Live
Accept card payments with a simple, secure REST API.
Predictable JSON, idempotent writes, signed webhooks and a sandbox that behaves like production.
curl -X POST https://sandboxgateway.supapay.co.za/v1/deposit_sessions \
-H "Authorization: Bearer sp_test_4eC39HqLyjWDarjtT1" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: 7f9c2b1e-order-1001" \
-d '{
"amount": 15000,
"currency": "ZAR",
"return_url": "https://shop.example.co.za/thanks",
"customer_id": "cust_8fK2pQ1mZx",
"reference": "ORDER-1001"
}'Base URLs
Production
Livehttps://gateway.supapay.co.za/v1Sandbox
Sandboxhttps://sandboxgateway.supapay.co.za/v1API keys
| Key type | Sandbox | Production | Use |
|---|---|---|---|
| Secret key | sp_test_… | sp_live_… | Server-side only. Never expose. |
| Publishable key | sp_pk_test_… | sp_pk_live_… | Safe in browsers (SDK). |
Keep secret keys secret
Never put
sp_live_ keys in client-side code, mobile apps or public repositories.Choose your integration
Available
Hosted redirect
Redirect customers to the SupaPay hosted payment page. We capture card data and run 3-D Secure.
Most merchants · lowest PCI scope
Proposed
Embedded SDK
Secure, iframe-based card fields embedded directly in your checkout.
Custom checkout UX
Merchant PCI
API Proxy
Send raw card data server-to-server. Requires your own PCI DSS Level 1 attestation.
PCI-certified merchants