Skip to content

Integrations

Connect your way: API, hosted pages or no code

Pick the path that matches your team and your PCI scope. Build on the REST API, drop in a hosted checkout, send a Payment Link or upload a batch in the Business Portal, and let your AI coding tool read the real contract.

  • REST API
  • Stage sandbox
  • Signed webhooks
  • Public MCP server

Compare

Effort, PCI scope and best fit

A guide to help you shortlist. Your final PCI scope depends on how you capture and store card data; confirm it with your assessor.

  • Direct REST API

    Effort
    High: server-side build
    PCI scope
    Depends on how card data is captured; pair with Smart Fields or a hosted option
    Best for
    Platforms needing full control of pay-ins, payouts and FX
  • Hosted WebCheckout

    Effort
    Low: redirect
    PCI scope
    Minimal
    Best for
    Teams that want local methods live fast
  • Payment Links

    Effort
    Very low: no code
    PCI scope
    Minimal
    Best for
    Invoices, remote sales, one-off charges
  • Embedded iframe

    Effort
    Low to medium
    PCI scope
    Reduced
    Best for
    Branded checkout without handling card fields
  • Smart Fields JS SDK

    Effort
    Medium: front end plus server
    PCI scope
    Shared
    Best for
    Custom checkout design with hosted card fields
  • Business Portal batches

    Effort
    Very low: file upload
    PCI scope
    No card data involved
    Best for
    Finance and ops running payouts and virtual accounts
  • MCP server for AI tools

    Effort
    Low: add one URL
    PCI scope
    Not applicable: no payment data
    Best for
    Engineers using AI coding assistants

Sandbox (Stage) credentials are issued at the start of the partnership. Production access follows testing, a security review and business verification.

API in practice

A typical API pay-in, end to end

Four parties, six steps. Your backend only talks to one API; the local rail is handled for you.

  1. 1

    Merchant backendLocalpayment API:

    Authenticate

    POST /api/token/ returns a short-lived access token. Calls come from your server, from an allow-listed IP.

  2. 2

    Merchant backendLocalpayment API:

    Create the pay-in

    POST /api/payin/ with your own externalId, country, currency, amount and payment method.

  3. 3

    Localpayment APILocal rail:

    Route to the local rail

    Localpayment sends the request over the rail you enabled, such as Pix, SPEI or PSE.

  4. 4

    Local railLocalpayment API:

    Customer pays

    The rail confirms the payment. Real-time rails confirm in seconds, 24/7.

  5. 5

    Localpayment APIWebhook endpoint:

    Signed webhook

    A webhook with an X-Signature HMAC-SHA256 header announces the new status.

  6. 6

    Webhook endpointMerchant backend:

    Verify and update

    Check the signature, deduplicate on externalId or internalId, return 200 and update the order.

Simplified illustration with fictitious data. See the quickstart for the exact request and response fields.

Go live

From signed agreement to production

  1. Get Stage credentials

    Sandbox credentials arrive at the start of the partnership, so engineering can begin while the compliance review runs.

  2. Build and test in Stage

    Stage mirrors production with no real money. Use test cards, the virtual-account simulator and the Postman collection.

  3. Review and verify

    Production credentials follow completed testing, a security review and business verification.

  4. Go live in weeks

    Switch the base URL and credentials, allow-list your IPs and start. New markets are enabled by configuration, with no reintegration.

FAQ

Integration questions

Which path should we start with?

If you need control and have engineers, start with the REST API. If you want local methods live fast, use WebCheckout or Payment Links. You can combine paths on the same account.

Do you provide server SDKs?

There are no official server SDKs. The REST API is plain JSON over HTTPS, and the docs show cURL and Node.js examples. The only SDK is the client-side Smart Fields JS SDK.

How are API calls secured?

Calls use HTTPS from server-side environments with Bearer tokens and require IP allow-listing. Webhooks are signed with HMAC-SHA256 so you can verify they come from Localpayment.

How do we avoid duplicate charges?

Send your own unique externalId on every transaction. A duplicate returns HTTP 409, and webhook consumers should deduplicate on externalId or internalId.

How does this affect our PCI scope?

It depends on the path. Hosted WebCheckout and Payment Links keep scope minimal, the embedded iframe reduces it and Smart Fields shares it. Confirm the result with your assessor.

How can AI coding tools help?

Add the public, read-only MCP server at docs.localpayment.com/mcp to Cursor, VS Code, Claude or similar tools. They then read the documented API instead of guessing.

How long does integration take?

Stage credentials come at the start of the partnership and go-live takes weeks, depending on the path and your review cycles. Talk to sales for a plan for your case.

Start building today

Tell us your markets and your stack. We will recommend the integration path and set up your Stage credentials.

How can we help?

Download your copy

Leave your details and get the full edition instantly.