
currency_display  → "ILS"
currency_payment  → "ILS"
items[0]          → discount_type="fixed", discount_val="0", name="Test payment", price="1000", qty="1", vat="1"
lang              → "AUTO"
login             → "pp1008795"
order_id          → "1589758an"
preauthorize      → "0"  ← included (0 is a value, not an empty field)
success_url       → "https://example.com/success"
webhook_url       → "https://example.com/hook/allpay"

String to sign (values joined with :, API key appended):

pay:jason@company.io:Jason Statham:000000000:ILS:ILS:fixed:0:Test payment:1000:1:1:AUTO:pp1008795:1589758an:0:https://example.com/success:https://example.com/hook/allpay:CB545B50989469F7258C8E043462B30C

SHA256 result:

c3c5458724d88837bd60879b5130c860589e42248360b4ca42c2539ebf8a7803

Signature calculator

Warning Make sure you follow these steps exactly. 99% of "Invalid signature" errors are caused by: trimming spaces from values, treating 0 as empty (it is a valid value and is included in the signature), omitting parameters from the signature function, or writing true / false as text instead of 1 / 0 (see value rules). Only "", null and parameters you do not send are left out.

Errors

All errors return HTTP 200 with a JSON body containing error_code and error_msg. The only exception is error 429, which returns HTTP 429 (see Request limits).

{
  "error_code": 3,
  "error_msg":  "Signature is incorrect"
}

error_code	error_msg	Description
2	`Missing required parameters: ...` / `Wrong param value: ...`	A required parameter is missing, has an invalid value, or failed validation (price, qty, discount, email format, `order_id` longer than 64 characters, `receipt_type` eligibility, `skip_receipt`, a missing or unknown `currency_display`, the period or filters of List Transactions / List Payouts, or a refund `amount` larger than the part of the order that has not been refunded yet). The error message lists the specific fields.
3	`Signature is incorrect`	The `sign` parameter does not match the expected SHA256 signature.
5	`Login incorrect`	The `login` parameter does not match any Allpay account.
6	`Order not found` / `Subscription not found`	No order or subscription with the given `order_id` was found for this account.
9	`Incorrect token`	The `allpay_token` does not exist, is invalid or was deleted with Delete Token.
12	`<processor message>`	The payment processor declined the token charge. The message is the decline reason in English (the same as `decline_reason`). The response also includes `decline_code` and `decline_reason` when a decline code is available — see Decline codes.
13	`Token creation error`	Failed to retrieve a token for the given order (`gettoken` endpoint).
15	`Order ID ... has already been paid`	An order with this `order_id` already exists and has been paid. Use a unique `order_id` for each payment.
16	`Same order can not be charged twice` / `Pre-authorization is not active` / `Refund error: wrong order status`	Attempted to charge a J5 pre-authorization that was already captured, that is not authorized yet (the customer has not completed the payment or it failed) or that was voided with Refund; or to refund an order that is not in a paid state.
17	`Processor refund error: ...`	The payment processor returned an error when processing the refund. The message ends with the reason in English, and the response includes `decline_code` / `decline_reason` when a code is available.
18	`Subscription can only include one item`	The `items` array contains more than one item in a subscription request.
19	`Payment error: wrong order status`	The payment processor returned an unexpected status when capturing a J5 pre-authorization.
20	`Incorrect method`	The `show` parameter in the URL contains an unknown or unsupported endpoint name.
21	`Amount must be at least 5 ILS`	The total payment amount after item discounts (and after applying currency rate) is below the minimum of 5 ILS. Applies only to ILS payments (`currency_payment` = ILS or not specified).
22	`Subscriptions module is not enabled for this account`	A request contained a `subscription` object, but the Subscriptions module is not active for the account. Enable it in the dashboard (Modules → Subscriptions).
26	`Order ID ... already has a payment attempt, use a new order_id`	A token charge (`allpay_token`) was requested for an `order_id` that already had a payment attempt, e.g. a declined charge. Each payment attempt must use its own `order_id`.
27	`Payment cannot be cancelled: ...`	Cancel Payment could not cancel the link: it is a token charge, or the customer is completing the payment right now (check the status a little later). New in v16.
28	`Order ID ... was cancelled, use a new order_id`	The `order_id` belongs to a link cancelled with Cancel Payment; Create Payment and Capture Token do not reuse it. New in v16.
429	`Too many requests`	The request limit of this method is exceeded — see Request limits. The response has HTTP status 429 and a `Retry-After` header with the number of seconds to wait.

Request limits

Limits are counted separately for each method and API login. A request without a recognized login is counted by IP address, at most 20 requests per period.

Method	Limit
getpayment, runauthorizedpayment	30 requests per 10 seconds
paymentstatus	100 requests per 10 seconds
gettransactions	30 requests per minute
All other methods	60 requests per 10 seconds

Decline codes

When a payment is declined, the API returns decline_code and decline_reason — in error 12 of a token charge, in Check Payment Status and in the failed-payment webhook. A code not listed here comes with decline_reason = Payment declined. Most declines by the bank use the general code 20004: the bank does not disclose the exact reason (insufficient funds, limits, etc.).

decline_code	decline_reason	What to do
20004	Declined by the card issuer	Ask the customer for another card
420	Declined, please try another payment method	Another card or payment method. If it repeats for all customers, contact Allpay support
21001	Card is blocked	Another card
21002	Card is reported stolen	Do not retry; another card
21003	Card is reported counterfeit	Do not retry; another card
21004	Card is expired	Another card
21005	Incorrect card number	Enter the card again
21008	Incorrect CVV or ID number	Enter the details again
21012	Card is not permitted for this type of transaction	Another card
21014	Card is not permitted for installment payments	Pay without installments
21017	Card verification failed, please try again	Retry
610	Card is restricted	Another card
20010	Debit cards are not accepted	A credit card
20020	Card brand is not supported by the merchant	A card of another brand
600	Saved card is no longer valid, the card must be entered again	Ask the customer to enter the card again and get a new `allpay_token`
20001	Temporary processing error, no charge was made	Safe to retry with a new `order_id`
20002, 991	Temporary connection error, no charge was made	Safe to retry with a new `order_id`
352	Amount is out of the allowed limits	Check the amount
312	Installments are allowed only in ILS	Pay in ILS or without installments
351	Invalid number of installments	Check `inst`
23001	Payment request was rejected by the customer	Bit: the customer rejected the request
23002	Payment request was canceled by the merchant	Bit: the request was canceled
23003	Payment request has expired	Bit: the customer did not confirm in time; create a new payment
720, 998, 130	Service is not activated / Operation is not permitted / Merchant has reached the sales limit	Merchant account settings — contact Allpay support

Show code example

Node.js

const crypto = require('crypto');

// "", null and undefined are left out
const isEmpty = v => v === '' || v === null || v === undefined;
// true → "1", false → "0"
const allpayValue = v => v === true ? '1' : v === false ? '0' : String(v);

function allpaySign(data, apiKey) {
  const chunks = [];
  for (const key of Object.keys(data).sort()) {
    const val = data[key];
    if (key === 'sign' || isEmpty(val)) continue;
    if (typeof val === 'object') {
      // items (array) or subscription (object with sorted keys)
      const list = Array.isArray(val) ? val : Object.keys(val).sort().map(k => val[k]);
      for (const item of list) {
        if (item !== null && typeof item === 'object') {
          for (const k of Object.keys(item).sort())
            if (!isEmpty(item[k])) chunks.push(allpayValue(item[k]));
        } else if (!isEmpty(item)) {
          chunks.push(allpayValue(item));
        }
      }
    } else {
      chunks.push(allpayValue(val));
    }
  }
  chunks.push(apiKey);
  return crypto
    .createHash('sha256')
    .update(chunks.join(':'))
    .digest('hex');
}

PHP

// true → "1", false → "0", float → shortest exact form (as in the JSON body)
function allpay_value($v) {
  if (is_bool($v)) return $v ? '1' : '0';
  if (is_float($v)) return json_encode($v);
  return $v;
}

function allpay_sign(array $data, string $api_key): string {
  ksort($data);
  $chunks = [];
  foreach ($data as $key => $val) {
    // "" and null are left out
    if ($key === 'sign' || $val === '' || $val === null) continue;
    if (is_array($val)) {
      // items (list) or subscription (object with sorted keys)
      ksort($val);
      foreach ($val as $item) {
        if (is_array($item)) {
          ksort($item);
          foreach ($item as $v)
            if ($v !== '' && $v !== null) $chunks[] = allpay_value($v);
        } elseif ($item !== '' && $item !== null) {
          $chunks[] = allpay_value($item);
        }
      }
    } else {
      $chunks[] = allpay_value($val);
    }
  }
  $chunks[] = $api_key;
  return hash('sha256', implode(':', $chunks));
}

Python

import hashlib

# "" and None are left out
def is_empty(v):
    return v is None or v == ''

# True → "1", False → "0", 100.0 → "100"
def allpay_value(v):
    if v is True:
        return '1'
    if v is False:
        return '0'
    if isinstance(v, float) and v.is_integer():
        return str(int(v))
    return str(v)

def allpay_sign(data: dict, api_key: str) -> str:
    chunks = []
    for key in sorted(data):
        val = data[key]
        if key == 'sign' or is_empty(val):
            continue
        if isinstance(val, (list, dict)):
            # items (list) or subscription (dict with sorted keys)
            items = val if isinstance(val, list) else [val[k] for k in sorted(val)]
            for item in items:
                if isinstance(item, dict):
                    chunks += [allpay_value(item[k]) for k in sorted(item) if not is_empty(item[k])]
                elif not is_empty(item):
                    chunks.append(allpay_value(item))
        else:
            chunks.append(allpay_value(val))
    chunks.append(api_key)
    return hashlib.sha256(':'.join(chunks).encode('utf-8')).hexdigest()

Getting Started

Test Mode

Test mode is a setting of the integration (API login), not of your code. Switch it in the Allpay app: Settings → Integrations → My sites, the Test mode switch of the integration.

While the switch is on, every payment created with this login is a test payment: real cards are not charged — use the Test Cards.
Your code is the same in both modes: same URL, login, API key and requests. Do not add a test flag or an environment variable for the mode, and do not send test_mode.
To go live, turn the switch off. Nothing changes on your side.
Need test and live side by side (for example, staging and production)? Create two integrations, one of them with test mode on, and give each environment its own login and API key.
To check the mode from code, call Verify API Keys: it returns test_mode of the login. Every payment carries its mode too — test_mode in the Create Payment response, Check Payment Status, List Transactions and every webhook. Do not ship or issue documents for a webhook with test_mode: 1.
test_mode: 1 in Create Payment makes one payment a test payment while the switch is off; it is rarely needed. It never works the other way: while the switch is on, no live payment can be created with this login — test_mode: 0 is ignored.

Payments

Create payment links, check status, issue refunds.

Payments

Create Payment

POSThttps://allpay.to/app/?show=getpayment&mode=api16

Key rules

R1 Use a new order_id for each payment. An already paid order_id is rejected with error 15.
R2 price already includes VAT. It is not added on top.
R3 Fulfill the order only when status = 1 and the signature is valid.
R4 Test or live is decided by the Test mode switch of the integration, not by your code. Do not send test_mode unless one payment must be a test payment while the switch is off.
R5 To stop an unpaid link from being paid, call Cancel Payment. A cancelled order_id cannot be reused (error 28).

Flow diagram

Your server

Allpay

Customer

1. Your server to Allpay: POST getpayment (signed)
2. Allpay to Your server (response): payment_url
3. Your server to Customer: Redirect to payment_url
4. Customer to Allpay: Enters card on the payment page
5. Allpay to Customer (response): Redirect to success_url
6. Allpay to Your server: Webhook: status, sign
Note at Allpay:
Steps 5 and 6 are independent: the webhook can arrive first
7. Your server to Allpay (response): HTTP 200
Note at Your server:
Verify sign. Fulfill only if status = 1

request response webhook / Allpay-initiated

The payment process follows three steps: (1) send a signed POST request to create a payment link, (2) redirect the customer to the returned payment_url, (3) receive a webhook notification at your webhook_url once payment is complete.

Note One successful payment per API payment URL. After a successful payment, reopening the original payment_url redirects the customer to the payment confirmation page, even before the URL expires. No additional setting is required. While a payment attempt is still being processed, another attempt against the same payment is blocked; a retry is allowed after a confirmed failure. This applies to a specific API payment URL, not to reusable payment links created in the dashboard.

Parameters

Name · Type · Description

Required

order_id^*

string required

Unique order identifier in your system. For non-subscription API payments, the identifier is scoped to the seller and payment page (API login); use a new order_id for each new payment. A new request with an already paid order_id is rejected with error 15. Recurring subscription charges can share the subscription's order_id. Maximum 64 characters; a longer value is rejected with error 2.

items^*

array required

List of products/services. Displayed in your Allpay account and on accounting documents. The total charge is calculated from item prices × quantities.

Field · Type · Required · Description

items[].name^*

string required

Product or service name

items[].qty^*

number required

Quantity

items[].price^*

number required

Unit price, up to 2 decimals — extra decimals are rounded (100.015 → 100.02). VAT must already be included in the price — it is not added on top.

items[].vat^*

integer required

VAT rate included in the price: 0 — no VAT (VAT-exempt), 1 — 18% VAT, 3 — 0% VAT

items[].discount_val

number optional

Discount value — deducted from item price

items[].discount_type

string optional

Whether discount_val is a fixed amount or a percentage: fixed or perc. Required when discount_val is provided.

sign^*

string required

SHA256 signature

currency_display^*

string required

The currency of all amounts in the request (item prices, discounts, amount) — and the currency the customer sees on the payment page. Allpay converts the amounts to currency_payment using Google Finance exchange rates. Examples: ILS, USD, EUR, CAD, AED. Full list of supported currencies → An unknown currency returns error 2. Webhooks and status methods return both currencies — currency_display and currency_payment — together with the rate currency_course.

Optional

currency_payment

string optional

The currency the card is charged in and your account is settled in. If not provided — ILS. If the currency is not enabled for your account (or cannot be charged), the payment is still created and the card is charged in ILS — no error is returned; check currency_payment in the webhook or in Check Payment Status to see the actual charge currency. In v14 and earlier the charge currency is passed as currency; with mode=api16 a non-empty currency returns error 2.

ILS USD EUR

lang

string optional

Payment page language.

AUTO EN HE RU AR ES IT DE FR

button_title

string optional

Text on the payment button.

pay donate subscribe

receipt_type

integer optional

Type of the document issued after a successful payment — applies to one-time payments, token payments, and subscription charges. In v14 and earlier this parameter is called doc_type. Only takes effect if an accounting service (EasyCount or Morning) is connected to your account — if none is connected, the payment is created normally and simply no document is generated (see the receipt field in the webhook). If not provided, the default document type configured in the accounting service's settings is used.

320 — Tax Invoice Receipt

400 — Receipt

405 — Receipt for donation

Warning If explicitly set to 320 or 405, the request fails if your business type is not eligible to issue that document — this check is unrelated to whether an accounting service is connected.

skip_receipt

integer optional

Do not issue a document (receipt / invoice) for this particular payment, even though an accounting service is connected.
With 1: no document is issued after the payment, the receipt field of the webhook and Payment Status stays empty, the customer's success page shows no «Download receipt» button, and no refund document is issued for refunds and chargebacks of this payment either. You can still issue a document manually for such a payment from the Allpay dashboard. Accepts 0 / 1 or false / true; any other value returns error 2.

0 — the usual behaviour: the document is issued if an accounting service is connected

1 — do not issue a document for this payment

test_mode

integer optional

Usually not needed: test or live is decided by the Test mode switch of the integration, not by your code — see Test Mode. The parameter can only turn test mode on for this request: while the switch is on, every payment of this login is a test payment whatever you send.

1 — test payment, real cards are not charged

0 — the integration's setting (same as not sending the parameter)

webhook_url

string optional

After a successful or failed payment, Allpay sends a POST webhook with payment details to this URL. If not provided, the transaction will be visible only in your Allpay dashboard.

success_url

string optional

The customer is redirected to this URL after successful payment. If not provided, the customer is redirected to the default Allpay success page.

backlink_url

string optional

URL for the "Return to site" button displayed at the bottom of the payment page — allows the customer to return to your checkout. Note: there is no fail URL — payment errors are displayed directly on the payment page, prompting the customer to make a new attempt.

inst

integer optional

Max installment payments offered (1–12)

inst_fixed

integer optional

0 — customer chooses from 1 up to the inst value

1 — number of payments is fixed at the inst value; customer cannot change it

allpay_token

string optional

Charge a card using a saved token — the customer does not need to re-enter card details. The payment is processed immediately and the result is returned synchronously in the API response. A webhook is sent to webhook_url (if provided), same as for regular payments. Use a new, unique order_id for each charge — do not reuse order_ids across recurring charges. On success: {"order_id","status":1}. On failure: {"error_code","error_msg"}. Together with preauthorize: 1 the amount is reserved (J5) instead of charged — see Pre-authorize.

force_3ds

integer optional

New in v16

Require 3-D Secure for this payment whatever its amount — for example, for the first payment with a new card or when your risk checks flag the order. Works on the payment page and in Hosted Fields; without it, 3-D Secure follows the amount threshold set in the Allpay app. Not available with allpay_token (error 2): a token charge runs without the customer, so nobody could pass the check. Ignored in test mode — test payments never go through 3-D Secure.

1 — always require 3-D Secure

0 — by the amount threshold of the account

preauthorize

integer optional

Creates a J5 pre-authorization — the amount is reserved on the customer's card for up to 168 hours (7 days), but no charge is made. To collect the funds, a separate Charge Pre-auth request must be sent within this period.

1 — J5 pre-authorization

0 — regular payment (default)

Warning Any non-empty value other than 0, "0", false or null turns J5 on — including the string "false". For a regular payment pass 0 or leave the parameter out. JSON true also works, but is signed as 1 — see value rules.

subscription

object optional

Add to create a recurring subscription. See Create Subscription.

client_name

string optional

Customer's full name (any language). If not provided, the customer will be asked to enter it on the payment page. Required when using Hosted Fields integration.

client_email

string optional

Customer's email address. Used to send an invoice if an accounting service (EasyCount or Morning) is connected. If not provided, the customer will be asked to enter it on the payment page. With Hosted Fields integration, client_email or client_phone is required; without an email the invoice is not sent to the customer by email.

client_phone

string optional

Customer's phone number. With Hosted Fields integration, required when client_email is not provided.

client_tehudat

string optional

For private customers — Social ID (Tehudat Zehut); for companies — Company Number (Mispar Het Pey). Pass "000000000" to hide this field and skip the ID request for non-Israeli customers.

show_applepay

integer optional

The Apple Pay button is shown automatically whenever the Apple Pay module is active on your account. This parameter is only needed to hide it for this payment request.

0 — hide the button

1 — show the button (same as not sending the parameter)

If the parameter is sent, any value other than 1 hides the button. JSON true / false also work and are signed as 1 / 0 — see value rules.

show_googlepay

integer optional

The Google Pay button is shown automatically whenever the Google Pay module is active on your account. This parameter is only needed to hide it for this payment request.

0 — hide the button

1 — show the button (same as not sending the parameter)

If the parameter is sent, any value other than 1 hides the button. JSON true / false also work and are signed as 1 / 0 — see value rules.

show_bit

integer optional

The Bit button is shown automatically whenever the Bit module is active on your account. This parameter is only needed to hide it for this payment request.

0 — hide the button

1 — show the button (same as not sending the parameter)

If the parameter is sent, any value other than 1 hides the button. JSON true / false also work and are signed as 1 / 0 — see value rules.

add_field_1

string optional

Any additional data about the order or customer, e.g. your checkout or customer ID — returned unchanged in the webhook sent to the webhook_url specified in this request.

add_field_2

string optional

A second custom value — returned unchanged in the webhook sent to the webhook_url specified in this request.

expire

integer optional

Unix timestamp when the payment link expires (default: 1 week)

Response

Redirect flow (no allpay_token):

Field · Type · Description

payment_url

string

URL to redirect the customer to

test_mode

integer

New in v16

Mode of the created payment, in both flows — see Test Mode.

1 — test payment

0 — live payment

Token payment flow (allpay_token provided) — on success:

Field · Type · Description

order_id

string

Order identifier

status

integer

1 — charge successful

test_mode

integer

New in v16

Mode of the payment: 1 — test, 0 — live

A webhook is sent to webhook_url (if provided) — identical in structure to webhooks from regular (redirect-flow) payments.

On failure:

Field · Type · Description

error_code

integer

Error code from the payment processor

error_msg

string

Human-readable error description

Show example · request and response

Response

// Redirect flow
{ "payment_url": "https://allpay.to/~login/pay/?payment_id=abc123&code=xyz", "test_mode": 0 }

// Token flow — success
{ "order_id": "ORDER-001", "status": 1, "test_mode": 0 }

// Token flow — failure
{ "error_code": 12, "error_msg": "Payment declined" }

cURL

curl "https://allpay.to/app/?show=getpayment&mode=api16" \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{
    "login": "your_login",
    "order_id": "ORDER-001",
    "items": [{
      "name": "Product A",
      "qty": 1,
      "price": 100,
      "vat": 1
    }],
    "currency_display": "ILS",
    "webhook_url": "https://yoursite.com/webhook",
    "sign": "YOUR_COMPUTED_SIGN"
  }'

Node.js

const crypto = require('crypto');

const isEmpty = v => v === '' || v === null || v === undefined;
const allpayValue = v => v === true ? '1' : v === false ? '0' : String(v);

function allpaySign(data, apiKey) {
  const chunks = [];
  for (const key of Object.keys(data).sort()) {
    const val = data[key];
    if (key === 'sign' || isEmpty(val)) continue;
    if (typeof val === 'object') {
      const list = Array.isArray(val) ? val : Object.keys(val).sort().map(k => val[k]);
      for (const item of list) {
        if (item !== null && typeof item === 'object') {
          for (const k of Object.keys(item).sort())
            if (!isEmpty(item[k])) chunks.push(allpayValue(item[k]));
        } else if (!isEmpty(item)) chunks.push(allpayValue(item));
      }
    } else chunks.push(allpayValue(val));
  }
  chunks.push(apiKey);
  return crypto.createHash('sha256').update(chunks.join(':')).digest('hex');
}

const body = {
  login: 'your_login',
  order_id: 'ORDER-001',
  items: [{ name: 'Product A', qty: 1, price: 100, vat: 1 }],
  currency_display: 'ILS',
  webhook_url: 'https://yoursite.com/webhook'
};
body.sign = allpaySign(body, 'YOUR_API_KEY');

const res = await fetch('https://allpay.to/app/?show=getpayment&mode=api16', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify(body)
});
const { payment_url } = await res.json();

PHP

function allpay_value($v) {
  if (is_bool($v)) return $v ? '1' : '0';
  if (is_float($v)) return json_encode($v);
  return $v;
}

function allpay_sign(array $data, string $api_key): string {
  ksort($data);
  $chunks = [];
  foreach ($data as $key => $val) {
    if ($key === 'sign' || $val === '' || $val === null) continue;
    if (is_array($val)) {
      ksort($val);
      foreach ($val as $item) {
        if (is_array($item)) {
          ksort($item);
          foreach ($item as $v) if ($v !== '' && $v !== null) $chunks[] = allpay_value($v);
        } elseif ($item !== '' && $item !== null) { $chunks[] = allpay_value($item); }
      }
    } else { $chunks[] = allpay_value($val); }
  }
  $chunks[] = $api_key;
  return hash('sha256', implode(':', $chunks));
}

$body = [
  'login'    => 'your_login',
  'order_id' => 'ORDER-001',
  'items'    => [[
    'name' => 'Product A', 'qty' => 1,
    'price' => 100,       'vat' => 1
  ]],
  'currency_display' => 'ILS',
  'webhook_url'      => 'https://yoursite.com/webhook'
];
$body['sign'] = allpay_sign($body, 'YOUR_API_KEY');

$ch = curl_init('https://allpay.to/app/?show=getpayment&mode=api16');
curl_setopt_array($ch, [
  CURLOPT_POST           => true,
  CURLOPT_POSTFIELDS     => json_encode($body),
  CURLOPT_HTTPHEADER     => ['Content-Type: application/json'],
  CURLOPT_RETURNTRANSFER => true
]);
$response = json_decode(curl_exec($ch), true);
$payment_url = $response['payment_url'];

Python

import hashlib, requests

def is_empty(v): return v is None or v == ''

def allpay_value(v):
    if v is True: return '1'
    if v is False: return '0'
    if isinstance(v, float) and v.is_integer(): return str(int(v))
    return str(v)

def allpay_sign(data: dict, api_key: str) -> str:
    chunks = []
    for key in sorted(data):
        val = data[key]
        if key == 'sign' or is_empty(val): continue
        if isinstance(val, (list, dict)):
            items = val if isinstance(val, list) else [val[k] for k in sorted(val)]
            for item in items:
                if isinstance(item, dict):
                    chunks += [allpay_value(item[k]) for k in sorted(item) if not is_empty(item[k])]
                elif not is_empty(item): chunks.append(allpay_value(item))
        else: chunks.append(allpay_value(val))
    chunks.append(api_key)
    return hashlib.sha256(':'.join(chunks).encode('utf-8')).hexdigest()

body = {
    'login': 'your_login',
    'order_id': 'ORDER-001',
    'items': [{'name': 'Product A', 'qty': 1,
               'price': 100, 'vat': 1}],
    'currency_display': 'ILS',
    'webhook_url': 'https://yoursite.com/webhook'
}
body['sign'] = allpay_sign(body, 'YOUR_API_KEY')
res = requests.post('https://allpay.to/app/?show=getpayment&mode=api16', json=body)
payment_url = res.json()['payment_url']

Token charge

# cURL
curl "https://allpay.to/app/?show=getpayment&mode=api16" \
  -X POST -H "Content-Type: application/json" \
  -d '{
    "login": "your_login",
    "order_id": "ORDER-002",
    "items": [{"name": "Monthly CRM plan", "qty": 1, "price": 49.00, "vat": 1}],
    "currency_display": "ILS",
    "allpay_token": "TOKEN_VALUE",
    "sign": "YOUR_COMPUTED_SIGN"
  }'

// Node.js
const body = {
  login: 'your_login',
  order_id: 'ORDER-002',
  items: [{ name: 'Monthly CRM plan', qty: 1, price: 49.00, vat: 1 }],
  currency_display: 'ILS',
  allpay_token: 'TOKEN_VALUE'
};
body.sign = allpaySign(body, 'YOUR_API_KEY');
const res = await (await fetch('https://allpay.to/app/?show=getpayment&mode=api16', {
  method: 'POST', headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify(body)
})).json();
// success: { order_id, status: 1 }
// failure: { error_code, error_msg }

// PHP
$body = [
  'login'        => 'your_login',
  'order_id'     => 'ORDER-002',
  'items'        => [['name' => 'Monthly CRM plan', 'qty' => 1, 'price' => 49.00, 'vat' => 1]],
  'currency_display' => 'ILS',
  'allpay_token'     => 'TOKEN_VALUE'
];
$body['sign'] = allpay_sign($body, 'YOUR_API_KEY');
// POST to https://allpay.to/app/?show=getpayment&mode=api16
// success: ['order_id' => ..., 'status' => 1]
// failure: ['error_code' => 12, 'error_msg' => '...']

Payments

Payment Webhook

Key rules

R1 Verify the signature before processing. A payment is confirmed only when status == 1.
R2 Outside subscriptions, a repeated successful webhook with the same order_id is the same payment: acknowledge it, but do not fulfill it again.
R3 All charges of a subscription have the same order_id, so do not deduplicate them by order_id.

Allpay sends a POST request with Content-Type: application/json and a JSON body to your webhook_url after every payment attempt — both successful and failed. Respond with HTTP 200 to acknowledge. Allpay makes up to 10 delivery attempts total — the first retry 1 minute after the initial failure, then with progressively increasing intervals, with the final attempt within 24 hours.

Required check Always verify the signature before processing. A payment is confirmed only when status == 1.

Note Payment identity and repeat delivery. The payment webhook does not currently include the transaction_id returned by List Transactions. For a non-subscription API payment on the same seller account and payment page (API login), repeated successful notifications with the same order_id refer to the same payment: acknowledge them with HTTP 200, but do not fulfil the order again. Failed attempts (status = 0) and a later success (status = 1) are different outcomes, so do not discard a success just because you previously received a failure for that order. Subscription charges are an exception: multiple successful charges share the same order_id, so do not use order_id alone to deduplicate subscription payments. For your own tracking, pass add_field_1 and add_field_2 in the creation request together with webhook_url; these custom values are echoed unchanged and are not Allpay transaction IDs.

Payload Fields

Field · Type · Description

order_id

string

Your order identifier

status

integer

0 — unpaid / failed

1 — successful

amount

number

Payment amount after discounts, in the display currency (currency_display). It is in the display currency in every webhook.

currency_display

string

Display currency — the currency of amount and of the item prices

currency_payment

string

The currency the card is charged in: ILS / USD / EUR

currency_course

number

Exchange rate of this payment from the display currency to the charge currency, fixed when the payment was created; 1 when both currencies are the same. Amount charged in currency_payment = amount × currency_course, to the agora. Also sent in the Chargeback Webhook and the Capture Token webhook.

subscription_create

integer

Present only in webhooks where no money was charged: subscription creation with a deferred start, and Capture Token. Absent from every webhook that reports an actual charge.

0 — card saved, no subscription created

1 — subscription created, first charge scheduled

name

string

Order name — the name from the request, or the first item's name

items

array

Positions of the order, with the same fields as in the request (name, qty, price, vat, …). Not present in webhooks about a payment page error.

error

string

Reason the payment attempt failed. Present only when status is 0. The decline reason in English (the same as decline_reason, Payment declined when no code is available).

decline_code

integer

Numeric decline code, for telling decline reasons apart (blocked card, expired card, etc.) without parsing error — see Decline codes. Present only with status = 0 when a code is available.

decline_reason

string

Decline reason in English for decline_code; Payment declined for a code not listed in Decline codes. Present together with decline_code.

inst

integer

Number of installment payments

preauth

string

Present only for a J5 pre-authorization. With status = 1 it tells a reservation from a charge:

authorized — the amount is reserved, not charged yet

captured — the reservation was charged with Charge Pre-auth

captured_amount

number

Present only with preauth = captured: the amount charged, in the same currency as amount.

method

string

Payment method. card also covers payments that failed before a method was chosen.

card bit applepay googlepay

card_mask

string

Masked card number, e.g. 465901******7049

card_brand

string

Visa / Mastercard / AmEx / Diners

card_exp

string

New in v16

Card expiry date in MMYY format, e.g. 0829. Absent when unknown (Bit, some wallet payments).

test_mode

integer

New in v16

Mode of the payment — see Test Mode. Do not ship or issue documents for a test payment.

1 — test payment

0 — live payment

foreign_card

integer

0 — local card (issued by an Israeli bank)

1 — foreign card

receipt

string

URL to the digital receipt. Generated only if an accounting service (EasyCount or Morning) is connected in your Allpay account.

client_name

string

Customer name

client_email

string

Customer email

client_phone

string

Customer phone

client_tehudat

string

Customer Social ID (if provided)

add_field_1

string

Custom data from request (unchanged)

add_field_2

string

Custom data from request (unchanged)

sign

string

SHA256 signature — verify using your API key

Security Verify the signature over the payload exactly as received, with the same signature function you use for requests — every field except sign takes part, including items and any field not listed above. Fields without a value are not sent, so the payload never contains null. Amounts (amount, item prices) are rounded to 2 decimals. Numbers follow the value rules: 100.00 is signed as 100.

Important: status = 0 in a webhook means that this payment attempt failed. It does not mean the order is permanently cancelled — the customer may still retry payment on the same payment page. Fulfill the order only when status = 1 and the signature is valid.

Show code example

Payload

{
  "order_id":      "ORDER-001",
  "status":       1,
  "amount":       100.00,
  "currency_display": "ILS",
  "currency_payment": "ILS",
  "currency_course":  1,
  "inst":         1,
  "method":       "card",
  "card_mask":    "465901******7049",
  "card_brand":   "Visa",
  "card_exp":  "0829",
  "test_mode":    0,
  "foreign_card": 0,
  "client_name":  "Joe Doe",
  "client_email": "joe@example.com",
  "add_field_1":  "your-data",
  "sign":         "abc123..."
}

Verify (PHP)

$payload = json_decode(file_get_contents('php://input'), true) ?: [];
$received_sign = (string)($payload['sign'] ?? '');

// Verify signature first
$expected = allpay_sign($payload, 'YOUR_API_KEY');
if (!hash_equals($expected, $received_sign)) {
  http_response_code(400);
  exit;
}

// Fulfill order only on successful payment
if ((int)$payload['status'] === 1) {
  fulfill_order($payload['order_id'], $payload['amount']);
}

// Always acknowledge receipt — including failed payment attempts
http_response_code(200);
echo 'OK';

Verify (JS)

app.post('/webhook', (req, res) => {
  const payload = req.body || {};
  const expected = allpaySign(payload, 'YOUR_API_KEY');
  const received = typeof payload.sign === 'string' ? payload.sign : '';

  // Timing-safe comparison; timingSafeEqual throws on different lengths, so check the length first
  if (received.length !== expected.length ||
      !crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(received))) {
    return res.sendStatus(400);
  }

  if (payload.status === 1) {
    fulfillOrder(payload.order_id, payload.amount);
  }

  // Always respond 200 — including failed payment attempts
  res.sendStatus(200);
});

Payments

Chargeback Webhook

Allpay sends a separate POST request to the same webhook_url when the card issuer charges an order back, and again if that chargeback is later reverted. Delivery, retries and signature work exactly as for the Payment Webhook.

Warning Distinguish this webhook by the type field.

Payload Fields

Field · Type · Description

type

string

chargeback — the issuer withdrew the money from you

chargeback_revert — a previous chargeback was cancelled and the money returned to you

status

integer

State of the original order, the same value Check Payment Status would return at that moment.

1 — nothing withdrawn from the order

3 — the whole order has been charged back or refunded

4 — partially charged back or refunded

amount

number

Amount of this operation — how much was withdrawn (chargeback) or returned (chargeback_revert). Always positive.

refunded

number

Total already charged back or refunded on this order, including the current operation.

order_amount

number

Full charged amount of the original order (order sum minus any discount).

currency_display, currency_payment, currency_course

string / number

The currencies and the exchange rate of the original order, as in the Payment Webhook. The amounts of this webhook are already in currency_payment; the order amount in the display currency is order_amount / currency_course.

order_id

string

Your order identifier. Present when the original payment was created via the API.

name

string

Name of the original order

items

array

Positions of the original order.

receipt

string

URL to the document issued for this operation (negative receipt for a chargeback).

receipt_tax

string

Link to the credit tax invoice.

method

string

Payment method of the original payment. Present for payments created through v15 and later.

card bit applepay googlepay

card_mask

string

Masked card number of the original payment

card_brand

string

Visa / Mastercard / AmEx / Diners

card_exp

string

New in v16

Expiry date of the card of the original payment, MMYY. Absent when unknown.

test_mode

integer

New in v16

Mode of the payment.

1 — test payment

0 — live payment

foreign_card

integer

0 — local card (issued by an Israeli bank)

1 — foreign card

client_name

string

Customer name

client_email

string

Customer email

client_phone

string

Customer phone

client_tehudat

string

Customer Social ID (if provided)

add_field_1

string

Custom data from the original request (unchanged)

add_field_2

string

Custom data from the original request (unchanged)

sign

string

SHA256 signature — verify using your API key

Show code example

Payload

// Full chargeback of a 100.00 ILS order
{
  "type":         "chargeback",
  "status":       3,
  "amount":       100.00,
  "refunded":     100.00,
  "order_amount": 100.00,
  "currency_display": "ILS",
  "currency_payment": "ILS",
  "currency_course":  1,
  "order_id":     "ORDER-001",
  "method":       "card",
  "card_mask":    "465901******7049",
  "card_brand":   "Visa",
  "foreign_card": 0,
  "client_name":  "Joe Doe",
  "sign":         "abc123..."
}

// The same chargeback later reverted — status stays 3
{
  "type":         "chargeback_revert",
  "status":       3,
  "amount":       100.00,
  "refunded":     100.00,
  "order_amount": 100.00,
  "currency_display": "ILS",
  "currency_payment": "ILS",
  "currency_course":  1,
  "order_id":     "ORDER-001",
  "sign":         "abc123..."
}

Handle (PHP)

$payload = json_decode(file_get_contents('php://input'), true) ?: [];

// Verify the signature exactly as for a payment webhook
$expected = allpay_sign($payload, 'YOUR_API_KEY');
if (!hash_equals($expected, (string)($payload['sign'] ?? ''))) {
  http_response_code(400);
  exit;
}

switch ($payload['type'] ?? '') {

  case 'chargeback':
    // Money withdrawn: block the order, open a dispute
    on_chargeback($payload['order_id'], $payload['amount']);
    break;

  case 'chargeback_revert':
    // Dispute won: money is back
    on_chargeback_revert($payload['order_id'], $payload['amount']);
    break;

  default:
    // No "type" — this is a regular payment webhook
    if ((int)$payload['status'] === 1) {
      fulfill_order($payload['order_id'], $payload['amount']);
    }
}

http_response_code(200);
echo 'OK';

Payments

Check Payment Status

POSThttps://allpay.to/app/?show=paymentstatus&mode=api16

Check the status of a payment. Call at least 2 seconds after the payment attempt.

Tip No answer to a token charge? If a Create Payment request with allpay_token timed out, check the same order_id here. Error 6 — the request never reached Allpay, nothing was charged or reserved. status: 0 without error — still processing, check again. status: 1 — charged; with preauth: authorized — reserved: to release the reservation call Refund. status: 0 with decline_code — declined. Keep checking for 10–15 minutes: a late answer from the card processor can still turn a timed-out request into a charge or a reservation.

Parameters

Name · Type · Description

order_id^*

string required

Order identifier

sign^*

string required

SHA256 signature

Response

Field · Type · Description

order_id

string

Order identifier

status

integer

0 — unpaid / not yet completed (payment attempt may have failed; customer can still retry)

1 — successful

3 — refunded

4 — partially refunded (the response also contains the refunded field)

cancelled

integer

New in v16

1 — the payment link was cancelled with Cancel Payment and can no longer be paid. Returned only together with status: 0.

amount

number

Payment amount in the display currency (currency_display), before discounts

refunded

number

Refunded part of the payment, in the same currency as amount. Returned only when status is 4 (partial refund) — the field is absent for all other statuses. Once the whole charged sum (amount minus any discount applied to the order) has been refunded, the status becomes 3 and the field is no longer returned.

error

string

Error message from the last failed payment attempt (e.g. card declined, insufficient funds). Returned only when status is not 1 and a failed attempt was recorded for the order. The decline reason in English (the same as decline_reason, Payment declined when no code is available).

decline_code

integer

Numeric decline code of the last failed attempt — use it to tell decline reasons apart without parsing error, see Decline codes. Returned only together with error and only when a code is available.

decline_reason

string

Decline reason in English for decline_code; Payment declined for a code not listed in Decline codes. Returned together with decline_code.

discount

number

Total discount of the order in the display currency. Returned only when the order has a discount.

currency_display

string

Display currency — the currency of amount and discount

currency_payment

string

The currency the card is charged in: ILS / USD / EUR

currency_course

number

Exchange rate of this payment from the display currency to the charge currency, fixed when the payment was created; 1 when both currencies are the same. Amount charged in currency_payment = (amount − discount) × currency_course, to the agora.

inst

integer

Installment count

preauth

string

Returned only for a J5 pre-authorization that has been authorized — absent for regular payments. Use it to check whether a reservation was charged, e.g. after a timeout of Charge Pre-auth.

authorized — reserved, not charged yet

captured — charged

voided — reservation cancelled with Refund (status 3)

expired — not charged within 168 hours, can no longer be charged

captured_amount

number

Returned only with preauth = captured: the amount charged, in the same currency as amount.

method

string

Payment method. For an order without a payment attempt — card.

card bit applepay googlepay

card_mask

string

Masked card number

card_brand

string

Card brand

card_exp

string

New in v16

Card expiry date in MMYY format, e.g. 0829. Absent when unknown (Bit, some wallet payments).

test_mode

integer

New in v16

Mode of the payment — see Test Mode.

1 — test payment

0 — live payment

foreign_card

integer

0 — local card (issued by an Israeli bank)

1 — foreign card

receipt

string

URL to the digital receipt. Generated only if an accounting service (EasyCount or Morning) is connected in your Allpay account.

client_name / email / phone / tehudat

string

Customer details

Show example · request and response

Response

{
  "order_id":      "ORDER-001",
  "status":       1,
  "amount":       100.00,
  "inst":         1,
  "currency_display": "ILS",
  "currency_payment": "ILS",
  "currency_course":  1,
  "method":       "card",
  "foreign_card": 0,
  "card_mask":    "465901******7049",
  "card_brand":   "Visa",
  "card_exp":  "0829",
  "test_mode":    0,
  "receipt":      "",
  "client_name":  "Joe Doe",
  "client_email": "joe@example.com",
  "client_phone": "+972501234567",
  "client_tehudat": "123456789"
}

// Partially refunded payment (status 4) — "refunded" is added
{
  "order_id":      "ORDER-001",
  "status":       4,
  "amount":       100.00,
  "refunded":     30.00,
  "inst":         1,
  "currency_display": "ILS",
  "currency_payment": "ILS",
  "currency_course":  1,
  "method":       "card",
  "foreign_card": 0,
  "card_mask":    "465901******7049",
  "card_brand":   "Visa",
  "card_exp":  "0829",
  "test_mode":    0,
  "receipt":      "",
  "client_name":  "Joe Doe",
  "client_email": "joe@example.com",
  "client_phone": "+972501234567",
  "client_tehudat": "123456789"
}

cURL

curl "https://allpay.to/app/?show=paymentstatus&mode=api16" \
  -X POST -H "Content-Type: application/json" \
  -d '{
    "login": "your_login",
    "order_id": "ORDER-001",
    "sign": "YOUR_COMPUTED_SIGN"
  }'

PHP

$body = [
  'login'    => 'your_login',
  'order_id' => 'ORDER-001'
];
$body['sign'] = allpay_sign($body, 'YOUR_API_KEY');
// POST to https://allpay.to/app/?show=paymentstatus&mode=api16
// $response['status']: 0=unpaid, 1=paid, 3=refunded, 4=partial refund
// on status 4 the response also contains $response['refunded'] — the refunded part

Node.js

const body = {
  login: 'your_login', order_id: 'ORDER-001'
};
body.sign = allpaySign(body, 'YOUR_API_KEY');
const { status, amount, refunded, currency_display } = await (await fetch('https://allpay.to/app/?show=paymentstatus&mode=api16', {
  method: 'POST', headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify(body)
})).json();
// status: 0=unpaid, 1=paid, 3=refunded, 4=partial refund
// refunded is present only when status === 4

Payments

Refund Payment

POSThttps://allpay.to/app/?show=refund&mode=api16

Key rules

R1 Pass exactly one of amount, items or refund_all: 1. A request without them, or with amount that is 0 or not a number, is rejected with error 2 — nothing is refunded.
R2 An uncaptured J5 reservation is always voided in full: amount and items are ignored.

Issue a full or partial refund. The refunded sum is taken from amount, from items when you refund specific positions, or is the whole remaining part of the order with refund_all: 1. Refunds are processed from your available withdrawal balance.

Parameters

Name · Type · Description

order_id^*

string required

Order identifier

amount

number optional

Refund amount, up to 2 decimals (e.g. 100.00; a string such as "100.00" is also accepted) — the sum actually returned to the customer, in the currency the payment was charged in. Pass a smaller value than the order amount for a partial refund. Must not exceed the part of the order that has not been refunded yet. Must be a positive number: 0, an empty string or text return error 2. Not combined with items or refund_all.

Warning For an uncaptured J5 reservation the whole reservation is voided whatever you pass in amount, items or refund_all.

refund_all

integer optional

New in v16

Refund the whole remaining part of the order, or void an uncaptured J5 reservation. Not combined with amount or items. Until v16 this was what a request without amount did.

1 — full refund of the remaining part

sign^*

string required

SHA256 signature

items

array optional

For a refund by item: array matching the original items count and order. Each object has one field: amount (number). Use 0 to skip an item. The refund total is the sum of its values, subject to the same limit as amount. Not combined with amount or refund_all.

Response

Field · Type · Description

order_id

string

Order identifier

msg

string

Human-readable result message, e.g. The amount will be refunded to the customer's card within 7 business days.

status

integer

3 — fully refunded

4 — partially refunded

receipt

string

Link to the refund receipt (negative receipt). Present only when refund documents were created — i.e. the original payment has a receipt issued via a connected accounting service (EasyCount or Morning).

receipt_tax

string

Link to the credit tax invoice. Present only for VAT-registered businesses, which receive two refund documents: a credit tax invoice and a negative receipt.

Show example · request and response

Response

{
  "order_id":    "ORDER-001",
  "msg":         "The amount will be refunded to the customer's card within 7 business days.",
  "status":      3,
  "receipt":     "https://...",
  "receipt_tax": "https://..."
}

// receipt / receipt_tax are included only when refund documents
// were created (an accounting service — EasyCount or Morning — is connected).
// receipt_tax is issued only for VAT-registered businesses.

cURL

# Full refund — amount equals the order total
curl "https://allpay.to/app/?show=refund&mode=api16" \
  -X POST -H "Content-Type: application/json" \
  -d '{
    "login": "your_login",
    "order_id": "ORDER-001",
    "amount": 100.00,
    "sign": "YOUR_COMPUTED_SIGN"
  }'

PHP

// Partial refund: return 200.00 of a larger order
$body = [
  'login'    => 'your_login',
  'order_id' => 'ORDER-001',
  'amount'   => 200.00
];
$body['sign'] = allpay_sign($body, 'YOUR_API_KEY');
// POST to https://allpay.to/app/?show=refund&mode=api16
// The order status becomes 4 (partially refunded) while a refundable part remains.

Node.js

// Full refund of whatever has not been refunded yet
const body = {
  login: 'your_login', order_id: 'ORDER-001',
  refund_all: 1
};
body.sign = allpaySign(body, 'YOUR_API_KEY');
const { status } = await (await fetch('https://allpay.to/app/?show=refund&mode=api16', {
  method: 'POST', headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify(body)
})).json();
// status 3 = fully refunded, 4 = partially refunded

PaymentsNew in v16

Cancel Payment

POSThttps://allpay.to/app/?show=cancelpayment&mode=api16

Key rules

R1 Only an unpaid payment link can be cancelled. A paid order returns error 15 — use Refund.
R2 A cancelled order_id cannot be used again: Create Payment and Capture Token return error 28.
R3 Calling it again for a cancelled link returns the same successful response.

Cancel a payment link created with Create Payment or Capture Token before the customer pays — for example, when the order was cancelled on your site or its price changed. The customer who opens the link sees that payment is no longer available, and a page that was already open can no longer start a payment. No webhook is sent: the response is the confirmation.

Warning While the customer is completing a payment (3-D Secure, Bit, Apple Pay, Google Pay), the link cannot be cancelled: error 27 — check Check Payment Status a little later. A J5 reservation that is already authorized is not cancelled here: release it with Refund.

Parameters

Name · Type · Description

order_id^*

string required

Order identifier of the link to cancel

sign^*

string required

SHA256 signature

Response

Field · Type · Description

order_id

string

Order identifier

status

integer

Always 0 — not paid

cancelled

integer

Always 1 — the link is cancelled. Check Payment Status returns the same field.

Errors: 6 — order not found, 15 — already paid, 27 — cannot be cancelled (a token charge, or the customer is paying right now).

Show example · request and response

Response

{
  "order_id": "ORDER-001",
  "status": 0,
  "cancelled": 1
}

cURL

curl "https://allpay.to/app/?show=cancelpayment&mode=api16" \
  -X POST -H "Content-Type: application/json" \
  -d '{
    "login": "your_login",
    "order_id": "ORDER-001",
    "sign": "YOUR_COMPUTED_SIGN"
  }'

PHP

$body = [
  'login'    => 'your_login',
  'order_id' => 'ORDER-001'
];
$body['sign'] = allpay_sign($body, 'YOUR_API_KEY');
// POST to https://allpay.to/app/?show=cancelpayment&mode=api16
// $response['cancelled'] === 1 — the link can no longer be paid

Node.js

const body = {
  login: 'your_login', order_id: 'ORDER-001'
};
body.sign = allpaySign(body, 'YOUR_API_KEY');
const res = await (await fetch('https://allpay.to/app/?show=cancelpayment&mode=api16', {
  method: 'POST', headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify(body)
})).json();
// res.cancelled === 1, or res.error_code (15 — already paid, 27 — try later)

Subscriptions

Create and manage recurring billing. Currently, only monthly frequency is supported. Requires the Subscriptions module to be active on your account.

Subscriptions

Create Subscription

POSThttps://allpay.to/app/?show=getpayment&mode=api16

Key rules

R1 With a deferred start, the first webhook has status = 1 and amount = 0: the card was saved, nothing was charged. Do not fulfill the order on it.
R2 A subscription can include only one item in items (error 18).

Flow diagram

Your server

Allpay

Customer

1. Your server to Allpay: POST getpayment + subscription
2. Allpay to Your server (response): payment_url
3. Your server to Customer: Redirect to payment_url
4. Customer to Allpay: Pays the first charge (deferred start: only saves the card)
5. Allpay to Your server: Webhook status = 1 (amount = 0 with a deferred start)
Note at Allpay:
Daily batch, Israel time: one charge a month
6. Allpay to Your server: Webhook for every charge — same order_id

request response webhook / Allpay-initiated

Same as Create Payment but with an additional subscription object. Returns a payment_url for the customer to authorize the first charge. Subsequent charges happen automatically each month with webhooks sent for each. If the subscription object is omitted, the request is processed as a regular one-time payment.

Warning With start_type=2 or start_type=3, the first charge is deferred, so the card is not sent to the issuing bank for authorization when the customer submits the payment page. This means an incorrect card number will pass this step and the subscription will be created successfully — the error will only surface later, when the first scheduled charge is attempted. To confirm the card is valid up front, use start_type=1 so the first charge happens immediately on the payment page.

subscription object

Name · Type · Description

start_type^*

integer required

When first charge occurs:

1 — immediately (the customer is charged when they complete the payment page)

2 — specific date (start_date)

3 — after N days (start_n)

start_date

integer optional

Unix timestamp (required if start_type=2). Only the date part is used — see note below.

start_n

integer optional

Number of days (required if start_type=3)

end_type^*

integer required

When subscription ends:

1 — infinite

2 — specific date (end_date)

3 — after N charges (end_n)

end_date

integer optional

Unix timestamp (required if end_type=2). Only the date part is used — see note below.

end_n

integer optional

Number of charges (required if end_type=3). Minimum 1: with end_n=1 and start_type=1 the customer is charged once on the payment page and the subscription completes immediately; with a deferred start the single charge occurs on the scheduled date.

Warning start_date / end_date select a calendar day, not an exact moment. Charges are not triggered at the exact second the timestamp represents. Instead, a daily batch job (running once a day, Israel time) charges every subscription whose scheduled date has arrived or already passed. The time-of-day portion of the timestamp is stored and returned in API responses (the dashboard shows only the date of the next charge), but it has no effect on when the charge actually runs. A practical consequence: if start_date is set to a time on the same calendar day the subscription is created, and that day's batch has already run, the first charge is postponed to the next day's batch — it is not executed later that same day. To guarantee same-day behavior, use start_type=1 (immediate); for a scheduled first charge, set start_date to the next calendar day or later.

Note: The Subscriptions module must be enabled for your account before subscriptions can be created via the API. If it is not, the request fails with error 22 — Subscriptions module is not enabled for this account. For live subscriptions the module also needs a current paid period; for test payments (test_mode = 1) it only has to be switched on.

Note: Subscriptions can include only one item in the items array (see error 18). If you need to describe multiple components, combine them into one item name or manage billing on your side using tokens.

Additional top-level parameter

Name · Type · Description

button_title

string optional

Button text. Default for subscriptions is subscribe.

subscribe pay donate

Subscription charge webhooks use the same structure as Payment Webhook. The order_id in every webhook — including the first charge and all recurring charges — is the original subscription order_id. Each successful charge has status = 1; a failed charge has status = 0. There is no field in the webhook payload that identifies the specific recurring charge or distinguishes it from the first charge.

Deferred start — the subscription-creation webhook is not a charge. With any deferred start_type — that is, anything other than 1 — no money is taken when the customer submits their card. Allpay saves the card, creates the subscription, and immediately sends a webhook with status = 1 — which here means the card was saved successfully, not that a payment was made. That webhook carries amount = 0, while the items array still holds the subscription price. Do not fulfill the order on it. Wait for the first charge webhook, which arrives after the scheduled charge, carries the amount actually charged.

Show example · request and response

cURL

curl "https://allpay.to/app/?show=getpayment&mode=api16" \
  -X POST -H "Content-Type: application/json" \
  -d '{
    "login": "your_login",
    "order_id": "SUB-001",
    "items": [{"name": "Monthly Plan", "qty": 1, "price": 49, "vat": 1}],
    "currency_display": "ILS",
    "webhook_url": "https://yoursite.com/webhook",
    "button_title": "subscribe",
    "subscription": {"start_type": 1, "end_type": 1},
    "sign": "YOUR_COMPUTED_SIGN"
  }'

Node.js

const body = {
  login: 'your_login',
  order_id: 'SUB-001',
  items: [{ name: 'Monthly Plan', qty: 1, price: 49, vat: 1 }],
  currency_display: 'ILS',
  webhook_url: 'https://yoursite.com/webhook',
  button_title: 'subscribe',
  subscription: {
    start_type: 1,   // immediately
    end_type:   1    // infinite
  }
};
body.sign = allpaySign(body, 'YOUR_API_KEY');

PHP

$body = [
  'login'    => 'your_login',
  'order_id' => 'SUB-001',
  'items'    => [['name' => 'Monthly Plan', 'qty' => 1, 'price' => 49, 'vat' => 1]],
  'currency_display' => 'ILS',
  'webhook_url' => 'https://yoursite.com/webhook',
  'subscription' => [
    'start_type' => 3, 'start_n' => 7,  // first charge after 7 days
    'end_type'   => 3, 'end_n'   => 12  // cancel after 12 charges
  ]
];
$body['sign'] = allpay_sign($body, 'YOUR_API_KEY');
// POST to https://allpay.to/app/?show=getpayment&mode=api16

Python

body = {
    'login': 'your_login',
    'order_id': 'SUB-001',
    'items': [{'name': 'Monthly Plan', 'qty': 1,
               'price': 49, 'vat': 1}],
    'currency_display': 'ILS',
    'subscription': {
        'start_type': 1, 'end_type': 1
    }
}
body['sign'] = allpay_sign(body, 'YOUR_API_KEY')
# POST to https://allpay.to/app/?show=getpayment&mode=api16

Subscriptions

Cancel Subscription

POSThttps://allpay.to/app/?show=cancelsubscription&mode=api16

Parameters

Name · Type · Description

order_id^*

string required

Subscription order ID

sign^*

string required

SHA256 signature

Response

Field · Type · Description

status

integer

After cancellation you can expect 4 or 2 (subscription was already completed — no cancellation needed).

1 — active

2 — completed

3 — error

4 — cancelled

Show example · request and response

cURL

curl "https://allpay.to/app/?show=cancelsubscription&mode=api16" \
  -X POST -H "Content-Type: application/json" \
  -d '{
    "login": "your_login",
    "order_id": "SUB-001",
    "sign": "YOUR_COMPUTED_SIGN"
  }'

PHP

$body = [
  'login'    => 'your_login',
  'order_id' => 'SUB-001'
];
$body['sign'] = allpay_sign($body, 'YOUR_API_KEY');
// POST to https://allpay.to/app/?show=cancelsubscription&mode=api16
// status 4 = cancelled, 2 = already completed

Node.js

const body = {
  login: 'your_login', order_id: 'SUB-001'
};
body.sign = allpaySign(body, 'YOUR_API_KEY');
const { status } = await (await fetch('https://allpay.to/app/?show=cancelsubscription&mode=api16', {
  method: 'POST', headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify(body)
})).json();
// status 4 = cancelled, 2 = already completed

Subscriptions

Subscription Status

POSThttps://allpay.to/app/?show=subscriptionstatus&mode=api16

Get detailed status and full charge history of a subscription.

Parameters

Name · Type · Description

order_id^*

string required

Subscription order ID

sign^*

string required

SHA256 signature

Response

Field · Type · Description

order_id

string

Subscription ID

status

integer

1 — active

2 — completed

3 — error (last charge failed, retry tomorrow)

4 — cancelled

amount

number

Amount per charge, in the display currency

currency_display

string

Display currency of the subscription — the currency of amount

currency_payment

string

The currency the card is charged in: ILS / USD / EUR

currency_course

number

Current exchange rate from the display currency to the charge currency; every charge is converted at the rate of its date. 1 when both currencies are the same.

payments_n

integer

Number of successful charges

paid_total

number

Total amount charged

payments

array

Charge history: each item has ts (Unix timestamp), amount, receipt (URL)

Show example · request and response

Response

{
  "order_id":    "SUB-001",
  "status":     1,
  "amount":     49.00,
  "currency_display": "ILS",
  "currency_payment": "ILS",
  "currency_course":  1,
  "payments_n": 3,
  "paid_total": 147.00,
  "payments": [
    { "ts": 1748131200, "amount": 49.00, "receipt": "" },
    { "ts": 1745539200, "amount": 49.00, "receipt": "" },
    { "ts": 1742947200, "amount": 49.00, "receipt": "" }
  ]
}

cURL

curl "https://allpay.to/app/?show=subscriptionstatus&mode=api16" \
  -X POST -H "Content-Type: application/json" \
  -d '{
    "login": "your_login",
    "order_id": "SUB-001",
    "sign": "YOUR_COMPUTED_SIGN"
  }'

PHP

$body = [
  'login'    => 'your_login',
  'order_id' => 'SUB-001'
];
$body['sign'] = allpay_sign($body, 'YOUR_API_KEY');
// POST to https://allpay.to/app/?show=subscriptionstatus&mode=api16
// $response['status']: 1=active, 2=completed, 3=error, 4=cancelled
// $response['payments_n'] — successful charges count
// $response['paid_total'] — total charged amount

Node.js

const body = {
  login: 'your_login', order_id: 'SUB-001'
};
body.sign = allpaySign(body, 'YOUR_API_KEY');
const { status, payments_n, paid_total } =
  await (await fetch('https://allpay.to/app/?show=subscriptionstatus&mode=api16',
    { method: 'POST', headers: {'Content-Type':'application/json'}, body: JSON.stringify(body) }
  )).json();
// status: 1=active, 2=completed, 3=error, 4=cancelled

Subscriptions

Subscription Statistics

POSThttps://allpay.to/app/?show=subscriptionsinfo&mode=api16

Statistical breakdown of subscriptions grouped by status.

Parameters

Name · Type · Description

sign^*

string required

SHA256 signature

Response

info — array, one entry per status group:

Field · Type · Description

status

integer

1 — active

2 — completed

3 — error

4 — cancelled

total_n

integer

Number of subscriptions with this status

total_amount

number

Sum of all subscription amounts for this status group

Show example · request and response

Response

{
  "info": [
    { "status": 1, "total_n": 42, "total_amount": 2058.00 },
    { "status": 2, "total_n":  5, "total_amount":  245.00 },
    { "status": 4, "total_n":  7, "total_amount":  343.00 }
  ]
}

cURL

curl "https://allpay.to/app/?show=subscriptionsinfo&mode=api16" \
  -X POST -H "Content-Type: application/json" \
  -d '{
    "login": "your_login",
    "sign": "YOUR_COMPUTED_SIGN"
  }'

PHP

$body = [
  'login' => 'your_login'
];
$body['sign'] = allpay_sign($body, 'YOUR_API_KEY');
// POST to https://allpay.to/app/?show=subscriptionsinfo&mode=api16
// $response['info'][0] = ['status' => 1, 'total_n' => 42, 'total_amount' => 2058.00]

Node.js

const body = { login: 'your_login' };
body.sign = allpaySign(body, 'YOUR_API_KEY');
const { info } = await (await fetch('https://allpay.to/app/?show=subscriptionsinfo&mode=api16', {
  method: 'POST', headers: {'Content-Type': 'application/json'},
  body: JSON.stringify(body)
})).json();
// info[0] = { status: 1, total_n: 42, total_amount: 2058.00 }

Tokens

Save a card without charging, then reuse it for future payments without requiring the customer to re-enter card details.

We recommend using the token API endpoints when building billing for SaaS products. For SaaS services, Allpay's token API endpoints provide more flexible billing management than the Subscriptions API. Once a card token has been obtained, your system can submit it via the API for each new payment while independently determining the amount, date, and conditions of the charge. This allows you to change pricing plans and implement custom recurring payment scenarios that match your product's business model.

Warning Bit and Apple Pay do not support tokenization.

Security Before charging a customer's card using a token, ensure you have their explicit consent. Unauthorized charges may result in withdrawal of your acquiring permission and blocking of your Allpay account. Recommendations for designing a billing interface →

Tokens

Capture Token Without Payment

POSThttps://allpay.to/app/?show=capturetoken&mode=api16

Flow diagram

Your server

Allpay

Customer

1. Your server to Allpay: POST capturetoken
2. Allpay to Your server (response): payment_url
3. Your server to Customer: Redirect to payment_url
4. Customer to Allpay: Saves the card — no charge
5. Allpay to Your server: Webhook with allpay_token
Note at Your server:
Store the token. Have the customer's consent for each charge
6. Your server to Allpay: POST getpayment + allpay_token
7. Allpay to Your server (response): {"order_id","status":1} — synchronous
8. Allpay to Your server: Webhook, same as a regular payment

request response webhook / Allpay-initiated

Creates a card capture session. Returns a payment_url where the customer enters their card details — no charge is made. In case of a successful card capture, Allpay sends a POST webhook to your webhook_url. The webhook includes the allpay_token, which can be used to initiate a new payment or a subscription.

Warning Since no charge is made, the card is never sent to the issuing bank for authorization, so this endpoint cannot verify that the card is valid. A token will be created even for an incorrect card number, and the error will only surface later, when the first real charge against that token is attempted. To confirm a card is valid before saving it for future use, charge it via Create Payment and then retrieve the token for that payment with Get Token.

Parameters

Name · Type · Description

order_id^*

string required

Unique identifier in your system. Use a unique order_id for each capture session — do not reuse an order_id from a previous capture.

items

array optional

Items for display only (no charge). Only name field is required per item.

sign^*

string required

SHA256 signature

button_title

string optional

Submit button text.

submit save subscribe pay donate

lang

string optional

Page language (AUTO, EN, HE, RU, AR, ES, IT, DE, FR)

webhook_url

string optional

Allpay sends a POST webhook with card details, capture status, and allpay_token to this URL.

success_url

string optional

The customer is redirected to this URL after the token is captured. If not provided, the customer is redirected to the default Allpay success page.

backlink_url

string optional

URL for the "Return to site" button displayed at the bottom of the page. Note: there is no fail URL — errors are displayed directly on the page, prompting the customer to try again.

client_name / email / phone / tehudat

string optional

Prefill customer fields

add_field_1 / add_field_2

string optional

Custom data — returned in webhook

expire

integer optional

Unix timestamp when link expires (default: 1 week)

API Response

payment_url

string

Redirect the customer here

Webhook (after customer submits card)

Success (status = 1):

Field · Type · Description

order_id

string

Your order identifier

status

integer

1 — token captured successfully

amount

number

Always 0 — capturing a token does not charge the card

subscription_create

integer

Always 0 — a card was saved without creating a subscription

allpay_token

string

Token representing the customer's card — use in future Create Payment calls or Create Subscription

items

array

Items from the request

method

string

Always card — a token is saved from a card. Present for tokens created through v15 and later.

card bit applepay googlepay

card_mask

string

Masked card number, e.g. 465901******7049

card_brand

string

Visa / Mastercard / AmEx / Diners

card_exp

string

New in v16

Expiry date of the saved card, MMYY. Use it to show the card in the customer's list of saved cards and to offer a new card before this one expires.

test_mode

integer

New in v16

Mode of the token. A test token can be charged only in test mode.

1 — test token

0 — live token

foreign_card

integer

0 — local card (issued by an Israeli bank)

1 — foreign card

client_name

string

Customer name (if provided in request)

client_email

string

Customer email (if provided in request)

client_phone

string

Customer phone (if provided in request)

client_tehudat

string

Customer Social ID (if provided in request)

sign

string

SHA256 signature — verify using your API key

Failed (status = 0):

Field · Type · Description

order_id

string

Your order identifier

status

integer

0 — capture failed

error

string

Reason the card could not be saved, in English — see Decline codes (Payment declined when no code is available).

sign

string

SHA256 signature — verify using your API key

Show example · request and response

Webhook

// success (status = 1)
{
  "order_id":      "TOKEN-001",
  "status":        1,
  "amount":        0,
  "subscription_create": 0,
  "allpay_token":  "6A0874314DCA42-79412113",
  "items":         [{ "name": "Save payment method" }],
  "method":        "card",
  "card_mask":     "465901******7049",
  "card_brand":   "Visa",
  "card_exp":  "0829",
  "test_mode":    0,
  "foreign_card": 0,
  "client_name":  "Joe Doe",
  "client_email": "joe@example.com",
  "sign":         "abc123..."
}

// failed (status = 0)
{
  "order_id": "TOKEN-001",
  "status":   0,
  "amount":   0,
  "currency_display": "ILS",
  "currency_payment": "ILS",
  "currency_course":  1,
  "error":    "Card declined",
  "sign":     "abc123..."
}

cURL

curl "https://allpay.to/app/?show=capturetoken&mode=api16" \
  -X POST -H "Content-Type: application/json" \
  -d '{
    "login": "your_login",
    "order_id": "TOKEN-001",
    "items": [{"name": "Save payment method"}],
    "button_title": "save",
    "webhook_url": "https://yoursite.com/token-webhook",
    "lang": "EN",
    "sign": "YOUR_COMPUTED_SIGN"
  }'

PHP

$body = [
  'login'       => 'your_login',
  'order_id'    => 'TOKEN-001',
  'items'       => [['name' => 'Save payment method']],
  'button_title' => 'save',
  'webhook_url' => 'https://yoursite.com/token-webhook'
];
$body['sign'] = allpay_sign($body, 'YOUR_API_KEY');
// POST to https://allpay.to/app/?show=capturetoken&mode=api16
// redirect to $response['payment_url']
// webhook: { status:1, order_id:'TOKEN-001', allpay_token:'6A0874314DCA42-...', card_mask:'465901******7049', card_brand:'Visa', ... }

Node.js

const body = {
  login: 'your_login',
  order_id: 'TOKEN-001',
  items: [{ name: 'Save payment method' }],
  button_title: 'save',
  webhook_url: 'https://yoursite.com/token-webhook',
  lang: 'EN'
};
body.sign = allpaySign(body, 'YOUR_API_KEY');
const { payment_url } = await (await fetch('https://allpay.to/app/?show=capturetoken&mode=api16', {
  method: 'POST', headers: {'Content-Type': 'application/json'},
  body: JSON.stringify(body)
})).json();
// redirect customer to payment_url
// webhook: { status: 1, order_id: 'TOKEN-001', allpay_token: '6A0874314DCA42-...', card_mask: '465901******7049', card_brand: 'Visa', ... }

Tokens

Get Token for Existing Payment

POSThttps://allpay.to/app/?show=gettoken&mode=api16

Retrieve a reusable token from a completed payment.

Note Bit payments do not support tokenization.

Parameters

Name · Type · Description

order_id^*

string required

Order ID of the completed payment

sign^*

string required

SHA256 signature

Response

Field · Type · Description

order_id

string

Order identifier

allpay_token

string

Token for future payments

card_mask

string

Masked card number

card_brand

string

Card brand

card_exp

string

New in v16

Expiry date of the saved card, MMYY. Absent when unknown.

test_mode

integer

New in v16

Mode of the token. A test token can be charged only in test mode.

1 — test token

0 — live token

foreign_card

integer

0 — local card (issued by an Israeli bank)

1 — foreign card

Show example · request and response

cURL

curl "https://allpay.to/app/?show=gettoken&mode=api16" \
  -X POST -H "Content-Type: application/json" \
  -d '{
    "login": "your_login",
    "order_id": "ORDER-001",
    "sign": "YOUR_COMPUTED_SIGN"
  }'

PHP

$body = [
  'login'    => 'your_login',
  'order_id' => 'ORDER-001'
];
$body['sign'] = allpay_sign($body, 'YOUR_API_KEY');
// POST to https://allpay.to/app/?show=gettoken&mode=api16
// $response['allpay_token'] — use in future getpayment calls

Node.js

const body = {
  login: 'your_login', order_id: 'ORDER-001'
};
body.sign = allpaySign(body, 'YOUR_API_KEY');
const { allpay_token, card_mask } = await (await fetch('https://allpay.to/app/?show=gettoken&mode=api16', {
  method: 'POST', headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify(body)
})).json();
// pass allpay_token in future Create Payment calls

TokensNew in v16

Delete Token

POSThttps://allpay.to/app/?show=deletetoken&mode=api16

Key rules

R1 After deletion, a charge with this allpay_token returns error 9. Deletion cannot be undone: to charge the card again, the customer saves it again.
R2 Allpay subscriptions created with this card keep charging it — cancel them with Cancel Subscription.

Delete a saved card token — for example, when the customer removes the card from their profile on your site. A token does not expire by itself: it works while the card is valid, and a charge after the card was reissued or expired is declined with code 600.

Note When the card processor recognises a card it has already saved for your account, the payment gets the same allpay_token as before, and deleting it deletes it for all those payments. Otherwise a card saved again gets a new token. To recognise such a card, compare card_mask, card_brand and card_exp — a strong hint, not a guarantee.

Parameters

Name · Type · Description

allpay_token^*

string required

Token to delete

sign^*

string required

SHA256 signature

Response

Field · Type · Description

allpay_token

string

The deleted token

status

integer

1 — deleted

A token that does not exist or was already deleted returns error 9.

Show example · request and response

Response

{
  "allpay_token": "68F1C2A9B3E4D5-12345678",
  "status": 1
}

cURL

curl "https://allpay.to/app/?show=deletetoken&mode=api16" \
  -X POST -H "Content-Type: application/json" \
  -d '{
    "login": "your_login",
    "allpay_token": "TOKEN_VALUE",
    "sign": "YOUR_COMPUTED_SIGN"
  }'

PHP

$body = [
  'login'        => 'your_login',
  'allpay_token' => 'TOKEN_VALUE'
];
$body['sign'] = allpay_sign($body, 'YOUR_API_KEY');
// POST to https://allpay.to/app/?show=deletetoken&mode=api16
// then remove the card from the customer's profile on your side

Node.js

const body = {
  login: 'your_login', allpay_token: 'TOKEN_VALUE'
};
body.sign = allpaySign(body, 'YOUR_API_KEY');
const res = await (await fetch('https://allpay.to/app/?show=deletetoken&mode=api16', {
  method: 'POST', headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify(body)
})).json();
// res.status === 1, or res.error_code 9 — no such token

J5 / Pre-authorization

Reserve an amount on a card without charging it. The reservation is valid for 7 days (168 hours). You can charge an amount equal to or less than the reserved amount — but only once. To void a reservation without charging, call the Refund endpoint.

J5 / Pre-auth

Pre-authorize (Reserve)

POSThttps://allpay.to/app/?show=getpayment&mode=api16

Key rules

R1 The reservation expires after 168 hours (7 days). Charge or void it before then.
R2 You can charge only once, up to the reserved amount.

Flow diagram

Your server

Allpay

Customer

1. Your server to Allpay: POST getpayment + preauthorize: 1
2. Allpay to Your server (response): payment_url
3. Your server to Customer: Redirect to payment_url
4. Customer to Allpay: Authorizes the reservation
5. Allpay to Your server: Webhook: preauth = authorized
Note at Your server:
Within 168 hours (7 days). To void: Refund
6. Your server to Allpay: POST runauthorizedpayment with amount
7. Allpay to Your server (response): status: 1, amount
8. Allpay to Your server: Webhook: preauth = captured

request response webhook / Allpay-initiated

Same as Create Payment with preauthorize: 1. Reserves the amount on the customer's card — no charge is made. Returns payment_url.

With a saved card: pass allpay_token together with preauthorize: 1 to place the reservation server-to-server, without the payment page. The response is synchronous, as for a token charge: {"order_id","status":1} on success, {"error_code","error_msg"} on failure. A webhook is sent when the reservation is confirmed, the same as for a reservation made on the payment page. 3DS is not performed. Card tokens only (not Apple Pay / Google Pay / Bit).

Warning The reservation expires after 168 hours (7 days). Charge or void it before then.

preauthorize

integer

Set to 1

Show example · request and response

cURL

curl "https://allpay.to/app/?show=getpayment&mode=api16" \
  -X POST -H "Content-Type: application/json" \
  -d '{
    "login": "your_login",
    "order_id": "J5-001",
    "items": [{"name": "Hotel reservation", "qty": 1, "price": 500, "vat": 1}],
    "currency_display": "ILS",
    "preauthorize": 1,
    "webhook_url": "https://yoursite.com/webhook",
    "sign": "YOUR_COMPUTED_SIGN"
  }'

PHP

$body = [
  'login'        => 'your_login',
  'order_id'     => 'J5-001',
  'items'        => [['name' => 'Hotel reservation', 'qty' => 1, 'price' => 500, 'vat' => 1]],
  'currency_display' => 'ILS',
  'preauthorize' => 1,
  'webhook_url'  => 'https://yoursite.com/webhook'
];
$body['sign'] = allpay_sign($body, 'YOUR_API_KEY');
// POST to https://allpay.to/app/?show=getpayment&mode=api16
// redirect to $response['payment_url']

Node.js

const body = {
  login: 'your_login', order_id: 'J5-001',
  items: [{ name: 'Hotel reservation', qty: 1, price: 500, vat: 1 }],
  currency_display: 'ILS',
  preauthorize: 1,
  webhook_url: 'https://yoursite.com/webhook'
};
body.sign = allpaySign(body, 'YOUR_API_KEY');

J5 / Pre-auth

Charge Pre-authorized Payment

POSThttps://allpay.to/app/?show=runauthorizedpayment&mode=api16

Charge a reserved amount. Can only be done once, must not exceed the reserved amount, and must happen within 168 hours. The reserved amount is the order total after discounts. The pre-authorization must be active: authorized (Check Payment Status returns status 1) and not voided — otherwise error 16.

Note To void a reservation without charging, call Refund without an items field.

After a successful charge, a webhook is sent with status = 1, preauth = captured and captured_amount — to the webhook_url of the original pre-authorization request and to the integration webhook. If the response is lost (timeout), check the order with Check Payment Status: preauth = captured means the charge went through.

Parameters

Name · Type · Description

order_id^*

string required

Order ID from the original pre-authorization

amount^*

number required

Amount to charge, greater than 0 and not more than the reserved amount (order total after discounts), up to 2 decimals — extra decimals are rounded

sign^*

string required

SHA256 signature

Response

Field · Type · Description

order_id

string

Order identifier

status

integer

0 — failed

1 — successful

amount

number

Amount charged

Show example · request and response

cURL

curl "https://allpay.to/app/?show=runauthorizedpayment&mode=api16" \
  -X POST -H "Content-Type: application/json" \
  -d '{
    "login": "your_login",
    "order_id": "J5-001",
    "amount": 450.00,
    "sign": "YOUR_COMPUTED_SIGN"
  }'

PHP

$body = [
  'login'    => 'your_login',
  'order_id' => 'J5-001',
  'amount'   => 450.00  // charge less than reserved
];
$body['sign'] = allpay_sign($body, 'YOUR_API_KEY');
// POST to https://allpay.to/app/?show=runauthorizedpayment&mode=api16

Node.js

const body = {
  login: 'your_login', order_id: 'J5-001',
  amount: 450.00
};
body.sign = allpaySign(body, 'YOUR_API_KEY');
const { status } = await (await fetch('https://allpay.to/app/?show=runauthorizedpayment&mode=api16', {
  method: 'POST', headers: {'Content-Type': 'application/json'},
  body: JSON.stringify(body)
})).json();

Data Export

Export transactions, payouts and subscriptions — e.g. for a daily reconciliation with your POS or accounting system. All export methods page through results 100 at a time, oldest first, and take the period date_from / date_to; transactions and subscriptions also take search by order, customer and card. Transactions and subscriptions are returned only for the API login of the request — payments made through payment links, e-commerce plugins and other API logins of the account are not included.

Data Export

List Transactions

POSThttps://allpay.to/app/?show=gettransactions&mode=api16

Returns every money movement of the period, oldest first, 100 per page: successful payments, refunds, chargebacks and chargeback reversals. Unpaid and failed payment attempts, J5 reservations that have not been charged yet (see Charge Pre-auth) and card tokens captured without a payment are not included. A refund or chargeback is a separate transaction dated when it happened, linked to the original payment by parent_transaction_id and carrying the same order_id.

Only transactions of this API login are returned — payments made through payment links, e-commerce plugins and other API logins of the account are not included. They are also limited to the mode of the login: test transactions for a login in test mode, live transactions otherwise.

Parameters

Name · Type · Description

date_from^*

string required

First day of the period, YYYY-MM-DD. Days are counted in Israel time (Asia/Jerusalem) from 00:00.

date_to^*

string required

Last day of the period, YYYY-MM-DD, inclusive (up to 23:59:59 Israel time). For a daily reconciliation pass the same date as date_from. The period can be at most 31 days.

type

string optional

Return only one type of transaction. If omitted, all types are returned.

payment — successful payment

refund — refund

chargeback — chargeback

chargeback_revert — chargeback reversed in your favour

order_id

string optional

Return only the transactions of this order: the payment and its refunds / chargebacks made within the period.

client_email

string optional

Customer e-mail, exact match (case-insensitive).

client_phone

string optional

Customer phone. Compared by its last 9 digits, so 0501234567, +972501234567 and 972-50-123-4567 find the same customer. At least 7 digits.

card_last4

string optional

Last 4 digits of the card.

page

integer optional

Page number, from 1. Each page contains up to 100 transactions. Keep requesting next_page until it is 0.

sign^*

string required

SHA256 signature

Note All amounts are in the currency the card was actually charged in (currency_payment) — the amount that reaches your account before fees. Every transaction carries currency_display, currency_payment and currency_course; for a payment the amount in the display currency is returned in order_amount.

Response

Field · Type · Description

date_from, date_to

string

The requested period

total_n

integer

Number of transactions matching the request (on all pages)

page

integer

Current page

next_page

integer

Next page number, or 0 if this is the last page

totals

array

Sums over all matching transactions (not only this page), one object per charge currency. Use it to check that you have received every page.

Field · Type · Description

totals[].currency_payment

string

Charge currency: ILS / USD / EUR

totals[].payments

number

Sum of payments

totals[].refunds

number

Sum of refunds (negative)

totals[].chargebacks

number

Sum of chargebacks (negative) minus chargeback reversals

totals[].net

number

payments + refunds + chargebacks

totals[].n

integer

Number of transactions

transactions

array

Transactions of this page, oldest first.

Field · Type · Description

transactions[].transaction_id

integer

Allpay transaction ID, unique — use it to tell transactions apart (one order can have several)

transactions[].type

string

payment refund chargeback chargeback_revert

transactions[].parent_transaction_id

integer

Refunds and chargebacks only: transaction_id of the original payment (it may be outside the requested period)

transactions[].order_id

string

Your order ID from Create Payment; for a refund or chargeback — the one of the original payment. Empty for payments without an order ID (payment links).

transactions[].date

string

Date and time in Israel time, YYYY-MM-DD HH:MM:SS

transactions[].ts

integer

The same moment as a Unix timestamp

transactions[].amount

number

Amount in the charge currency: positive for a payment and a chargeback reversal, negative for a refund and a chargeback. For a payment it is the amount actually charged (after discounts); refunds made later do not change it — they are separate transactions.

transactions[].currency_display

string

Display currency of the payment — the currency of order_amount (currency_display of the request, otherwise the charge currency). For a refund or chargeback — the charge currency.

transactions[].currency_payment

string

The currency the card is charged in: ILS / USD / EUR

transactions[].currency_course

number

Exchange rate of the payment from the display currency to the charge currency, fixed when the payment was created: amount = order_amount × currency_course, to the agora. 1 when the currencies are the same and always for a refund or chargeback (its amount is already in the charge currency).

transactions[].status

integer

Payments only: state of the payment at the time of the request, as in Payment Status.

1 — paid

3 — fully refunded or charged back

4 — partially refunded or charged back

transactions[].refunded

number

Payments with status 3 / 4 only: amount refunded and charged back so far, in the charge currency

transactions[].order_amount

number

Payments only: the order amount after discounts in the display currency (currency_display); equals amount when the currencies are the same

transactions[].method

string

card bit applepay googlepay

transactions[].inst

integer

Number of installments; 1 — a single payment

transactions[].foreign_card

integer

0 — Israeli card

1 — foreign card

transactions[].card_mask

string

Masked card number, e.g. 458045******4580

transactions[].card_brand

string

Card brand, e.g. VISA

transactions[].receipt

string

Link to the receipt issued by the connected accounting service (EasyCount or Morning); for a refund or chargeback — to the refund receipt. Empty when no receipt was issued (no service connected, or skip_receipt = 1 in Create Payment).

transactions[].client_name

string

Customer name

transactions[].client_email

string

Customer email

transactions[].client_phone

string

Customer phone

transactions[].client_tehudat

string

Customer Social ID (Teudat Zehut), if it was collected

transactions[].test_mode

integer

New in v16

Mode of the record. The export holds only records of the login's mode, so the value is the same for all of them.

Note No webhook is sent by this method — it only reads data. Requests are limited to 30 per minute per API login.

Show example · request and response

Response

{
  "date_from": "2026-10-12",
  "date_to":   "2026-10-12",
  "total_n":   2,
  "page":      1,
  "next_page": 0,
  "totals": [{
    "currency_payment": "ILS", "payments": 240, "refunds": -40,
    "chargebacks": 0, "net": 200, "n": 2
  }],
  "transactions": [{
    "transaction_id": 5120034,
    "type":           "payment",
    "order_id":       "T-1042",
    "date":           "2026-10-12 13:05:41",
    "ts":             1791799541,
    "amount":         240,
    "currency_display": "USD",  // prices of the order were in USD
    "currency_payment": "ILS",
    "currency_course":  3.75,   // 64 USD × 3.75 = 240 ILS
    "order_amount":   64,
    "status":         4,
    "refunded":       40,
    "method":         "card",
    "inst":           1,
    "foreign_card":   0,
    "card_mask":      "458045******4580",
    "card_brand":     "VISA",
    "receipt":        "",
    "client_name":    "Joe Doe",
    "client_email":   "joe@example.com",
    "client_phone":   "0501234567",
    "client_tehudat": ""
  }, {
    "transaction_id":        5120391,
    "type":                  "refund",
    "parent_transaction_id": 5120034,
    "order_id":              "T-1042",
    "date":                  "2026-10-12 18:22:07",
    "ts":                    1791818527,
    "amount":                -40,
    "currency_display":      "ILS",  // a refund is in the charge currency
    "currency_payment":      "ILS",
    "currency_course":       1,
    // ... method, card and client fields as above
  }]
}

cURL

curl "https://allpay.to/app/?show=gettransactions&mode=api16" \
  -X POST -H "Content-Type: application/json" \
  -d '{
    "login": "your_login",
    "date_from": "2026-10-12",
    "date_to": "2026-10-12",
    "page": 1,
    "sign": "YOUR_COMPUTED_SIGN"
  }'

PHP

// all transactions of yesterday, page by page
$day = date('Y-m-d', strtotime('yesterday'));
$transactions = [];
$page = 1;
do {
  $body = [
    'login'     => 'your_login',
    'date_from' => $day,
    'date_to'   => $day,
    'page'      => $page
  ];
  $body['sign'] = allpay_sign($body, 'YOUR_API_KEY');

  $ch = curl_init('https://allpay.to/app/?show=gettransactions&mode=api16');
  curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => json_encode($body),
    CURLOPT_HTTPHEADER     => ['Content-Type: application/json'],
    CURLOPT_RETURNTRANSFER => true
  ]);
  $res = json_decode(curl_exec($ch), true);
  curl_close($ch);

  $transactions = array_merge($transactions, $res['transactions']);
  $page = $res['next_page'];
} while ($page > 0);
// $res['totals'] — sums per currency for the whole day

Node.js

const day = '2026-10-12';
const transactions = [];
let page = 1, totals;
do {
  const body = { login: 'your_login', date_from: day, date_to: day, page };
  body.sign = allpaySign(body, 'YOUR_API_KEY');
  const res = await (await fetch('https://allpay.to/app/?show=gettransactions&mode=api16', {
    method: 'POST', headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify(body)
  })).json();
  transactions.push(...res.transactions);
  totals = res.totals;
  page = res.next_page;
} while (page > 0);

Data Export

List Payouts

POSThttps://allpay.to/app/?show=getpayouts&mode=api16

Returns the payouts to your bank account made in the period, oldest first, 100 per page. Payouts belong to the whole account, so the list is the same for every API login, and there are no test payouts — the list is the same for a login in test mode too.

Parameters

Name · Type · Description

date_from^*

string required

First day of the period, YYYY-MM-DD, Israel time.

date_to^*

string required

Last day of the period, YYYY-MM-DD, inclusive. The period can be at most 366 days.

page

integer optional

Page number, from 1. Each page contains up to 100 payouts.

sign^*

string required

SHA256 signature

Response

Field · Type · Description

date_from, date_to

string

The requested period

total_n

integer

Number of payouts in the period (on all pages)

page

integer

Current page

next_page

integer

Next page number, or 0 if this is the last page

payouts

array

Payouts of this page.

Field · Type · Description

payouts[].payout_id

integer

Allpay payout ID

payouts[].date

string

Date and time of the payout in Israel time, YYYY-MM-DD HH:MM:SS

payouts[].ts

integer

The same moment as a Unix timestamp

payouts[].amount

number

Amount transferred to the bank account (after fees)

payouts[].currency

string

ILS / USD / EUR

payouts[].status

integer

0 — requested, being processed

1 — sent to the bank

payouts[].bank

string

Name of the receiving bank

Note No webhook is sent by this method — it only reads data.

Show example · request and response

Response

{
  "date_from": "2026-10-01",
  "date_to":   "2026-10-12",
  "total_n":   1,
  "page":      1,
  "next_page": 0,
  "payouts": [{
    "payout_id": 48211,
    "date":      "2026-10-06 09:14:00",
    "ts":        1791267240,
    "amount":    18432.5,
    "currency":  "ILS",
    "status":    1,
    "bank":      "Bank Leumi"
  }]
}

cURL

curl "https://allpay.to/app/?show=getpayouts&mode=api16" \
  -X POST -H "Content-Type: application/json" \
  -d '{
    "login": "your_login",
    "date_from": "2026-10-01",
    "date_to": "2026-10-12",
    "sign": "YOUR_COMPUTED_SIGN"
  }'

PHP

$body = [
  'login'     => 'your_login',
  'date_from' => '2026-10-01',
  'date_to'   => '2026-10-12'
];
$body['sign'] = allpay_sign($body, 'YOUR_API_KEY');
// POST to https://allpay.to/app/?show=getpayouts&mode=api16
// $response['payouts'] — payouts of the period, oldest first

Node.js

const body = { login: 'your_login', date_from: '2026-10-01', date_to: '2026-10-12' };
body.sign = allpaySign(body, 'YOUR_API_KEY');
const { payouts, next_page } = await (await fetch('https://allpay.to/app/?show=getpayouts&mode=api16', {
  method: 'POST', headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify(body)
})).json();

Data Export

List Subscriptions

POSThttps://allpay.to/app/?show=getsubscriptions&mode=api16

Returns subscriptions created through this API login, oldest first, 100 per page — with the same period and search parameters as List Transactions. Subscriptions created through payment links and other API logins of the account are not included. Only subscriptions in the mode of the API login are returned: test subscriptions for a login in test mode, live ones otherwise. To get the charges of a subscription, use Subscription Status or List Transactions with its order_id.

Parameters

Name · Type · Description

status

integer optional

Filter by subscription status. If omitted or set to 0, returns all subscriptions regardless of status. Any other value returns error 2.

0 — any

1 — active

2 — completed

3 — error

4 — cancelled

date_from

string optional

Return only subscriptions created from this day on, YYYY-MM-DD, Israel time. Pass together with date_to.

date_to

string optional

Last day of the creation period, YYYY-MM-DD, inclusive. The period can be at most 366 days. Without date_from / date_to subscriptions of any date are returned.

order_id

string optional

Your order ID of the subscription, exact match.

client_email

string optional

Customer e-mail, exact match (case-insensitive).

client_phone

string optional

Customer phone, compared by its last 9 digits. At least 7 digits.

card_last4

string optional

Last 4 digits of the card.

page

integer optional

Page number, from 1. Each page contains up to 100 subscriptions. Keep requesting next_page until it is 0.

sign^*

string required

SHA256 signature

Response

Field · Type · Description

date_from, date_to

string

The requested period — only when it was passed

total_n

integer

Number of subscriptions matching the request (on all pages)

page

integer

Current page

next_page

integer

Next page number, or 0 if this is the last page

subscriptions

array

Subscriptions of this page, oldest first.

Field · Type · Description

subscriptions[].subscription_id

integer

Allpay subscription ID

subscriptions[].order_id

string

Subscription order identifier; empty for subscriptions created through a payment link

subscriptions[].name

string

Subscription name (from the first item)

subscriptions[].status

integer

1 — active

2 — completed

3 — error

4 — cancelled

subscriptions[].date

string

When the subscription was created, Israel time, YYYY-MM-DD HH:MM:SS

subscriptions[].ts

integer

The same moment as a Unix timestamp

subscriptions[].amount

number

Amount per charge, in the display currency

subscriptions[].currency_display

string

Display currency of the subscription

subscriptions[].currency_payment

string

The currency the card is charged in: ILS / USD / EUR

subscriptions[].currency_course

number

Current exchange rate from the display currency to the charge currency; 1 when the currencies are the same. Every charge is converted at the rate of its date, so the next charge ≈ amount × currency_course.

subscriptions[].payments_n

integer

Number of successful charges made

subscriptions[].paid_total

number

Total amount charged to date

subscriptions[].date_start

integer

Unix timestamp of the first charge

subscriptions[].date_end

integer

Unix timestamp of the last charge; 0 for infinite subscriptions

subscriptions[].next_payment

integer

Unix timestamp of the next scheduled charge

subscriptions[].card_mask

string

Masked number of the card the subscription is charged to

subscriptions[].card_brand

string

Card brand

subscriptions[].foreign_card

integer

0 — Israeli card

1 — foreign card

subscriptions[].client_name

string

Customer name

subscriptions[].client_email

string

Customer email

subscriptions[].client_phone

string

Customer phone

subscriptions[].client_tehudat

string

Customer Social ID (if provided)

subscriptions[].add_field_1

string

Custom data from the original request (if provided)

subscriptions[].add_field_2

string

Custom data from the original request (if provided)

Show example · request and response

Response

{
  "total_n":   1,
  "page":      1,
  "next_page": 0,
  "subscriptions": [{
    "subscription_id":  20417,
    "order_id":      "SUB-001",
    "name":         "Monthly Plan",
    "status":       1,
    "date":         "2025-03-26 03:00:00",
    "ts":           1742950800,
    "amount":       49,
    "currency_display": "ILS",
    "currency_payment": "ILS",
    "currency_course":  1,
    "payments_n":   3,
    "paid_total":   147,
    "date_start":   1742947200,
    "date_end":     0,  // 0 = infinite
    "next_payment": 1750723200,
    "card_mask":    "458045******4580",
    "card_brand":   "VISA",
    "foreign_card": 0,
    "client_name":  "Joe Doe",
    "client_email": "joe@example.com",
    "client_phone": "+972501234567",
    "client_tehudat": "123456789",
    "add_field_1":  "custom-data"  // add_field_1 / add_field_2 — only when passed
  }]
}

cURL

curl "https://allpay.to/app/?show=getsubscriptions&mode=api16" \
  -X POST -H "Content-Type: application/json" \
  -d '{
    "login": "your_login",
    "status": 1,
    "page": 1,
    "sign": "YOUR_COMPUTED_SIGN"
  }'

PHP

$body = [
  'login'  => 'your_login',
  'status' => 1, // active only
  'page'   => 1
];
$body['sign'] = allpay_sign($body, 'YOUR_API_KEY');
// POST to https://allpay.to/app/?show=getsubscriptions&mode=api16
// $response['subscriptions'] — array of subscriptions
// $response['next_page'] — 0 if no more pages

Node.js

const body = {
  login: 'your_login', status: 1, page: 1
};
body.sign = allpaySign(body, 'YOUR_API_KEY');
const { subscriptions, total_n, next_page } = await (await fetch('https://allpay.to/app/?show=getsubscriptions&mode=api16', {
  method: 'POST', headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify(body)
})).json();

Utility

Verify API Credentials

POSThttps://allpay.to/app/?show=checkkeys&mode=api16

Verify that an API login + key pair is valid, without making a payment. Useful for onboarding flows where you're connecting a merchant's account.

Parameters

Name · Type · Description

sign^*

string required

SHA256 signature generated with the API key

Response (valid credentials)

Field · Type · Description

last_paid_order_id

string

Last paid order ID, or "-1" if none

last_paid_order_date

string

Unix timestamp of last payment, or "-1" if none

test_mode

integer

New in v16

Mode of this login: the Test mode switch of the integration (always 1 for accounts in "developing" status) — see Test Mode.

1 — test mode: real cards are not charged

0 — live

Response (invalid credentials)

{ "error_code": 3, "error_msg": "Signature is incorrect" }

Show example · request and response

cURL

curl "https://allpay.to/app/?show=checkkeys&mode=api16" \
  -X POST -H "Content-Type: application/json" \
  -d '{
    "login": "their_login",
    "sign": "YOUR_COMPUTED_SIGN"
  }'

PHP

$body = [
  'login' => 'their_login'
];
$body['sign'] = allpay_sign($body, 'THEIR_API_KEY');
// POST to https://allpay.to/app/?show=checkkeys&mode=api16
// isset($response['error_code']) → invalid credentials

Node.js

const body = { login: 'their_login' };
body.sign = allpaySign(body, 'THEIR_API_KEY');
const res = await (await fetch('https://allpay.to/app/?show=checkkeys&mode=api16', {
  method: 'POST', headers: {'Content-Type': 'application/json'},
  body: JSON.stringify(body)
})).json();

if (res.error_code) {
  // invalid credentials
} else {
  // valid — res.last_paid_order_id
}

Utility

Test Cards

Turn on test mode for your integration, then use the card numbers below. Use any future date as the expiration date and any three digits for the CVV.

Card Numbers

Brand	Number	Result
Visa	4557430402053431	✓ Success
Mastercard	5326105300985846	✓ Success
American Express	375516193000090	✓ Success
Visa	4000000000000002	✗ Declined — card declined
Visa	4000000000000051	✗ Declined — card blocked
Visa	4000000000000085	✗ Declined — card stolen
Visa	4000000000000069	✗ Declined — card expired
Visa	4000000000000101	✗ Declined — CVV required
Visa	4000000000000127	✗ Declined — incorrect CVV
Visa	4000000000000135	✗ Declined — credit limit reached
Visa	4242424242424241	✗ Declined — incorrect card number

Use the decline cards to test error handling: the payment fails, and the response, Check Payment Status and the webhook carry the decline reason (Decline codes).

Note Real cards are not charged in test mode. How it is switched on and off: Test Mode.

Utility

Changelog

API updates, new endpoints and parameters, and breaking changes — in reverse chronological order.

November 12, 2026

v16

API v16. Use mode=api16. Signature and all other methods work the same way as in v15. Integrations on v15 and earlier keep working without changes; everything below applies to v16 only.

Moving from v15: what to change

Refund. Refund needs amount, items or the new refund_all: 1. A request without them, or with amount that is 0 or not a number, used to refund the whole order; now it returns error 2. Test mode. test_mode: 0 no longer creates a live payment while the integration's Test mode switch is on — the parameter can only turn test mode on (Test Mode).

Test mode in responses and webhooks

test_mode is returned by Verify API Keys (mode of the login), Create Payment, Capture Token, Check Payment Status, Get Token, List Transactions and sent in every webhook. It is part of the webhook signature like any other field.

Card expiry: card_exp

Expiry date of the card in MMYY format in Get Token, Check Payment Status and the webhooks (payment, chargeback, Capture Token), when it is known.

New methods

Cancel Payment stops an unpaid payment link from being paid (errors 27, 28). Delete Token deletes a saved card token.

3-D Secure for one payment: force_3ds

force_3ds: 1 in Create Payment requires 3-D Secure for that payment whatever its amount, on the payment page and in Hosted Fields.

November 12, 2026

All versions

Hosted Fields: onError after a reload

The Hosted Fields iframe no longer calls onError with error_n: 6 when it is opened again after a failed attempt. onError now comes only for the attempt that has just failed, so the same payment_url can be reused for the next try.

November 12, 2026

All versions

order_id length

order_id is limited to 64 characters. A request with a longer order_id is now rejected with error 2 Wrong param value: order_id (max 64 characters) in every method and every API version. Previously such a value could not be stored in full with the payment or subscription.

November 11, 2026

All versions

Payment page: phone number format

The phone number a customer enters on the Allpay payment page now arrives in client_phone in international format without spaces — +972501234567 (before: +972 50 123 4567). This applies to webhooks and API responses in all API versions. The new payment page is rolling out gradually, account by account, starting November 11, 2026. If your integration parses or compares phone numbers, accept both formats: payments made before the change keep the old one.

October 13, 2026

v15

API v15. Use mode=api15. Signature, webhook format and all other methods work the same way as in v14. Integrations on v14 and earlier keep working without changes; everything below is available only with mode=api15.

Moving from v14: what to change

Currency. currency is gone. In Create Payment pass the display currency as currency_display — now required, all amounts of the request are in it — and the charge currency as currency_payment (optional, ILS by default; a currency not enabled for your account is charged in ILS, as before). A request with currency returns error 2, so an integration moved from v14 cannot silently charge in the wrong currency.

Responses (Check Payment Status, Subscription Status, List Transactions, List Subscriptions) and webhooks have no currency either — they return currency_display, currency_payment and currency_course (see below). In List Transactions totals[].currency is now totals[].currency_payment. Payouts and billing plans keep currency: they have a single currency.

Receipt type. The Create Payment parameter doc_type is renamed to receipt_type; values and behavior are the same. With mode=api15 only receipt_type is read. v14 and earlier keep doc_type.

Exchange rate: currency_course

For payments created through v15, Check Payment Status, List Transactions and every webhook (payment, chargeback, Capture Token) return currency_display, currency_payment and currency_course — the exchange rate fixed when the payment was created. This way you can always calculate the amount charged: amount × currency_course in the payment webhook, (amount − discount) × currency_course in Check Payment Status. Check Payment Status also returns discount when the order has one.

Payment method: method

New field method — card, bit, applepay or googlepay, the same values as in List Transactions. Returned by Check Payment Status and sent in the webhooks of payments created through v15 and later: payment, chargeback (the method of the original payment) and Capture Token (always card).

skip_receipt

New optional parameter of Create Payment: skip_receipt: 1 — do not issue a receipt for this payment, its refunds and chargebacks, or the recurring charges of a subscription, even if an accounting service (EasyCount or Morning) is connected. Meant for the rare case when receipts are issued elsewhere. Without the parameter, receipts are issued as before.

Transactions and payouts

New methods List Transactions (gettransactions) — payments, refunds, chargebacks and chargeback reversals for a period of up to 31 days, with search by order, customer e-mail / phone and card, and totals per currency — and List Payouts (getpayouts) — payouts to your bank account for a period.

List Subscriptions

List Subscriptions now works like the new methods above. New filters: date_from / date_to (creation date), order_id, client_email, client_phone, card_last4. The list is sorted oldest first, so new subscriptions do not shift the pages while you page through it. The response adds page and, for every subscription, subscription_id, the creation date / ts, the currencies with the current rate, and the card. Numbers are returned as numbers (previously some came as strings); an invalid status or page returns error 2.

Fixes

Subscription Status now returns the right currencies for subscriptions not in ILS. The webhook of a failed attempt carries amount in the display currency, like the webhook of a successful payment (in v14 and earlier it is in the billing currency).

October 11, 2026

v14

Charge Pre-auth now checks the amount against the reserved amount after discounts (previously against the amount before discounts, so a capture above the reservation reached the processor and failed with error 19); an amount of 0 or less is rejected with error 2. For an order with a discount, the charged amount is now stored and shown correctly in Check Payment Status and refunds. A pre-authorization that is not authorized yet or was voided returns error 16 Pre-authorization is not active without a request to the processor. Applies to API v14.

J5 by saved card: Create Payment with both allpay_token and preauthorize: 1 now places the reservation server-to-server and returns the result synchronously; previously the token was ignored and a payment_url was returned. A token charge of an order with item discounts now charges the amount after discounts (previously the amount before discounts). Applies to API v14.

J5 state: Check Payment Status and the webhook now return preauth for J5 orders (authorized / captured with captured_amount; Check Payment Status also voided / expired), so a reservation can be told from a charge. Charge Pre-auth now sends a webhook with preauth = captured. Applies to API v14.

Decline codes: Check Payment Status, the failed-payment webhook and error 12 of a token charge now include decline_code (numeric decline code) and decline_reason (the reason in English) — see Decline codes. The error text in these places (error_msg of errors 12 and 17, error in Check Payment Status and the webhook) is now the same English reason instead of the processor's text, which could come in Hebrew. Applies to API v14.

October 9, 2026

v14

API v14 — standard signature and webhook format. The methods and their parameters are the same as in v13; the documentation now uses mode=api14. Integrations on v13 and earlier keep working without changes.

Signature of requests

null is now left out of the signature, like ""; true is signed as 1 and false as 0 — see value rules. Requests signed by the earlier rules (null and false as an empty value) are still accepted, in every API version.

Amounts

In v14, amount (payment and Charge Pre-auth) and the fixed item discount are rounded to 2 decimals on receipt, the same way item prices always were. The stored amount, Check Payment Status, the Charge Pre-auth response and the webhook now show the same rounded amount the charge is calculated from — in the display currency when currency_display is used, as before. Webhooks of v14 payments carry amounts rounded to 2 decimals.

Webhooks

For payments created through v14, including later charges of a subscription created through it: webhooks are always JSON, items is an array, fields without a value are not sent, currency is always filled, and the signature follows the rules above. Payments created through v13 and earlier keep the previous format.

October 1, 2026

v13

Added new error code 26 — Order ID ... already has a payment attempt, use a new order_id. A token charge (allpay_token) can no longer be repeated with the same order_id once a payment attempt was made for it. Previously such a request was rejected by the payment processor and returned as error 12. To retry a declined charge, first check the previous order with Check Payment Status, then send the charge with a new order_id. Applies to API v13.

October 1, 2026

v13

The Check Payment Status response now includes the reason a payment attempt failed.

error

Error message from the last failed payment attempt, e.g. when the card was declined or has insufficient funds. Returned only when status is not 1 and the order has a recorded error — the field is absent for successful payments and for orders without a failed attempt. Applies to API v13.

September 17, 2026

Added a new parameter show_googlepay to the payment request, allowing control over the Google Pay button visibility on the payment page. The Google Pay module must be activated in your account first.

September 10, 2026

v13

Create Subscription now applies a softer check in test mode. Error 22 — Subscriptions module is not enabled for this account — is returned for a live subscription when the Subscriptions module has no current paid period; for a test payment (test_mode = 1) the module only has to be switched on, so an integration can be built and tested before the module is paid for. Applies to all API versions that support subscriptions (v7 and later).

September 10, 2026

v12

New Chargeback Webhook. Allpay now notifies your webhook_url when an order is charged back by the card issuer, and again when such a chargeback is reverted. Previously chargebacks were visible only in the merchant dashboard.

type

New field that identifies the event: chargeback or chargeback_revert. Regular payment webhooks do not contain type — handlers that ignore payloads carrying this field keep their current behavior.

amount, refunded, order_amount, currency

Amount of the operation, the running total charged back or refunded on the order, and the full charged amount of the order — all in the currency the card was charged in.

Delivery, retries and the sign calculation are identical to the Payment Webhook. No webhook is sent for a refund you issue yourself. Applies to all API versions and to payment links with a webhook configured.

August 28, 2026

v12

The Check Payment Status response now includes a new field for partially refunded payments.

refunded

Refunded part of the payment. Returned only when status is 4 (partial refund). Applies to API v8 and later.

August 20, 2026

v12

Added new error code 22 — Subscriptions module is not enabled for this account. Create Subscription now checks that the Subscriptions module is active for the account before creating the payment; previously such a request returned a payment_url that the customer could not pay. Test payments (test_mode = 1) are unaffected. Applies to all API versions that support subscriptions (v7 and later).

August 19, 2026

v12

Clarified in the Create Subscription docs that start_date / end_date only select a calendar day — charges run via a once-daily batch job, so the time-of-day portion of the timestamp does not control the exact moment of the charge. No API behavior changed; this is a documentation clarification. Applies to all API versions.

August 19, 2026

v12

Webhooks that report a saved card rather than a charge now say so explicitly. This affects subscription creation with any deferred start_type and Capture Token. Both previously sent status = 1 with the full price in items and no amount field, which could be mistaken for a completed payment.

amount

Now always present and set to 0 in these webhooks.

subscription_create

New field, present only in these webhooks: 1 — subscription created and the first charge scheduled; 0 — card saved without creating a subscription. Webhooks reporting an actual charge do not include this field.

Both fields are included in the sign calculation. If you verify signatures over the received payload — as described in Signature — no change is required on your side. Applies to all API versions.

July 17, 2026

v12

Fixed subscription completion for end_type=3 with end_n=1: previously, when the first charge occurred immediately (start_type=1), the subscription stayed active and a second charge was attempted a month later. Now the subscription completes right after the first charge. end_n=1 is fully supported for all start types.

July 6, 2026

v12

The Refund Payment response now includes links to refund documents when they are created (an accounting service — EasyCount or Morning — is connected and the original payment has a receipt).

receipt

Link to the refund receipt (negative receipt).

receipt_tax

Link to the credit tax invoice. Issued only for VAT-registered businesses, which receive two refund documents.

May 25, 2026

v12

Added new error code 21 — Amount must be at least 5 ILS. Returned when the payment amount (after applying currency rate) is below 5 ILS. Previously this case was not enforced via the API.

May 16, 2026

v12

API v12 released: support for donation receipts and donation payment buttons.

In light of the new reporting requirements for non-profit organizations in Israel, Allpay API v12 now supports two new parameters for payment creation.

doc_type

Document type for the document issued after payment. If not provided, the default value is taken from your account settings.

Available values: 320 — Tax Invoice Receipt, 400 — Receipt, 405 — Receipt for donation.

button_title

Text displayed on the payment button. Available values: pay (default), donate, subscribe.

This update allows non-profit organizations to create payments that issue the correct donation document and display a more suitable payment button for donation flows.

April 10, 2026

v11

API v11 released. We've introduced several updates to improve flexibility and control over payments and card handling.

New capturetoken endpoint

Allows saving a customer's card without charging it. Works with both redirect flow and Hosted Fields.

Webhook error notifications

Webhook notifications are now sent to webhook_url in case of payment errors. The customer remains on the payment page, allowing them to retry with another card.

Webhook delivery and retries

Your server must return an HTTP 200 OK response to confirm successful receipt of a webhook. If any other status is returned, or the request fails due to a timeout or network error, Allpay will automatically retry delivery.

Allpay performs up to 10 delivery attempts in total. The first retry is made 1 minute after the initial failure. Subsequent retries are sent with progressively increasing intervals, with the final attempt occurring within 24 hours of the original request. If all delivery attempts fail, the webhook will be marked as failed and no further retries will be made.

Custom payment button text

You can now customize the payment button label using the new button_title parameter. Available options: "Pay" or "Donate".

January 22, 2026

The notifications_url parameter has been renamed to webhook_url. notifications_url remains valid and fully supported for all API versions below v10.

January 16, 2026

v10

We've released API v10, introducing the new currency_display parameter. This parameter allows you to display prices to customers in one currency while charging in the billing currency. It helps show prices in a familiar currency for customers, while keeping settlement and payouts in the merchant's preferred currency.

No changes are required if you do not need multi-currency price display.

November 20, 2025

API version 9 introduces support for item-level discounts. Two new optional parameters have been added: discount_val — discount amount for the item, and discount_type — defines whether the discount is a fixed amount or a percentage. These parameters allow displaying the discount directly on the payment page and automatically deducting it from the item price.

August 25, 2025

Added new value 4 — partially refunded to the payment status parameter in responses to Refund requests and Payment status verification requests.

July 25, 2025

Added API Keys Verification endpoint that allows developers of various platforms integrating with Allpay to verify the validity and authenticity of a user's Allpay API login and key without initiating a payment.

July 15, 2025

Added support for partial refunds by introducing the optional items array in the refund request.

May 8, 2025

Introducing New J5 Transaction Flow. J5 is a two-step payment process used in Israeli payment systems. It begins with a pre-authorization (reservation) of funds on a customer's card for up to 168 hours (7 days). During this time, you can charge the reserved amount — fully or partially. If no charge is made, the funds are automatically released.

This is applicable for use cases like deliveries, rentals, variable-weight goods, or custom orders. Read more about J5 →

March 12, 2025

Allpay introduces Hosted Fields — a secure way to embed a payment form on a website or in an application, fully adapting it to your design. Tutorial →

February 13, 2025

Added a new parameter show_applepay to the payment request, allowing control over the Apple Pay button visibility on the payment page. The Apple Pay module must be activated in your account first. This parameter is useful in order to hide the button when creating a card token, as Apple Pay payments cannot be used for tokenization.

January 29, 2025

We're introducing two new tools for developers to test payments via API:

Allpay API Tester

With the Allpay API Tester, you can send requests for new payments, refunds, subscriptions, and other operations in both live and test modes, simulating requests from your server.

API Tag

Every transaction processed via the API is marked with an "API" tag in the Allpay dashboard. Clicking on the tag allows you to view the associated API request and response.

November 22, 2024

Language support updates. New lang parameter values:

AUTO — automatically sets the payment page language based on the client's browser settings. This is now the default value.

AR — added support for Arabic language.

If the lang parameter is not provided or set to AUTO, the payment page will automatically display in the client's browser language. Providing EN, RU, HE, or AR will display the payment page in that language for all clients, regardless of their browser settings.

A language switcher is now available on the payment page, allowing clients to change the language at any time, regardless of the initial lang parameter setting.

November 15, 2024

API updated to version 6.

New parameters introduced

items — an array containing product details, including names, quantities, prices, and VAT attributes. This information will appear in the Allpay app and in the digital invoice if digital invoice integration is enabled.

expire — a Unix timestamp that defines the lifetime of the payment link. Once the link expires, it becomes invalid for payment. This helps avoid situations where customers pay for products or services that are no longer available.

Removed parameters

name (product name) and amount (total payment amount).

Key changes

The items array replaces the need for the name and amount parameters. The final amount is calculated based on the prices and quantities provided in the items array. Using the vat parameter inside the items array, Allpay will either display the VAT amount on the payment page or indicate that VAT is not included.

Important: Prices provided in the items array must already include VAT (if applicable). The vat parameter is used only to specify whether VAT is included in the item's price or not. We do not add VAT on top of the prices.

The old API version will continue to function as before.

October 6, 2024

Added support for full or partial refunds via the API. See the Refund endpoint.

August 3, 2024

The new payment request parameter show_bit allows you to enable or disable the display of the Bit payment button on the payment page. The Bit module must be activated in your Allpay account first.

March 14, 2024

The receipt parameter is included in both payment notification and payment verification response. This parameter provides the URL to the digital receipt, which is generated by the EasyCount module when the module is activated in the account settings.

Please note that the request URL changed to ...api4.

February 9, 2024

Added new optional parameter for Payment Request: client_tehudat, representing the client's Social ID Number (Teudat Zehut). If provided, Allpay won't prompt the client for manual entry. If not provided, it will be requested on the payment page, as required by law. For non-Israeli citizens, submit 000000000.

December 24, 2023

fail_url parameter will no longer be applied because payment errors are displayed directly on the payment page, prompting the customer to make a new payment attempt.

New parameter added: backlink_url — a URL for the new "Return to site" button on the bottom of the payment page.

December 21, 2023

New parameters added in the responses for payment protocol, status verification and token requests: card_mask (example: 465901******7049), card_brand (example: Visa, Mastercard etc.) and foreign_card (issued in Israel or abroad).

Request URLs changed from ...api1 to ...api2.

September 9, 2023

Added endpoint for creating and using tokens.

June 30, 2023

When submitting the currency parameter in USD or EUR, the amount will be auto-converted to ILS on the Allpay side. Exchange rates are taken in real time from Google Finance.

June 29, 2023

Added payment verification method to check transaction status.

Utility

Resources & Support

Tools, guides, and contact information to help with your integration.

Tools

API Tester Interactive tool to send API requests and inspect responses without writing code

API Reference for AI models (.md) Machine-readable Markdown version of this reference — feed it to an AI coding assistant (Copilot, Claude, Codex, etc.) to help generate an accurate integration

Hosted Fields Embed a PCI-compliant card input directly in your page without redirecting the customer

Guides

Webhooks Guide How to configure per-integration webhook URLs — in addition to the webhook_url passed per request, you can set a fixed URL in your integration settings that Allpay will also notify after every payment

API Q&A Answers to the most common integration questions

Currencies List All supported currencies and their codes for currency_payment / currency_display

J5 / Pre-auth Guide In-depth explanation of the two-step pre-authorization flow

Token UI Recommendations UX guidelines for building a saved-card interface using tokens

Support & Updates

support@allpay.co.il Technical support over email

@allpay_israel Technical support over Telegram

@allpay_api Telegram channel to track API updates