API Reference
API Overview
A small REST API: create a card checkout or a crypto payment, check its status, and get a webhook when it is paid.
Base URL#
https://paylio.org/api/v1All requests use HTTPS. Request and response bodies are JSON.
Authentication#
Create an API key in Dashboard › API Keys. Keys start with plio_live_. Send the key in one of these headers:
Authorization: Bearer plio_live_YOUR_KEY
# or
X-API-Key: plio_live_YOUR_KEY- The full key is shown only once, when you create it. PayLio stores only a hash.
- You can have up to 10 active keys. Use one per integration so you can revoke them separately.
- Every key inherits the fees, wallet and providers of your account.
- Optionally limit a key to your server's IP addresses when you create it. Requests from other addresses are rejected as if the key were invalid.
- We email you whenever a key is created.
Approved payout wallets#
Payments created with an API key pay out only to wallets you approved in Dashboard › API Keys › Payout wallets, or to the payout wallet in your Settings. Approving a wallet needs your password and sends you an email. So even a leaked key cannot send your customers' payments to someone else's wallet.
- One approval of a
0x…address covers every EVM network. Other networks are approved per network. - Any other address is rejected with
403and codepayout_address_not_approved. - Wallets your account already used for payments are approved automatically.
Keep keys on your server
Never put an API key in browser JavaScript, a mobile app or a public repository. If a key leaks, revoke it in the dashboard and create a new one.Endpoints#
| Method | Path | Purpose |
|---|---|---|
POST | /api/v1/wallet | Create a card checkout |
GET | /api/v1/payment-status | Get a payment's status |
POST | /api/v1/crypto/payments | Create a crypto payment |
GET | /api/v1/crypto/payments/{id} | Retrieve a crypto payment |
GET | /api/v1/crypto/currencies | List coins and minimums |
GET | /api/v1/crypto/quote | Price an order in a coin |
Integration flow#
For card checkouts. Crypto payments follow the same four steps with their own endpoints.
| Step | What you do |
|---|---|
| 1. Create | Call POST /wallet and store payment_id and ipn_token on your order. |
| 2. Redirect | Send the customer to checkout_url. |
| 3. Receive | Verify the payment.paid webhook signature with the stored ipn_token. |
| 4. Confirm | Call GET /payment-status and fulfil the order only if status is paid. |
Rate limits#
| Endpoint | Limit |
|---|---|
POST /wallet | 60 requests per minute per API key |
GET /payment-status | 120 requests per minute per API key |
POST /crypto/payments | 60 requests per minute per API key |
GET /crypto/payments/{id} | 120 requests per minute per API key |
GET /crypto/currencies, /crypto/quote | 60 requests per minute per API key |
When you exceed a limit you get 429 with a Retry-After header. See Errors & Rate Limits.