---
title: "OrderCard API"
description: "The OrderCard API for vaulted cards, gateways, transactions and webhook endpoints."
image: "https://docs.ordercard.io/og.png"
---

> API Reference Index
> Fetch the complete API index at: https://docs.ordercard.io/api/llms.txt
> Use this file to discover all available pages before exploring further.

# OrderCard API

The OrderCard API is a small JSON API at `https://api.ordercard.io`. You use it from your server to charge cards that were vaulted with [hosted fields](/hosted-fields), to capture, void and refund those charges, and to manage the gateways they go through.

Every request is authenticated with a **secret API key** that belongs to your team and to one environment, sandbox or live. The key decides which cards, gateways and transactions a request can see, so there is no team or environment parameter anywhere. Read [Authentication](/api/authentication) first.

## Resources

| Resource | What it is |
| --- | --- |
| [Customers](/api/customers) | Your customers, with OrderCard's id (`cus_…`) and your own reference. |
| [Payment methods](/api/payment-methods) | Vaulted cards, addressed by their token (`tok_…`). |
| [Gateways](/api/gateways) | Your accounts at Fortis, NMI, Authorize.net, Converge, Deluxe, or the built-in test gateway (`gw_…`). |
| [Transactions](/api/transactions) | Every purchase, authorization, capture, void, refund and verification (`txn_…`). |
| [Webhook endpoints](/api/webhook-endpoints) | Where OrderCard posts card and transaction events (`we_…`). |

## A whole charge in three calls

```bash
# 1. Your page tokenizes the card with hosted fields and posts the token to your server.

# 2. Your server charges it through one of your gateways.
curl -X POST https://api.ordercard.io/v1/gateways/gw_01jaxr2d5f8g0h3j6k9m2n5p8q/purchase \
  -H "Authorization: Bearer $ORDERCARD_SECRET_KEY" \
  -H "Idempotency-Key: order-1001" \
  -H "Content-Type: application/json" \
  -d '{ "payment_method_token": "tok_01jaxqk0pz7r8w5m3n2b4c6d8e", "amount": 2500 }'

# 3. Later, refund part of it.
curl -X POST https://api.ordercard.io/v1/transactions/txn_01jaxs4h7k0m3p6r9t2v5x8z1b/refund \
  -H "Authorization: Bearer $ORDERCARD_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "amount": 1000 }'
```

Money only moves through this API. The dashboard shows every transaction but cannot charge, capture, void or refund.

## Before you build

- [Conventions](/api/conventions) covers amounts, ids, idempotency, pagination and rate limits.
- [Errors](/api/errors) lists every error shape and code.
- [Testing](/testing) has the sandbox test cards and the test gateway's behaviour.

Source: https://docs.ordercard.io/api/index.mdx