Skip to main content
POST
Create a Payment Intent
Returns 201 Created with the intent id and client_secret. Hand both to the JavaScript SDK to render the card fields and confirm the payment. Card data is never sent to this endpoint.

Authentication

This is a server-side endpoint. Send your secret key as an HTTP Bearer token:
Never expose the secret key in a browser or mobile app. The browser SDK uses your publishable key (pk_) instead, scoped to this intent by its client_secret.

Amounts

amount is an integer in the currency’s smallest unit (for PHP, centavos). For example, 86500 is PHP 865.00. Valid range is 1 to 99999999.

Expiry

expires_in_minutes controls how long the intent stays payable if the customer does not confirm. It defaults to 1440 (24 hours), with a minimum of 5 and a maximum of 10080 (7 days). After it lapses, the intent’s status becomes EXPIRED. Create a fresh intent and re-mount the SDK.
Confirmation happens in the browser through the SDK, not through a REST call you make yourself. See Confirm the payment.

Authorizations

Authorization
string
header
required

Server-side secret key (sk_) as an HTTP Bearer token: Authorization: Bearer sk_.... Creates payment intents. Never expose the secret key in a browser or mobile app.

Body

application/json
amount
integer<int64>
required

Amount to charge in the currency's smallest unit (for PHP, centavos). 86500 = PHP 865.00. Integer, range 1 to 99,999,999.

Required range: 1 <= x <= 99999999
Example:

86500

currency
string
required

ISO 4217 currency code: a string of exactly 3 uppercase letters (for example, PHP). Must be a currency enabled for your account.

Required string length: 3
Pattern: ^[A-Z]{3}$
description
string | null

Human-readable label, echoed back on the receipt. Optional; this endpoint imposes no length limit.

Example:

"Order #1234"

expires_in_minutes
integer<int64>
default:1440

Minutes the intent stays payable if unconfirmed. Integer, 5 to 10080 (7 days). Default 1440 (24 hours).

Required range: 5 <= x <= 10080
Example:

1440

metadata
object

Free-form string key/value pairs stored with the intent. This endpoint imposes no key-count, length, or size limits.

Response

Payment intent created.

id
string<uuid>
required

Unique payment intent identifier (UUID v7). Pass this to the SDK.

Example:

"b7e2c1a4-9f3d-4c6b-8a21-5e0f7d9c3b18"

client_secret
string<uuid>
required

Client secret that authorizes confirming this one intent. Pass it to the SDK with id. Keep it out of logs and URLs.

amount
integer<int64>
required

Amount in the smallest currency unit.

Example:

86500

currency
string
required

ISO 4217 currency code.

Example:

"PHP"

status
enum<string>
required

Always ACTIVE on create.

Available options:
ACTIVE
expires_at
string<date-time>
required

RFC 3339 UTC timestamp when the intent stops being payable.

Example:

"2026-09-04T12:00:00Z"