Skip to content

Environments

EnvironmentAPI Base URL
Live (prod)https://gateway.paytalya.com
Testprovided at onboarding

All endpoints are versioned with the /v1 prefix. Example full address:

https://gateway.paytalya.com/v1/payments

The API surface (gateway.paytalya.com) is for server-to-server calls (with the API key). The handoff page the buyer’s browser/WebView talks to is a separate origin (pay.*), described below.

You collect the card on your own checkout, then redirect the buyer to Paytalya’s separate handoff page. The POST /v1/payments request body contains no card, and its response returns a handoffUrl: this is the handoff page address (the pay.* origin) you redirect the buyer’s browser/WebView to, with the card + paymentRef. Use the handoffUrl as-is from the response; do not assume a fixed value. The bank’s 3D Secure relay runs on that page.

After 3D completes, the handoff page redirects the buyer’s browser/WebView to the returnUrl you supplied in the POST /v1/payments request via 303. The result carried over the returnUrl is not authoritative; always obtain the definitive result via GET /v1/payments and webhook.

There is no difference on Paytalya’s side between web and mobile (web: native browser 303; mobile: the WebView lands on the same 303); on mobile deep links are not used. Detail: Card Handoff.

The payment’s window to complete 3D is 30 minutes; if it is not completed within that time, the payment moves to expired.