> ## Documentation Index
> Fetch the complete documentation index at: https://docs.moduluslabs.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Create Payment Intent
> Create a payment intent on your server, then confirm it in the browser with the JavaScript SDK
Returns `201 Created` with the intent `id` and `client_secret`. Hand both to the [JavaScript SDK](/docs/ecom/jssdk/introduction) to render the card fields and confirm the payment. Card data is never sent to this endpoint.
## Authentication
This is a server-side endpoint. Send your **secret key** as an HTTP Bearer token:
```
Authorization: Bearer sk_test_...
```
Never expose the secret key in a browser or mobile app. The browser SDK uses your **publishable key** (`pk_`) instead, scoped to this intent by its `client_secret`.
## Amounts
`amount` is an integer in the currency's smallest unit (for PHP, centavos). For example, `86500` is PHP 865.00. Valid range is `1` to `99999999`.
## Expiry
`expires_in_minutes` controls how long the intent stays payable if the customer does not confirm. It defaults to `1440` (24 hours), with a minimum of `5` and a maximum of `10080` (7 days). After it lapses, the intent's `status` becomes `EXPIRED`. Create a fresh intent and re-mount the SDK.
Confirmation happens in the browser through the SDK, not through a REST call you make yourself. See [Confirm the payment](/docs/ecom/jssdk/confirm-payment).
## OpenAPI
````yaml api-reference/ecom/openapi.json POST /payment-intents
openapi: 3.0.3
info:
title: Ecom API
description: >-
REST API for creating and managing hosted payment links. Generate a
shareable checkout URL and accept one-time or multi-use payments.
**Entity scoping:** Every API key is scoped to an entity in the organization
hierarchy (Partner → Merchant → Branch). Data access is automatically
restricted to the key's level.
**Amounts:** All monetary values are integers in the currency's smallest
unit (for PHP, centavos). `150000` represents PHP 1,500.00.
**Idempotency:** Create requires an `Idempotency-Key`; cancel accepts one
optionally.
version: 1.0.0
contact:
name: API Support
email: support@moduluslabs.io
license:
name: Proprietary
url: https://moduluslabs.io
servers:
- url: https://api.sbx.moduluslabs.io/ecom/v1
description: Sandbox
security:
- ApiKeyAuth: []
tags:
- name: Payment Links
description: Create and manage hosted payment links
paths:
/payment-intents:
post:
summary: Create a Payment Intent
description: >-
Create a payment intent from your server with your secret key. Returns
the `id` and `client_secret` to hand to the JavaScript SDK, which
renders the card fields and confirms the payment in the browser. Card
data is never sent to this endpoint.
operationId: createPaymentIntent
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/CreatePaymentIntentRequest'
example:
amount: 86500
currency: PHP
description: 'Order #1234'
metadata:
order_id: '1234'
responses:
'201':
description: Payment intent created.
content:
application/json:
schema:
$ref: '#/components/schemas/PaymentIntent'
example:
id: b7e2c1a4-9f3d-4c6b-8a21-5e0f7d9c3b18
client_secret: 3f9a6d2e-7c14-4b8f-a5d0-1e6c2b9f4a73
amount: 86500
currency: PHP
status: ACTIVE
expires_at: '2026-09-04T12:00:00Z'
'400':
description: >-
Invalid request (for example `INVALID_AMOUNT`, `INVALID_CURRENCY`,
or `INVALID_EXPIRY`).
content:
application/json:
schema:
$ref: '#/components/schemas/PaymentIntentError'
'401':
description: Missing or invalid secret key.
content:
application/json:
schema:
$ref: '#/components/schemas/PaymentIntentError'
'413':
description: Request body too large (`PAYLOAD_TOO_LARGE`).
content:
application/json:
schema:
$ref: '#/components/schemas/PaymentIntentError'
'500':
description: Internal error (`INTERNAL_ERROR`).
content:
application/json:
schema:
$ref: '#/components/schemas/PaymentIntentError'
security:
- BearerAuth: []
components:
schemas:
CreatePaymentIntentRequest:
type: object
required:
- amount
- currency
properties:
amount:
type: integer
format: int64
minimum: 1
maximum: 99999999
description: >-
Amount to charge in the currency's smallest unit (for PHP,
centavos). `86500` = PHP 865.00. Integer, range 1 to 99,999,999.
example: 86500
currency:
type: string
minLength: 3
maxLength: 3
pattern: ^[A-Z]{3}$
description: >-
ISO 4217 currency code: a string of exactly 3 uppercase letters (for
example, `PHP`). Must be a currency enabled for your account.
description:
type: string
nullable: true
description: >-
Human-readable label, echoed back on the receipt. Optional; this
endpoint imposes no length limit.
example: 'Order #1234'
expires_in_minutes:
type: integer
format: int64
minimum: 5
maximum: 10080
default: 1440
description: >-
Minutes the intent stays payable if unconfirmed. Integer, 5 to 10080
(7 days). Default 1440 (24 hours).
example: 1440
metadata:
type: object
additionalProperties:
type: string
description: >-
Free-form string key/value pairs stored with the intent. This
endpoint imposes no key-count, length, or size limits.
PaymentIntent:
type: object
properties:
id:
type: string
format: uuid
description: Unique payment intent identifier (UUID v7). Pass this to the SDK.
example: b7e2c1a4-9f3d-4c6b-8a21-5e0f7d9c3b18
client_secret:
type: string
format: uuid
description: >-
Client secret that authorizes confirming this one intent. Pass it to
the SDK with `id`. Keep it out of logs and URLs.
amount:
type: integer
format: int64
description: Amount in the smallest currency unit.
example: 86500
currency:
type: string
description: ISO 4217 currency code.
example: PHP
status:
type: string
enum:
- ACTIVE
description: Always `ACTIVE` on create.
expires_at:
type: string
format: date-time
description: RFC 3339 UTC timestamp when the intent stops being payable.
example: '2026-09-04T12:00:00Z'
required:
- id
- client_secret
- amount
- currency
- status
- expires_at
PaymentIntentError:
type: object
required:
- code
- message
properties:
code:
type: string
description: Machine-readable error code.
example: INVALID_CURRENCY
message:
type: string
description: Human-readable message. Do not branch on its wording.
request_id:
type: string
description: Correlation id for this request, when available.
securitySchemes:
ApiKeyAuth:
type: apiKey
in: header
name: X-API-Key
description: >-
API key enabled for the requested payment-link operation and associated
with an eligible partner, merchant, or branch account.
BearerAuth:
type: http
scheme: bearer
description: >-
Server-side secret key (sk_) as an HTTP Bearer token: `Authorization:
Bearer sk_...`. Creates payment intents. Never expose the secret key in
a browser or mobile app.
````