AcmePay API

REST for writes, GraphQL for reads. OpenAPI spec: openapi.json.

Base URL (current)	`https://api.acmepay.duckdns.org/api/v2`
GraphQL	`https://api.acmepay.duckdns.org/graphql` (beta, read-only)
Sandbox	`https://sandbox.acmepay.duckdns.org` — isolated test data, resets nightly
Previous version	`/api/v1` — deprecated, sunset 2025-12-31. See legacy documentation.
Spec	OpenAPI 3.1 at /docs/openapi.json

Authentication

Production requests use short-lived bearer tokens. Exchange your dashboard credentials or client credentials at POST /api/v2/auth/token, then send:

Authorization: Bearer <token>

API keys issued in the developer portal look like apk_live_… (production) and apk_test_… (sandbox). The header X-AcmePay-Key is still accepted by /api/v1 only and will be removed with v1.

Core resources (v2)

Payments	`POST /api/v2/payments`, `GET /api/v2/payments/{id}`, `POST /api/v2/payments/{id}/capture`
Payouts	`POST /api/v2/payouts`, `GET /api/v2/payouts/{id}`
Customers	`GET/POST /api/v2/customers`
Webhooks	`GET/POST /api/v2/webhooks`, signed with `X-AcmePay-Signature`
Status	`GET /api/v2/status` — unauthenticated health check

Example request

curl https://api.acmepay.duckdns.org/api/v2/payments \
  -H "Authorization: Bearer $ACMEPAY_TOKEN" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d amount=4200 -d currency=gbp -d capture=true

Internal services

Endpoints under https://api.acmepay.duckdns.org/internal/ (reporting, reconciliation jobs) are reachable from the corporate network / VPN only and are not part of the public API. They are documented in the internal wiki.

Environments

Production	`api.acmepay.duckdns.org`
Sandbox	`sandbox.acmepay.duckdns.org` — safe for integration testing
Staging	internal only — do not point integrations here

Older guides, the Postman collection and v1 examples live in the legacy documentation.