The OrderCard API is a small JSON API at https://api.ordercard.io. You use it from your server to charge cards that were vaulted with hosted fields, to capture, void and refund those charges, and to manage the gateways they go through.
Every request is authenticated with a secret API key that belongs to your team and to one environment, sandbox or live. The key decides which cards, gateways and transactions a request can see, so there is no team or environment parameter anywhere. Read Authentication first.
Resources
| Resource | What it is |
|---|---|
| Customers | Your customers, with OrderCard’s id (cus_…) and your own reference. |
| Payment methods | Vaulted cards, addressed by their token (tok_…). |
| Gateways | Your accounts at Fortis, NMI, Authorize.net, Converge, Deluxe, or the built-in test gateway (gw_…). |
| Transactions | Every purchase, authorization, capture, void, refund and verification (txn_…). |
| Webhook endpoints | Where OrderCard posts card and transaction events (we_…). |
A whole charge in three calls
# 1. Your page tokenizes the card with hosted fields and posts the token to your server.
# 2. Your server charges it through one of your gateways.
curl -X POST https://api.ordercard.io/v1/gateways/gw_01jaxr2d5f8g0h3j6k9m2n5p8q/purchase \
-H "Authorization: Bearer $ORDERCARD_SECRET_KEY" \
-H "Idempotency-Key: order-1001" \
-H "Content-Type: application/json" \
-d '{ "payment_method_token": "tok_01jaxqk0pz7r8w5m3n2b4c6d8e", "amount": 2500 }'
# 3. Later, refund part of it.
curl -X POST https://api.ordercard.io/v1/transactions/txn_01jaxs4h7k0m3p6r9t2v5x8z1b/refund \
-H "Authorization: Bearer $ORDERCARD_SECRET_KEY" \
-H "Content-Type: application/json" \
-d '{ "amount": 1000 }'Money only moves through this API. The dashboard shows every transaction but cannot charge, capture, void or refund.
Before you build
- Conventions covers amounts, ids, idempotency, pagination and rate limits.
- Errors lists every error shape and code.
- Testing has the sandbox test cards and the test gateway’s behaviour.