Create Payment Intent

Create a Payment Intent

curl --request POST \
  --url https://api.sbx.moduluslabs.io/ecom/v1/payment-intents \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: <idempotency-key>' \
  --header 'X-API-Key: <api-key>' \
  --data '
{
  "merchant_branch_reference_number": "SH-ANG-001",
  "amount": 86500,
  "currency": "PHP",
  "description": "Order #1234",
  "order_reference": "ORD-2026-1234",
  "expires_at": "2030-01-01T10:00:00Z",
  "metadata": {
    "order_id": "1234"
  }
}
'

import requests

url = "https://api.sbx.moduluslabs.io/ecom/v1/payment-intents"

payload = {
    "merchant_branch_reference_number": "SH-ANG-001",
    "amount": 86500,
    "currency": "PHP",
    "description": "Order #1234",
    "order_reference": "ORD-2026-1234",
    "expires_at": "2030-01-01T10:00:00Z",
    "metadata": { "order_id": "1234" }
}
headers = {
    "Idempotency-Key": "<idempotency-key>",
    "X-API-Key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'Idempotency-Key': '<idempotency-key>',
    'X-API-Key': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    merchant_branch_reference_number: 'SH-ANG-001',
    amount: 86500,
    currency: 'PHP',
    description: 'Order #1234',
    order_reference: 'ORD-2026-1234',
    expires_at: '2030-01-01T10:00:00Z',
    metadata: {order_id: '1234'}
  })
};

fetch('https://api.sbx.moduluslabs.io/ecom/v1/payment-intents', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.sbx.moduluslabs.io/ecom/v1/payment-intents",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'merchant_branch_reference_number' => 'SH-ANG-001',
    'amount' => 86500,
    'currency' => 'PHP',
    'description' => 'Order #1234',
    'order_reference' => 'ORD-2026-1234',
    'expires_at' => '2030-01-01T10:00:00Z',
    'metadata' => [
        'order_id' => '1234'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "Idempotency-Key: <idempotency-key>",
    "X-API-Key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.sbx.moduluslabs.io/ecom/v1/payment-intents"

	payload := strings.NewReader("{\n  \"merchant_branch_reference_number\": \"SH-ANG-001\",\n  \"amount\": 86500,\n  \"currency\": \"PHP\",\n  \"description\": \"Order #1234\",\n  \"order_reference\": \"ORD-2026-1234\",\n  \"expires_at\": \"2030-01-01T10:00:00Z\",\n  \"metadata\": {\n    \"order_id\": \"1234\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Idempotency-Key", "<idempotency-key>")
	req.Header.Add("X-API-Key", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.sbx.moduluslabs.io/ecom/v1/payment-intents")
  .header("Idempotency-Key", "<idempotency-key>")
  .header("X-API-Key", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"merchant_branch_reference_number\": \"SH-ANG-001\",\n  \"amount\": 86500,\n  \"currency\": \"PHP\",\n  \"description\": \"Order #1234\",\n  \"order_reference\": \"ORD-2026-1234\",\n  \"expires_at\": \"2030-01-01T10:00:00Z\",\n  \"metadata\": {\n    \"order_id\": \"1234\"\n  }\n}")
  .asString();

using RestSharp;


var options = new RestClientOptions("https://api.sbx.moduluslabs.io/ecom/v1/payment-intents");
var client = new RestClient(options);
var request = new RestRequest("");
request.AddHeader("Idempotency-Key", "<idempotency-key>");
request.AddHeader("X-API-Key", "<api-key>");
request.AddJsonBody("{\n  \"merchant_branch_reference_number\": \"SH-ANG-001\",\n  \"amount\": 86500,\n  \"currency\": \"PHP\",\n  \"description\": \"Order #1234\",\n  \"order_reference\": \"ORD-2026-1234\",\n  \"expires_at\": \"2030-01-01T10:00:00Z\",\n  \"metadata\": {\n    \"order_id\": \"1234\"\n  }\n}", false);
var response = await client.PostAsync(request);

Console.WriteLine("{0}", response.Content);

{
  "id": "b7e2c1a4-9f3d-4c6b-8a21-5e0f7d9c3b18",
  "client_secret": "3f9a6d2e-7c14-4b8f-a5d0-1e6c2b9f4a73",
  "amount": 86500,
  "currency": "PHP",
  "order_reference": "ORD-2026-1234",
  "status": "ACTIVE",
  "expires_at": "2030-01-01T10:00:00Z"
}

{
  "error": {
    "code": "BAD_REQUEST",
    "message": "<string>",
    "correlation_id": "<string>",
    "details": {
      "field": "description",
      "rule": "non_blank"
    }
  }
}

{
  "error": {
    "code": "BAD_REQUEST",
    "message": "<string>",
    "correlation_id": "<string>",
    "details": {
      "field": "description",
      "rule": "non_blank"
    }
  }
}

{
  "error": {
    "code": "BAD_REQUEST",
    "message": "<string>",
    "correlation_id": "<string>",
    "details": {
      "field": "description",
      "rule": "non_blank"
    }
  }
}

{
  "error": {
    "code": "BAD_REQUEST",
    "message": "<string>",
    "correlation_id": "<string>",
    "details": {
      "field": "description",
      "rule": "non_blank"
    }
  }
}

{
  "error": {
    "code": "BAD_REQUEST",
    "message": "<string>",
    "correlation_id": "<string>",
    "details": {
      "field": "description",
      "rule": "non_blank"
    }
  }
}

{
  "error": {
    "code": "BAD_REQUEST",
    "message": "<string>",
    "correlation_id": "<string>",
    "details": {
      "field": "description",
      "rule": "non_blank"
    }
  }
}

{
  "error": {
    "code": "BAD_REQUEST",
    "message": "<string>",
    "correlation_id": "<string>",
    "details": {
      "field": "description",
      "rule": "non_blank"
    }
  }
}

{
  "error": {
    "code": "BAD_REQUEST",
    "message": "<string>",
    "correlation_id": "<string>",
    "details": {
      "field": "description",
      "rule": "non_blank"
    }
  }
}

{
  "error": {
    "code": "BAD_REQUEST",
    "message": "<string>",
    "correlation_id": "<string>",
    "details": {
      "field": "description",
      "rule": "non_blank"
    }
  }
}

POST

payment-intents

Create a Payment Intent

curl --request POST \
  --url https://api.sbx.moduluslabs.io/ecom/v1/payment-intents \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: <idempotency-key>' \
  --header 'X-API-Key: <api-key>' \
  --data '
{
  "merchant_branch_reference_number": "SH-ANG-001",
  "amount": 86500,
  "currency": "PHP",
  "description": "Order #1234",
  "order_reference": "ORD-2026-1234",
  "expires_at": "2030-01-01T10:00:00Z",
  "metadata": {
    "order_id": "1234"
  }
}
'

import requests

url = "https://api.sbx.moduluslabs.io/ecom/v1/payment-intents"

payload = {
    "merchant_branch_reference_number": "SH-ANG-001",
    "amount": 86500,
    "currency": "PHP",
    "description": "Order #1234",
    "order_reference": "ORD-2026-1234",
    "expires_at": "2030-01-01T10:00:00Z",
    "metadata": { "order_id": "1234" }
}
headers = {
    "Idempotency-Key": "<idempotency-key>",
    "X-API-Key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'Idempotency-Key': '<idempotency-key>',
    'X-API-Key': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    merchant_branch_reference_number: 'SH-ANG-001',
    amount: 86500,
    currency: 'PHP',
    description: 'Order #1234',
    order_reference: 'ORD-2026-1234',
    expires_at: '2030-01-01T10:00:00Z',
    metadata: {order_id: '1234'}
  })
};

fetch('https://api.sbx.moduluslabs.io/ecom/v1/payment-intents', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.sbx.moduluslabs.io/ecom/v1/payment-intents",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'merchant_branch_reference_number' => 'SH-ANG-001',
    'amount' => 86500,
    'currency' => 'PHP',
    'description' => 'Order #1234',
    'order_reference' => 'ORD-2026-1234',
    'expires_at' => '2030-01-01T10:00:00Z',
    'metadata' => [
        'order_id' => '1234'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "Idempotency-Key: <idempotency-key>",
    "X-API-Key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.sbx.moduluslabs.io/ecom/v1/payment-intents"

	payload := strings.NewReader("{\n  \"merchant_branch_reference_number\": \"SH-ANG-001\",\n  \"amount\": 86500,\n  \"currency\": \"PHP\",\n  \"description\": \"Order #1234\",\n  \"order_reference\": \"ORD-2026-1234\",\n  \"expires_at\": \"2030-01-01T10:00:00Z\",\n  \"metadata\": {\n    \"order_id\": \"1234\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Idempotency-Key", "<idempotency-key>")
	req.Header.Add("X-API-Key", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.sbx.moduluslabs.io/ecom/v1/payment-intents")
  .header("Idempotency-Key", "<idempotency-key>")
  .header("X-API-Key", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"merchant_branch_reference_number\": \"SH-ANG-001\",\n  \"amount\": 86500,\n  \"currency\": \"PHP\",\n  \"description\": \"Order #1234\",\n  \"order_reference\": \"ORD-2026-1234\",\n  \"expires_at\": \"2030-01-01T10:00:00Z\",\n  \"metadata\": {\n    \"order_id\": \"1234\"\n  }\n}")
  .asString();

using RestSharp;


var options = new RestClientOptions("https://api.sbx.moduluslabs.io/ecom/v1/payment-intents");
var client = new RestClient(options);
var request = new RestRequest("");
request.AddHeader("Idempotency-Key", "<idempotency-key>");
request.AddHeader("X-API-Key", "<api-key>");
request.AddJsonBody("{\n  \"merchant_branch_reference_number\": \"SH-ANG-001\",\n  \"amount\": 86500,\n  \"currency\": \"PHP\",\n  \"description\": \"Order #1234\",\n  \"order_reference\": \"ORD-2026-1234\",\n  \"expires_at\": \"2030-01-01T10:00:00Z\",\n  \"metadata\": {\n    \"order_id\": \"1234\"\n  }\n}", false);
var response = await client.PostAsync(request);

Console.WriteLine("{0}", response.Content);

{
  "id": "b7e2c1a4-9f3d-4c6b-8a21-5e0f7d9c3b18",
  "client_secret": "3f9a6d2e-7c14-4b8f-a5d0-1e6c2b9f4a73",
  "amount": 86500,
  "currency": "PHP",
  "order_reference": "ORD-2026-1234",
  "status": "ACTIVE",
  "expires_at": "2030-01-01T10:00:00Z"
}

{
  "error": {
    "code": "BAD_REQUEST",
    "message": "<string>",
    "correlation_id": "<string>",
    "details": {
      "field": "description",
      "rule": "non_blank"
    }
  }
}

{
  "error": {
    "code": "BAD_REQUEST",
    "message": "<string>",
    "correlation_id": "<string>",
    "details": {
      "field": "description",
      "rule": "non_blank"
    }
  }
}

{
  "error": {
    "code": "BAD_REQUEST",
    "message": "<string>",
    "correlation_id": "<string>",
    "details": {
      "field": "description",
      "rule": "non_blank"
    }
  }
}

{
  "error": {
    "code": "BAD_REQUEST",
    "message": "<string>",
    "correlation_id": "<string>",
    "details": {
      "field": "description",
      "rule": "non_blank"
    }
  }
}

{
  "error": {
    "code": "BAD_REQUEST",
    "message": "<string>",
    "correlation_id": "<string>",
    "details": {
      "field": "description",
      "rule": "non_blank"
    }
  }
}

{
  "error": {
    "code": "BAD_REQUEST",
    "message": "<string>",
    "correlation_id": "<string>",
    "details": {
      "field": "description",
      "rule": "non_blank"
    }
  }
}

{
  "error": {
    "code": "BAD_REQUEST",
    "message": "<string>",
    "correlation_id": "<string>",
    "details": {
      "field": "description",
      "rule": "non_blank"
    }
  }
}

{
  "error": {
    "code": "BAD_REQUEST",
    "message": "<string>",
    "correlation_id": "<string>",
    "details": {
      "field": "description",
      "rule": "non_blank"
    }
  }
}

{
  "error": {
    "code": "BAD_REQUEST",
    "message": "<string>",
    "correlation_id": "<string>",
    "details": {
      "field": "description",
      "rule": "non_blank"
    }
  }
}

Returns 201 Created with the intent id, client_secret, and the supplied order_reference when present. Hand the id and client_secret to the JavaScript SDK to render the card fields and confirm the payment. Card data is never sent to this endpoint.

Never expose the secret key in a browser or mobile app. The browser SDK uses your publishable key (pk_) instead, scoped to this intent by its client_secret. See What is client_secret?

order_reference participates in idempotency comparison. Reusing an Idempotency-Key with a different order reference returns 409 instead of changing the existing intent.

Confirmation happens in the browser through the SDK, not through a REST call you make yourself. See Confirm the payment.

Authorizations

X-API-Key

string

header

required

Server-side secret key (sk_...) supplied in X-API-Key. Never expose this key in a browser or mobile app.

Headers

Idempotency-Key

string

required

Unique client-generated identifier for Payment Intent creation. Allowed characters: letters, digits, dot (.), hyphen (-), and underscore (_); 8-64 characters. Reusing the same key for the same branch with an identical body returns the existing intent; reusing it with a different body returns a conflict.

Required string length: 8 - 64

Pattern: ^[A-Za-z0-9._-]{8,64}$

Body

application/json

amount

integer<int64>

required

Amount to charge in the currency's smallest unit (for PHP, centavos). 86500 = PHP 865.00. Integer, range 1 to 99,999,999.

Required range: 1 <= x <= 99999999

Example:

86500

currency

string

required

ISO 4217 currency code: a string of exactly 3 uppercase letters (for example, PHP). Must be a currency enabled for your account.

Required string length: 3

Pattern: ^[A-Z]{3}$

expires_at

string<date-time>

required

Required RFC 3339 timestamp when the intent stops being payable. It must be in the future and is normalized to UTC.

Example:

"2030-01-01T10:00:00Z"

merchant_branch_reference_number

string

Target branch reference. Required for partner- and merchant-scoped secret keys. A branch-scoped key may omit it and can only target its own branch.

Maximum string length: 100

description

string | null

Optional human-readable label. When supplied, it must contain at least one non-whitespace character and be at most 500 characters.

Maximum string length: 500

Example:

"Order #1234"

order_reference

string | null

Optional merchant-defined order reference for reconciliation. It can contain at most 100 Unicode characters. Omit it or send null when the intent has no order reference.

Maximum string length: 100

Example:

"ORD-2026-1234"

metadata

object

Free-form string key/value pairs stored with the intent. Max 50 keys; each key <=40 characters, each value <=500 characters; <=10,000 serialized bytes. Sensitive payment or credential data is prohibited.

Show child attributes

Response

Payment intent created.

string<uuid>

required

Unique payment intent identifier (UUID v7). Pass this to the SDK.

Example:

"b7e2c1a4-9f3d-4c6b-8a21-5e0f7d9c3b18"

client_secret

string<uuid>

required

Client secret that authorizes confirming this one intent. Pass it to the SDK with id. Keep it out of logs and URLs.

amount

integer<int64>

required

Amount in the smallest currency unit.

Example:

86500

currency

string

required

ISO 4217 currency code.

Example:

"PHP"

status

enum<string>

required

Current lifecycle status of the newly created Payment Intent.

Available options:

ACTIVE,

CONSUMED,

EXPIRED,

CANCELLED

expires_at

string<date-time>

required

RFC 3339 UTC timestamp when the intent stops being payable.

Example:

"2030-01-01T10:00:00Z"

order_reference

string

Merchant-defined order reference supplied in the create request. Omitted when no order reference was supplied.

Maximum string length: 100

Example:

"ORD-2026-1234"

QR API

Webhooks API

Onboarding API

Transaction Reporting API

Terminal Gateway API

Ecom API

Authorizations

Headers

Body

Response