GIEP developer docs
For developers integrating a store, an order system or a back office with GIEP. Start with authentication and idempotency, then create a checkout session or wire up webhooks.
- AuthenticationSend a secret API key as a bearer token, from your servers only.
- IdempotencyCalls that move money or create a session carry an Idempotency-Key header.
- WebhooksSigned events, with verification code for Node.js, PHP and Python.
- Checkout from your siteYour server creates the checkout session and sends the shopper to the URL it returns.
- Signed return URLsVerify the giep_* parameters on the page the shopper returns to.
- API referenceEvery published endpoint, by tag, with parameters and examples.
Basics
- Base URL: the API host of the deployment, for example
https://api.<your GIEP domain>(staging:https://api.staging.giep.io). The OpenAPI document lists a placeholder server until the production domain is set. - JSON in and out (
Content-Type: application/json), except the CSV exports. - Amounts are integers in minor units of the currency: 4999 = 49.99 USD, 1000 = 1.000 KWD (three decimals). Never
send or expect floats. A
Moneyobject is{ "amount": 4999, "currency": "USD" }. - Times are ISO 8601 in UTC.
- IDs are UUIDs.
- Merchant routes are under
/v1./public/*routes are for the hosted checkout (the session token is the credential); you do not need them for a server integration.
TypeScript SDK
packages/sdk (@giep/sdk, server-side only, no runtime dependencies) wraps the API with types generated from the
OpenAPI document and includes verifyWebhook(rawBody, header, secret), which throws GiepWebhookError on any failure.
See packages/sdk/README.md.
The API reference is generated from the GIEP merchant API OpenAPI 3.1.0 document, version 0.1.0. The API serves the same document at /openapi.json. The hosted checkout calls a separate set of public routes, authenticated by the session token; a server integration does not need them, so they are not listed here.