CleonPay

Quickstart

A working payment in three requests.

0. Get a key

No account yet? Apply. Approval takes under two working days and comes with a dashboard invite. From the dashboard you create your own API keys (sandbox immediately, live once enabled) and add webhook endpoints, each with its signing secret.

1. Take a payment

POST /v1/payments
curl https://api.cleonpay.com/v1/payments \
  -H "Authorization: Bearer ck_test_..." \
  -H "Idempotency-Key: order-1001" \
  -H "Content-Type: application/json" \
  -d '{
    "method": "ideal",
    "amount": 1050,
    "currency": "EUR",
    "country": "NL",
    "success_url": "https://shop.example.com/thanks",
    "error_url": "https://shop.example.com/failed",
    "reference": "order-1001",
    "customer": { "first_name": "Joe", "last_name": "Bloggs" }
  }'

To route a payment through a specific MID, pass its handle as mid. Your MIDs and their handles are listed in your dashboard under API keys; they are issued to your account individually, so they are not shown here. Omit mid to use your account's default MID. A handle that is not one of your enabled MIDs for the payment's method and currency is rejected with mid_not_available.

The response carries a redirect_url:

{
  "id": "3743881d-0fce-416c-b3de-8bc3f5d414b1",
  "object": "payment",
  "status": "awaiting_customer",
  "amount": 1050,
  "currency": "EUR",
  "method": "ideal",
  "redirect_url": "https://ideal.example/pay/...",
  "reference": "order-1001",
  "livemode": false
}

2. Send the customer there

Never render it in an iframe. The schemes forbid it, and banks break out of frames anyway. Redirect the browser.

3. Wait for the webhook

When the money moves we POST to your endpoint:

{
  "id": "evt_01H...",
  "type": "payment.settled",
  "created": "2026-08-21T13: 15: 26.438Z",
  "data": { "payment_id": "3743881d-0fce-416c-b3de-8bc3f5d414b1" }
}

Fetch the payment to see its full state, then release the goods.

Do not fulfil on the return URL. A customer landing on success_url means their browser came back, not that the payment settled. Only the webhook is authoritative.