EnglishDeutschEspañolFrançaisItalianoNederlandsPortuguêsPolskiSvenskaNorskDanskRomânăČeštinaБългарски繁體中文（香港）
PlatformPartnersSolutionsAboutPricingContactDevelopersAll featuresAll industriesApply now
Developers

One API.
Every acquirer.

Integrate once. Cardflo routes every transaction across our network of acquirer partners, no extra code when you add a new provider, no breaking changes when routes shift.

create-payment.ts
// Create a payment, one API, every acquirer
const payment = await cardflo.payments.create({
  amount: 4999,            // £49.99
  currency: "GBP",
  customer: { id: "cus_8aF2..." },
  method: { type: "card", token: "tok_live_..." },
  // Smart routing picks the best acquirer automatically.
  routing: { strategy: "approval_then_cost" },
});

if (payment.status === "approved") {
  // Webhook payment.succeeded will follow.
}
Toolkit

Everything you need to ship payments fast.

REST API

Predictable resources, idempotent writes and JSON-everywhere.

Hosted checkout

Drop-in, PCI-scoped, themable to match your brand.

Webhooks

Signed events for every payment, refund and dispute.

Vault & network tokens

Portable customer cards with token lifecycle management.

Server SDKs

Node, Python, Go and PHP, typed clients with retries built in.

Plugins

WooCommerce, Magento, Shopify and Salesforce Commerce Cloud.
Webhooks

Real-time events for every payment lifecycle.

Signed, retried with exponential backoff, and idempotent by event ID. Subscribe to what you care about, ignore the rest.

  • payment.succeededCaptured by routed acquirer
  • payment.retriedSoft decline, next acquirer
  • payment.failedAll routes exhausted
  • refund.createdInitiated for capture
  • dispute.openedChargeback received
  • payout.completedSettled to your bank

Cardflo exposes a REST API, webhook stream, hosted-checkout iframe and a growing library of drop-in components. Everything is versioned, idempotent by default, and covers the same primitives whether you're integrating one acquirer or five. Documentation, sandbox keys and a Postman collection are public.

How teams integrate

Hosted checkout

Fastest path to production. Redirect or embed our PCI-scoped iframe, receive a webhook on completion. Zero PCI scope, wallets included, network tokens on by default. Most integrations ship in a day and cover 90 percent of use cases.

Direct API

Full control over authorisation, capture, refund and dispute flows. PCI DSS SAQ D scope. Suitable for card-on-file, subscriptions, marketplaces and any product that needs custom logic around the auth. Reference SDKs for Node, Python, Ruby, Go and PHP.

Webhooks and events

Idempotent, retry-safe, signed with HMAC. Every payment, refund, chargeback, KYB update and settlement is a webhook event. Sandbox lets you replay events without touching production, which makes end-to-end automation testing trivial.

FAQ

Frequently asked questions

Integration, SDKs, webhooks, sandbox, migration and SLAs. The practical answers engineers ask before writing the first line of code.

Do I need a separate integration for each acquirer?

No. One Cardflo REST API and one set of webhooks connect you to every acquirer in the network. Smart routing chooses the acquirer per transaction and you never write acquirer-specific code. Add or swap acquirers behind the scenes without touching your codebase.

How do webhooks and idempotency work?

Webhooks are signed with HMAC-SHA256 and delivered with automatic retries and exponential backoff. Every request accepts an idempotency key, so retried creates return the original payment instead of duplicating charges. Events include payment.succeeded, payment.retried, refund.created and dispute.opened.

Do you have SDKs and hosted UI components?

Yes. Server SDKs for Node, Python, PHP, Ruby, Go and .NET. A drop-in hosted checkout, Elements for embedded card capture, and a Payment Links API for no-code flows. All UI components are PCI-scope-reducing so you stay out of card data.

What is the sandbox and test-card story?

Sandbox mirrors production with test cards for every scheme, forced-decline codes for every response code we support, and simulated 3DS challenges. You can replay real production webhooks in sandbox to test edge cases without touching live traffic.

How do I migrate from Stripe, Adyen or Checkout.com?

Payment intents, customers, refunds and disputes map cleanly to Cardflo equivalents, and we support importing card tokens where the scheme allows. We provide a migration engineer, side-by-side field mapping docs and a dry-run mode to shadow traffic before switching primary flow.

What are your rate limits and uptime SLAs?

Public API rate limits start at 100 requests per second per account, higher on request. We publish 99.99% availability on the transactional API with monthly credits if we miss. Status is live at status.cardflo.io with incident history and RSS.
Apply now