API Reference

Base URL

https://api.rohopay.com

Authentication

Security Model & Hardening

RohoPay's API enforces the following security invariants — integrate with them in mind:

• API keys are server-side only. All /api/v1/* calls authenticate with Authorization: Bearer {api_key}. Never embed a live_ key in client-side code, mobile apps, or public repos. The card /api/v1/checkout endpoint takes api_key in the request body instead of the header.
• Dashboard sessions use a Secure cookie, not a JS token. Authenticated app calls (/dashboard/*, /api/v2/digital/*, /api/v2/plugins/*, /api/v2/reports/*) are authenticated by the httpOnly, Secure, SameSite=None rohopay_token cookie. The token is never returned in JSON responses, URLs, or localStorage.
• CORS is allowlist-only. The API reflects Access-Control-Allow-Origin solely for configured origins and sends Access-Control-Allow-Credentials: true for them. Unknown origins receive no CORS headers and are blocked by the browser.
• Currency is required and validated. Collection/checkout requests must supply a valid ISO-4217 currency. There is no silent default — an invalid or missing currency returns INVALID_CURRENCY.
• Refunds are strictly scoped. A refund must belong to the project and user on the API key; anything else is rejected with FORBIDDEN. Refund amounts are capped to the remaining refundable balance (computed inside the wallet lock).
• Withdrawals/disbursements are guarded. They enforce a per-day ceiling and a short in-flight window, computed under the wallet lock, to prevent double-spend.
• Idempotency is enforced on mutations. Send an Idempotency-Key header on create/pay/withdraw requests; duplicate keys are deduplicated rather than double-charged.
• Webhooks are the source of truth. Payment status from redirect query params is a UX hint only — always confirm final status via the webhook (HMAC-SHA256 in X-RohoPay-Signature) or a status poll. Provider webhooks are verified (x-webhook-secret for Iotec, HMAC for Relworx).

Response Envelope

All responses follow the same JSON structure:

{
  "success": true | false,
  "data": { ... },         // present when success: true
  "message": "...",        // optional human-readable message
  "error": {               // present when success: false
    "code": "ERROR_CODE",
    "message": "Human description",
    "reference": "RHP-..."  // optional transaction reference
  }
}

Complete Endpoint Index

Health

Authentication (User)

Payments API (v1)

Dashboard API (Session Auth)

Digital Products API (v2, Session Auth)

Public Checkout API (v2, No Auth)

WordPress Plugin API (v2, Session Auth)

Reporting API (v2, Session Auth)

Pagination

Endpoints that return lists accept optional query parameters: