}

Authorize payment with token

PUT https://checkout-eu-a.paysera.com/checkout/rest/v1/payment-requests/{id}/authorize

Authorize and capture a payment using a stored recurring billing token.

This endpoint is used for automated recurring charges. The token must be obtained from a previous successful payment with user interaction.

A successful charge returns status: "authorized", although the funds are already captured. GET /payment-requests/{id} and the payment_request.captured notification show captured.

A declined charge sends no notification. The reason is only in the synchronous error response, in error_description: Insufficient funds (HTTP 400), Failed to authorize payment, Invalid card number, Expired card or Restricted card (HTTP 409), all with error: "invalid_state". The payment request stays new. After a technical error or a timeout, repeat the request for the same payment request instead of creating a new one; see Repeating a request.

Authorization

This endpoint requires MAC (Message Authentication Code) authentication.

Authorization Header Format:

Authorization: MAC id="CLIENT_ID", ts="TIMESTAMP", nonce="RANDOM_STRING", mac="MAC_HASH", ext="body_hash=BODY_HASH"

Example:

Authorization: MAC id="a9b8c7d6e5f4g3h2", ts="1234567890", nonce="xyz123abc456def", mac="dGhpcyBpcyBhIHJhbmRvbSBtYWMgaGFzaCB2YWx1ZQ==", ext="body_hash=cmFuZG9tQm9keUhhc2hWYWx1ZQ%3D%3D"

For more details, see the Authentication section.

Parameters

Path Parameters

Name	Type	Required	Description
`id`	string	✓	Payment request ID to authorize

Request Body

Field	Type	Required	Description
`token`	string	✓	Recurring billing token obtained from initial payment

Repeating a request

When a request fails, times out, or returns an error, repeat it for the same payment request instead of creating a new payment request for the same charge. A repeated request checks the earlier attempt first:

while the earlier attempt's result is not known, the repeat answers 409 authorization_pending and does not charge the card again;
if the earlier attempt was declined, the repeat makes a new attempt;
if the earlier attempt was charged, the repeat completes the payment request with it, even when it is sent with another token. The payment request is then captured.

Limits

If Paysera can read the earlier attempt's state and its result is still not known about 15 minutes after it was made, a repeat stops waiting for it and makes a new attempt. Should the earlier attempt have gone through after all, the card is charged twice; Paysera logs such attempts for reconciliation.

If Paysera cannot read the earlier attempt's state, or finds a charge it cannot complete the payment request with automatically, repeats keep answering authorization_pending, as a new attempt could charge the card twice. If they still do about 15 minutes after the first attempt, the payment request needs Paysera support; see the stop rules below.

A new payment request for the same charge carries the same risk at any time, as it is not checked against the earlier one.

Repeat the request for the same payment request after an error, except after errors that repeating does not change: 400 invalid_parameters (for example "Checkout token not found"), 401 and 403. Fix the request or the token instead.

Stop repeating when:

the response is 200;
the payment request is not new any more, for example because an earlier request captured it or the payer paid on the payment page. The response is then 409 invalid_state "Requested action cannot be made to the current state of resource". As several answers share 409 invalid_state, you can instead get the payment request after any 409 invalid_state response and stop when its status is not new;
authorization_pending still comes back about 15 minutes after the first attempt. Do not create a new payment request for the same charge; contact Paysera support with the payment request ID;
the card is declined: 400 "Insufficient funds", or 409 "Failed to authorize payment", "Invalid card number", "Expired card" or "Restricted card". A repeat makes a new attempt that is likely to be declined again; ask the payer for another card, or after insufficient funds try again later, for example the next day;
"Unexpected issue occurred" comes back after a few repeats. The token may no longer be usable; ask the payer for another card.

The descriptions below explain the other errors, for example to decide when to notify the payer.

Status	`error`	`error_description`	Meaning
`409`	`authorization_pending`	Authorization result is not known yet. Repeat this request later, it resolves the pending authorization without charging the card again.	Repeat the same request later, for example after a minute. It can take several minutes for the result to become known; see the limits above.
`409`	`invalid_state`	Failed to authorize payment	The payment was declined or failed, and the card was not charged. When the authorization times out and the decline is found right after, in the same request, it is reported this way even for insufficient funds. A repeated request makes a new attempt, with the same or another token; see the stop rules above.
`409`	`invalid_state`	Invalid card number	The card was declined and not charged.
`409`	`invalid_state`	Expired card	The card was declined and not charged.
`409`	`invalid_state`	Restricted card	The card was declined and not charged.
`409`	`invalid_state`	Payment request was paid on the payment page	The payer paid this payment request on the payment page. A repeated request answers with the not-new error above.
`409`	`invalid_state`	Unexpected issue occurred, please try again later	Repeat the same request later. If it persists after a few repeats, the token may no longer be usable, for example when it was deactivated; ask the payer for another card.
`409`	`invalid_state`	Requested action cannot be made to the current state of resource	The payment request is not `new`. Get the payment request to see its status.
`400`	`invalid_state`	Insufficient funds	The card was not charged. A repeated request makes a new attempt; see the stop rules above.
`400`	`invalid_parameters`	Checkout token not found	The token does not exist. Do not repeat; use a valid token.
`403`	`forbidden`	Could not authorize client	The token was issued to another API client or project. Do not repeat.
`423`	`resource_locked`	Simultaneous requests, please try again later.	Another request for the same payment request is in progress. Repeat the request later.
`503`	`service_unavailable`	Service is unavailable.	The card was not charged. Repeat the request later.
`503`	`business_timeout`	Failed to fetch card settings	The card was not charged. Repeat the request later.

Example

Request

PUT https://checkout-eu-a.paysera.com/checkout/rest/v1/payment-requests/{id}/authorize
Content-Type: application/json
Authorization: MAC id="CLIENT_ID", ts="TIMESTAMP", nonce="RANDOM_STRING", mac="MAC_HASH", ext="body_hash=BODY_HASH"

{
  "token": "vLUGdTtnDjQs7Yv0fjYQyYfG60m"
}

Response

{
  "id": "def456payment",
  "status": "authorized",
  "order_id": "SUB_12345_MONTH_2",
  "price_paid": {
    "amount": "9.99",
    "currency": "EUR"
  },
  "payer": {
    "email": "customer@example.com",
    "name": "John",
    "surname": "Doe",
    "account_number": "EVP1234567"
  },
  "captured_at": "2025-12-15T11:45:30Z"
}

AUTHORIZATION: HTTP

REQUEST

Base URL

https://checkout-eu-a.paysera.com

Body REQUIRED

{
  "token": "vLUGdTtnDjQs7Yv0fjYQyYfG60m"
}

RESPONSE

Payment authorized and captured successfully

{
  "id": "def456payment",
  "status": "authorized",
  "order_id": "SUB_12345_MONTH_2",
  "price_paid": {
    "amount": "9.99",
    "currency": "EUR"
  },
  "payer": {
    "email": "customer@example.com",
    "name": "John",
    "surname": "Doe",
    "account_number": "EVP1234567"
  },
  "captured_at": "2025-12-15T11:45:30Z"
}

Note: The response shows status authorized although the funds are already captured. GET /payment-requests/{id} and the payment_request.captured notification show captured.

Authorization​

Parameters​

Path Parameters​

Request Body​

Repeating a request​

Example​

Request​

Response​