Pay with token

To create new payment requests using the card token.

Step 1: Generate hash

The order hash is generated as explained in Request hashing. Append .{customerReference} to the signed string — it is required whenever card.save, card.cardToken, or card.agreement is present, and omitting it returns 403 INVALID_HASH_CHECK.

Step 2: Pay

Endpoint	Value
URL	`https://test-fep.kashier.io/v3/orders/`
Method	POST

Whenever you are ready for production, use the following production API endpoint URL instead.

Endpoint	Value
URL	`https://fep.kashier.io/v3/orders/`
Method	POST

curl -X 'POST' 'https://test-fep.kashier.io/v3/orders/' \
  -H 'accept: application/json' \
  -H 'Content-Type: application/json' \
  -H 'Kashier-Hash: your_generated_hash' \
  -d '{
  "apiOperation": "PAY",
  "paymentMethod": {
      "type": "CARD",
      "card": {
          "cardToken": "",
          "securityCode": ""
      }
  },
  "installments": {
      "planId": ""
  },
  "connectedAccount": {
      "merchantId": ""
  },
  "order": {
      "reference": "",
      "amount": "1",
      "currency": "EGP",
      "description": ""
  },
  "customer": {
      "reference": ""
  },
  "interactionSource": "ECOMMERCE",
  "reconciliation": {
      "webhookUrl": "",
      "merchantRedirect": "",
      "redirect": true
  },
  "metaData": {},
  "merchantId": "MID-12-34"
}'

Body structure

{
  "apiOperation": "PAY",
  "paymentMethod": {
      "type": "CARD",
      "card": {
          "cardToken": "123456789123456789",
          "securityCode": "",
          "enable3DS": true
      }
  },
  "installments": {
      "planId": ""
  },
  "origin": {
      "id": ""
  },
  "connectedAccount": {
      "merchantId": ""
  },
  "order": {
      "reference": "",
      "amount": "1",
      "currency": "EGP",
      "description": ""
  },
  "customer": {
      "reference": ""
  },
  "interactionSource": "ECOMMERCE",
  "reconciliation": {
      "webhookUrl": "",
      "merchantRedirect": "",
      "redirect": true
  },
  "metaData": {},
  "merchantId": ""
}

Body parameters

Parameter	Required	Description
`apiOperation`	Yes	`PAY` — a confirmation purchase against the saved token.
`paymentMethod.type`	Yes	`CARD`.
`paymentMethod.card.cardToken`	Yes	The saved card token, used instead of `paymentMethod.card.number`.
`paymentMethod.card.securityCode`	Conditional	The CVV. Mandatory when `interactionSource` is `ECOMMERCE`.
`paymentMethod.card.enable3DS`	No	Whether to run 3D Secure. Note it belongs inside `card`, not directly under `paymentMethod`.
`installments.planId`	No	Send only when paying with an installment plan. Omit `installments` entirely for a regular charge.
`origin.id`	No	Origin identifier. Required only when you send an `origin` object.
`connectedAccount.merchantId`	No	The Sub Merchant / connected account MID (`MID-…`) to charge on behalf of.
`order.reference`	Yes	Your merchant order ID.
`order.amount`	Yes	Order amount.
`order.currency`	Yes	`EGP`, `USD`, `GBP`, or `EUR`.
`order.description`	No	Order description.
`customer.reference`	Yes	Shopper reference. Mandatory for any token payment — and it must also be appended to the signed hash string.
`interactionSource`	Yes	Must be `ECOMMERCE`, `MOTO`, or `RECURRING` for direct card pay. Use `RECURRING` for merchant-initiated repeat charges.
`reconciliation.webhookUrl`	No	Per-request server webhook URL.
`reconciliation.merchantRedirect`	No	Where to send the customer afterwards (their receipt page).
`reconciliation.redirect`	No	Redirect to `merchantRedirect` once the transaction completes.
`metaData`	No	Arbitrary data echoed back in responses and webhooks.
`merchantId`	Yes	Your merchant ID (`MID-…`).

timestamp

Some published samples of this request also carry a top-level timestamp field. It is not in any documented field reference, so whether Kashier requires it is unconfirmed — we have left it out of the samples above rather than assert it. If you already send it, keeping it does no harm.

Headers

Key	Description
Kashier-Hash (String)	Order hash generated in Request hashing.

Full parameter and response reference → Pay with token.

Responses

With interactionSource MOTO (non-3DS), the payment is processed and captured directly.

With Ecommerce and 3DS, after a successful response you should redirect to authentication.redirectUrl to generate the 3DS page. As soon as the transaction has completed, it will redirect to merchantRedirectUrl if reconciliation.redirect was equal to true; otherwise use 3D Secure handling.

You can receive the transaction response after 3DS processing in the webhook.