APG PayAPG Paydocs

Integration

Hosted checkout

Let the platform collect the card so your servers never see one.

Hosted checkout is a browser bundle that collects the card and hands you back a token. The card number never reaches your servers, which is the entire point: it moves you out of scope for most of PCI DSS.

This is a channel, not a different API. The bundle calls the same tokenisation operation you would call yourself, and everything after the token, the order, the payment, the refund, is identical. Only who touches the card changes.

The checkout needs to know what is being paid, and the order is what says so.

Request
curl -X POST "https://api.tst.au.apgpay.dev/bezel/orders" \
  -H "Authorization: Bearer $API_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "order": {
    "merchantId": "<useMerchantIdFromSeed>",
    "customerId": "<useCustomerIdFromSeed>",
    "orderType": "Online",
    "referenceOrderId": "web-order-10424",
    "description": "1kg Colombian single origin",
    "amount": 4800,
    "currency": "AUD",
    "billing": {
      "name": "Priya Raman",
      "address": {
        "line1": "12 Smith Street",
        "line2": null,
        "city": "Sydney",
        "state": "NSW",
        "postalCode": "2000",
        "country": "AU",
        "type": "OrdrAddressAttributes"
      },
      "phone": null,
      "type": "OrdrBillingAttributes"
    },
    "emailAddress": "priya.raman@example.com",
    "phoneNumber": null,
    "lineItems": [],
    "taxIncluded": true,
    "taxAmount": null,
    "discount": null,
    "shipping": null,
    "request3DSOnPayment": null,
    "emailCustomerReceipt": true,
    "settlement": null,
    "metadata": null,
    "type": "OrdrNewOrderAttributes"
  },
  "type": "OrdrCmdCreate"
}'

From here it is the ordinary flow, the token came from the browser rather than from your backend, and nothing else differs.

Request
curl -X POST "https://api.tst.au.apgpay.dev/bezel/transactions" \
  -H "Authorization: Bearer $API_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "orderId": "<useOrderIdFromStep1>",
  "paymentTokenId": "<usePaymentTokenIdFromSeed>",
  "authoriseOnly": null,
  "requestThreeDS": null,
  "returnUrl": "https://bluehillcoffee.example/checkout/complete",
  "offSession": null,
  "cardStatementName": null,
  "cardStatementCity": null,
  "referenceTransactionId": "web-order-10424",
  "type": "TranCmdCreate"
}'
Never accept an amount from the browser. Create the order server-side and let the checkout reference it, otherwise a payer can choose their own price.