Skip to content

Developers

One API. Every payment, done right.

Create checkout sessions, refund payments and receive signed events with one REST API and a typed TypeScript SDK. Integers for money, keys for every write, no surprises.

Get API accessSee the code
A developer at work in late afternoon light

Quickstart

Live in three calls.

  • 1

    Create an API key

    In Settings > API keys. The secret is shown once; keep it on your server.

  • 2

    Create a checkout session

    Send the cart in minor units with an idempotency key, then redirect the shopper to the URL.

  • 3

    Listen for order.paid

    Verify the signature, answer 200, fulfil. The redirect is a pointer, the event is the proof.

1 · Start a checkout

checkout.ts
// On YOUR server. The API key never reaches the browser.const res = await fetch(`${process.env.GIEP_API_URL}/v1/checkout-sessions`, {  method: 'POST',  headers: {    authorization: `Bearer ${process.env.GIEP_API_KEY}`,    'content-type': 'application/json',    // Same key on a retry = the same session, never a second one.    'idempotency-key': `order-${order.id}-session-v1`,  },  body: JSON.stringify({    checkoutId: process.env.GIEP_CHECKOUT_ID,    currency: 'AED',    // Amounts are integers in minor units: 24000 = 240.00 AED.    lineItems: [{ title: 'Glow serum 50 ml', quantity: 1, unitAmount: 24000 }],    externalOrderRef: order.id,    successUrl: 'https://shop.example/thanks',  }),});const { url } = await res.json(); // send the shopper here

2 · Trust only signed events

webhooks.ts
import { verifyWebhook } from '@giep/sdk'; // Use the raw body, exactly as received.app.post('/webhooks/giep', express.raw({ type: 'application/json' }), (req, res) => {  let event;  try {    event = verifyWebhook(req.body, req.header('GIEP-Signature'), process.env.GIEP_WEBHOOK_SECRET);  } catch {    return res.sendStatus(401); // unsigned or forged: rejected  }  res.sendStatus(200); // answer fast, work after  if (event.type === 'order.paid') fulfil(event.data); // deduplicate on event.id});

Designed for correctness

The rules that keep your integration safe.

  • Integers for money

    Every amount is in minor units with its currency. No floats, no rounding surprises, three-decimal currencies included.

  • Idempotency on every write

    Send an Idempotency-Key; a retry returns the same result instead of doing it twice.

  • Unknown is a status

    A processor timeout becomes unknown, not failed. GIEP reconciles it and tells you the truth with an event.

  • Signed webhooks

    GIEP-Signature is an HMAC of the timestamp and raw body. Reject anything that does not match.

  • At-least-once events

    Deliveries retry until you answer 2xx. Deduplicate on GIEP-Event-Id.

  • Typed SDK

    @giep/sdk wraps the API with generated types and verifyWebhook, server-side, no runtime dependencies.

Events

Know the moment anything changes.

  • payment.succeededA payment reached succeeded.
  • payment.failedA payment reached failed.
  • payment.unknownNo answer in time; reconciliation follows. Do not fulfil, do not retry with a new key.
  • order.paidA checkout order is paid. Fulfil on this.
  • refund.succeededA refund was confirmed by the processor.
  • alert.receivedA pre-dispute alert arrived.

Ready when your next order is.

See GIEP on your own store and processors. A 30-minute call, no slides.

Book a demoSee pricing