AspiPay Quick Start

1. Create a merchant account

Sign up for an AspiPay merchant account. You'll land on the dashboard with test mode enabled by default.

2. Generate a test API key

In Developers → API keys, click Generate. Copy the sk_test_… value — you'll only see it once.

Never commit secret keys to source control. Load them from environment variables.

3. Create a payment session

A payment session returns a checkout_url. Redirect the customer there.

curl -X POST https://aspipay.com/api/public/v1/payment_sessions \
  -H "Authorization: Bearer $ASPIPAY_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "amount_minor": 4999,
    "currency": "USD",
    "success_url": "https://your.site/success",
    "cancel_url":  "https://your.site/cancel"
  }'

4. Handle the webhook

Register a webhook endpoint in the dashboard. AspiPay signs every payload with HMAC-SHA256.

js

import { createHmac, timingSafeEqual } from "crypto";

export async function POST(req) {
  const raw = await req.text();
  const sig = req.headers.get("x-aspipay-signature") ?? "";
  const expected = createHmac("sha256", process.env.ASPIPAY_WEBHOOK_SECRET)
    .update(raw).digest("hex");
  if (!timingSafeEqual(Buffer.from(sig), Buffer.from(expected))) {
    return new Response("bad signature", { status: 401 });
  }
  const evt = JSON.parse(raw);
  if (evt.type === "transaction.succeeded") {
    // fulfil the order
  }
  return new Response("ok");
}

You're live

Next stops: