Build on StixFlow

StixFlow is a programmable payments platform for stores, catalog, and hosted checkout — sandbox first, live after KYB.

What you can build

• +Multi-store catalogs with products, variants, and prices (amounts in cents)
• +Hosted checkout sessions that return a payer-facing url
• +Direct vs MoR payment models with platform application fees
• +Refunds, cancels, and durable payment events
• +HMAC-signed webhooks (StixFlow-Signature)

Start here

How integration usually goes

1. 1Register, open the dashboard, copy your sk_test_ key.
2. 2Complete sandbox KYB in the dashboard so checkout can charge.
3. 3Create a store → product → price → checkout session.
4. 4Register a webhook endpoint and verify StixFlow-Signature.
5. 5Request production, finish live KYB, switch to sk_live_.

Authentication

Merchant REST endpoints require a secret API key:

Authorization: Bearer sk_test_…

Test keys start with sk_test_; live keys with sk_live_. Create keys in the dashboard after registration. Live keys unlock when production KYB is approved.

Webhooks

Register endpoints via POST /api/v1/webhook-endpoints or the dashboard. Events:

payment.succeeded
payment.failed
payment.canceled
payment.refunded

Partner payment webhooks are ingested by StixFlow. You receive one outbound POST per merchant event, with StixFlow event names only.

Verify StixFlow-Signature: t={unix},v1={hmac} where v1 is hex HMAC-SHA256 of t + '.' + raw_body using your whsec_… secret.

{
  "id": "evt_…",
  "object": "event",
  "type": "payment.succeeded",
  "created": 1726500000,
  "livemode": false,
  "request_id": "req_…",
  "data": {
    "object": {
      "object": "payment",
      "id": "pay_…",
      "amount": 1999,
      "currency": "eur",
      "status": "succeeded",
      "payment_model": "direct",
      "livemode": false
    }
  }
}

Sandbox & go-live

Use a sk_test_ key against the same /api/v1/* paths. Complete KYB in the dashboard for sandbox and live separately.

• Checkout requires active KYB for the same livemode (kyb_required otherwise).
• After live KYB and a signed production agreement, create sk_live_* keys in the dashboard.

Base URL

Header: Authorization: Bearer sk_test_…

Stores

{
  "name": "Main store",
  "slug": "main-store",
  "currency": "eur"
}

Catalog

Create products and prices (amounts in minor units / cents).

{
  "name": "Pro plan",
  "description": "Monthly access",
  "product_type": "digital",
  "amount": 2900,
  "currency": "eur"
}

{
  "product": "prod_…",
  "variant": "var_…",
  "amount": 1999,
  "currency": "eur",
  "type": "one_time"
}

Checkout

{
  "store_id": "sto_…",
  "items": [{ "id": "prod_…", "quantity": 1 }],
  "customer_email": "[email protected]",
  "customer_first_name": "Jane",
  "customer_last_name": "Doe",
  "success_url": "https://example.com/success",
  "failed_url": "https://example.com/failed"
}

Payments

• GET /api/v1/payments — list
• GET /api/v1/payments/{id} — retrieve
• POST /api/v1/payments/{id}/refund — body { "amount": 1200 } optional
• POST /api/v1/payments/{id}/cancel

Also: GET /api/v1/events and GET /api/v1/events/{id} for durable outbound events.