Create a payin (top-up charge)
Requires an approved account identity; person accounts need approved KYC and company accounts need approved KYB before this authenticated operation can create or charge a payin. Creates a fiat top-up. With method: "qr" (default) an active QR charge is generated through the processor — in Bolivia the local interoperable QR, in Brazil a dynamic PIX QR whose charge carries the QR image and the “copia e cola” payload. With method: "bank_transfer" the deposit is announced and the response carries the reference the sender must include so the arriving transfer is matched and credited automatically — a short 12-character alphanumeric code that fits any bank concept field (some rails cap it at 20 characters with no special characters). With method: "fintoc" (Chile) the response carries a hosted payment_url: the payer opens it and transfers from any Chilean bank or wallet; the deposit is detected, validated and credited automatically. With method: "card" the response carries a hosted payment_url for a 3-D Secure card checkout branded with your organization — Bolivia (BOB) and international cards in USD (country: "US", Visa, Mastercard, American Express, Discover and Diners issued anywhere); card data never touches your integration. When stored_card_id is absent, an open pending/challenge card session can be reused for the same account, country, currency, amount and payer_reference (falling back to customer.email), returning HTTP 200 with session_reused: true and the existing payment_url. Card sessions default to 60 minutes and accept explicit expiries up to 48 hours. The account cap is 50 open sessions; if unused zero-attempt pending sessions cannot be evicted, the response is 429 too_many_open_card_sessions. With method: "checkout" the response carries a public checkout_url — a branded universal checkout link denominated in the virtual balance of your choice (settlement_asset: USD, USDT, USDC, BTC, GOLD, SILVER or PLATINUM; fiat BOB/MXN/ARS are rejected). The payer picks any country with a live payin corridor (quoted local amount), any of the 4 crypto options (exclusive deposit address with a scannable QR), or pays instantly from the CBPay app via the merchant QR/alias; every payment is auto-converted to the settlement asset unless paid in the same asset. The first method that completes the payment wins. Charging is free; the payin fee applies when the deposit is credited. The live catalog may also expose PY/PYG, CO/COP, EC/USD and BR/BRL regional corridors. COP is integer-only; PYG, USD and BRL accept at most two decimals. BR/BRL/pix is a hosted redirect and requires payer name and document; its minimum is 1 BRL. wallet may be hosted or collect-only depending on the corridor.
Authorizations
Session JWT (from register/login) or API key (pk_...).
X-API-Key: <token> is accepted as an alternative header.
Headers
Alternative to the JSON idempotency_key. It is required for method: "card" when the body does not contain the key, and optional for QR charges. Do not send different values in the body and header.
256^[^\r\n]{1,256}$Body
Corridor country. Required for every method except checkout, where it is optional and only preselects the payer's country on the page.
"BO"
Corridor currency. Required for every method except checkout, which rejects it with 400 — the charge is denominated in settlement_asset.
"BOB"
Positive decimal string. Local currency amount for corridor methods; for checkout it is denominated in the settlement_asset ("50" USDT, "0.001" BTC, "2" grams of gold).
Optional channel hint passed to the core.
Charge expiration in seconds. For checkout it accepts 600 to 604800 (10 minutes to 7 days; default 24 hours).
Collection mode. qr creates an active QR charge through the processor; bank_transfer announces an incoming deposit and returns the reference to include in the transfer description; fintoc (Chile only) returns a hosted payment_url where the payer transfers from any Chilean bank or wallet and the deposit is detected automatically; pix (Brazil only) returns a hosted payment_url for a PIX redirect checkout (payer_name and payer_document required, minimum 1 BRL); card returns a hosted payment_url for a 3-D Secure card checkout (Bolivia in BOB, or international cards in USD when country is US); checkout returns a public checkout_url where the payer picks the payment method (QR, card, bank transfer or crypto). Use /v1/payins/collect for pull collections. wallet is hosted or collect-only depending on the corridor; collect-only flows do not return a payment URL.
qr, bank_transfer, fintoc, card, checkout, wallet, pix For method: "card", this key is required; send it in the body or as the Idempotency-Key header. It is optional for qr, bank_transfer, fintoc, pix and checkout methods. A retry with the same key returns the original payin with HTTP 200 and idempotency_hit: true — the same payment_url/checkout_url for hosted methods, or the SAME reference for an announced bank transfer — instead of opening a second charge. On announced transfers this decides whether the money can be credited: two live announcements with the same amount and no payer identity are indistinguishable, so the arriving deposit would stay unassigned. If you omit the key we still collapse an identical retry (same account, currency, amount and payer document) into the original announcement; send a distinct key when you really need two separate charges for the same amount and payer.
256^[^\r\n]{1,256}$Optional billing prefill for the card checkout (card method). The payer can complete or correct it on the page.
Show child attributes
Show child attributes
Optional public https URL (card and checkout methods) the payer is redirected to after an approved payment.
Optional public https URL (card and checkout methods) the payer is redirected to when the payment fails or expires.
Optional RFC3339 expiry for the card payment session (card method); at least 5 minutes ahead and no more than 48 hours from creation. Default 60 minutes.
Checkout only — the virtual balance the charge is denominated in and settles into. When omitted it resolves to your payin_settlement_asset (USD is the principal balance). Every payment is auto-converted to this asset on credit (same-asset payments skip conversion). Local fiat (BOB, MXN, ARS) is rejected. Must be enabled for your organization (422 settlement_asset_disabled otherwise).
USD, USDT, USDC, BTC, GOLD, SILVER, PLATINUM Card method only — offer the payer a "save this card" checkbox on the hosted page. The credential is stored ONLY if the payer ticks it (explicit consent) and the 3-D Secure payment is approved; the payin_received/payin_credited flow then carries a stored_credential block and the card appears in GET /v1/stored-cards.
Card method only — your own plain-text identifier for the payer (max 120 chars). It is the preferred identity for reusing an open pending/challenge card session; when absent, customer.email is used as the fallback. It scopes stored-card discovery and charges within the calling account; the same email or reference in another account cannot discover or use the credential.
120Card method only — pay with a previously saved card (see GET /v1/stored-cards). The hosted page skips card entry and shows the saved card; 3-D Secure still runs. Mutually exclusive with save_card. Unknown or revoked card, including a credential from another account, responds 404. The billing details saved with the credential are applied automatically on the hosted page (masked summary with an edit link — the payer retypes nothing).
Payer identity. Required for pix (Brazil hosted redirect); for announced bank transfers it is the optional name of the person or company that will send the transfer, when it is NOT the account holder.
140Payer identity. Required for pix (Brazil hosted redirect); for announced bank transfers it is the optional tax or national ID of the sender (at least 5 characters, one of them a digit): when you omit it the account holder's verified tax id is used, so a self-deposit is recognised even if the payer forgets the reference. Send it when a third party pays.
40Hosted or collect payer phone; required by some wallet methods.
40Announced bank transfer only — the sender's bank account number (at least 5 characters). Optional; it is an extra matching signal when the rail reports the originating account.
40Response
Idempotent replay of a QR or announced transfer (bank_transfer), or reuse of an open card session (card). QR and bank-transfer replays return the original payin with idempotency_hit: true; card reuse returns the existing payment_url and session_reused: true. No second charge or session is created.