Pay a sale

• Sandbox: POST https://sandbox.payme.io/api/pay-sale
• Production: POST https://live.payme.io/api/pay-sale

Credentials

• Request body field token (optional): A partner-level token to pay with instead of the card fields: the uuid from Create a partner-level token.

Overview

Charges a card, or a saved card, on a sale you created with generate-sale. Use it in the Direct API (PCI DSS Level 1 partners only) and to finish a Hosted Fields payment.

This call takes no credentials: PayMe finds the sale by payme_sale_id, and the price, currency and callback URLs come from the sale. Treat payme_sale_id like the payment link: share it only with the buyer who pays it.

Send either the card fields (credit_card_number, credit_card_exp, credit_card_cvv) with buyer_name and buyer_email, or a saved card in buyer_key (or a partner-level token). With buyer_key or token, PayMe uses the saved card's details and needs no CVV.

Reading the result

The response is synchronous. PayMe also sends the sale callbacks. Read status_code:

Before you call

• The sale must be initial or failed; otherwise the call returns error 305 with the sale's status in status_additional_info. An expired sale returns 367.
• Only card sales can be paid here: a sale created for another payment method returns error 2.
• A value that looks like a card number in any field other than credit_card_number is rejected with HTTP 400, error 20.
• Send one call per sale at a time. A second call while the first is still running returns HTTP 429, error 998.

Parameters

This endpoint takes no path, query or header parameters.

Request body

Content type: application/json

Request example

{
  "payme_sale_id": "SALEDEMO-XXXXXXXX-XXXXXXXX-XXXXXXXX",
  "credit_card_number": "5326105300985846",
  "credit_card_exp": "1230",
  "credit_card_cvv": "658",
  "buyer_name": "Israel Israeli",
  "buyer_email": "buyer@example.com",
  "buyer_social_id": "008336174",
  "language": "en"
}

Code samples

curl

curl -X POST 'https://sandbox.payme.io/api/pay-sale' \
  -H 'Content-Type: application/json' \
  --data-raw '{
  "payme_sale_id": "SALEDEMO-XXXXXXXX-XXXXXXXX-XXXXXXXX",
  "credit_card_number": "5326105300985846",
  "credit_card_exp": "1230",
  "credit_card_cvv": "658",
  "buyer_name": "Israel Israeli",
  "buyer_email": "buyer@example.com",
  "buyer_social_id": "008336174",
  "language": "en"
}'

Node.js

const response = await fetch("https://sandbox.payme.io/api/pay-sale", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "payme_sale_id": "SALEDEMO-XXXXXXXX-XXXXXXXX-XXXXXXXX",
    "credit_card_number": "5326105300985846",
    "credit_card_exp": "1230",
    "credit_card_cvv": "658",
    "buyer_name": "Israel Israeli",
    "buyer_email": "buyer@example.com",
    "buyer_social_id": "008336174",
    "language": "en"
  }),
});

console.log(await response.text());

Python

import requests

response = requests.post(
    "https://sandbox.payme.io/api/pay-sale",
    json={
        "payme_sale_id": "SALEDEMO-XXXXXXXX-XXXXXXXX-XXXXXXXX",
        "credit_card_number": "5326105300985846",
        "credit_card_exp": "1230",
        "credit_card_cvv": "658",
        "buyer_name": "Israel Israeli",
        "buyer_email": "buyer@example.com",
        "buyer_social_id": "008336174",
        "language": "en",
    },
)

print(response.text)

PHP

<?php

$body = <<<'BODY'
{
  "payme_sale_id": "SALEDEMO-XXXXXXXX-XXXXXXXX-XXXXXXXX",
  "credit_card_number": "5326105300985846",
  "credit_card_exp": "1230",
  "credit_card_cvv": "658",
  "buyer_name": "Israel Israeli",
  "buyer_email": "buyer@example.com",
  "buyer_social_id": "008336174",
  "language": "en"
}
BODY;

$ch = curl_init('https://sandbox.payme.io/api/pay-sale');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => $body,
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

Responses

200 — The payment result: paid (status_code 0), declined (1) or a 3D Secure challenge (5). A decline also returns HTTP 200. (success)

{
  "status_code": 0,
  "status_error_code": 0,
  "payme_status": "success",
  "payme_sale_id": "SALEDEMO-XXXXXXXX-XXXXXXXX-XXXXXXXX",
  "payme_sale_code": 1111111,
  "sale_created": "2026-11-09 10:15:02",
  "sale_status": "completed",
  "payme_sale_status": "completed",
  "sale_type": "Sale",
  "sale_payment_method": "credit-card",
  "currency": "ILS",
  "price": 10000,
  "transaction_id": "order-1234",
  "sale_description": "Shirt",
  "sale_deferred_months": null,
  "is_token_sale": false,
  "payme_signature": "b71e**************ca5a",
  "payme_transaction_id": "TRANDEMO-XXXXXXXX-XXXXXXXX-XXXXXXXX",
  "payme_transaction_total": "10000",
  "payme_transaction_card_brand": "Mastercard",
  "payme_transaction_auth_number": "0123456",
  "payme_transaction_voucher": "111111",
  "payme_transaction_emv_uid": null,
  "payme_transaction_acquirer": "PayMe",
  "payme_transaction_auth_source": "VoiceMail",
  "payme_transaction_card_issuer": "Isracard",
  "payme_transaction_credit_type": "RegularCredit",
  "buyer_name": "Israel Israeli",
  "buyer_email": "buyer@example.com",
  "buyer_phone": null,
  "buyer_card_mask": "532610******5846",
  "buyer_card_exp": "1230",
  "buyer_card_is_foreign": false,
  "buyer_social_id": "008336174",
  "installments": 1,
  "transaction_first_payment": 10000,
  "transaction_periodical_payment": 0,
  "transaction_arn": null,
  "sale_paid_date": "2026-11-09 10:16:40",
  "sale_release_date": null,
  "sale_3ds": false,
  "session": "Ab12Cd34",
  "redirect_url": null,
  "cancel_url": null
}

400 — Error 20: a card-like number in a field other than credit_card_number. Error 367: the sale has expired. (error)

{
  "status_code": 1,
  "status_error_details": "The sale has expired",
  "status_additional_info": "",
  "status_error_code": 367,
  "session": "Ab12Cd34"
}

429 — Error 998: another call for this sale is still running, or too many requests. Wait, then check the sale before retrying. (error)

{
  "status_code": 1,
  "status_error_details": "Operation is not permitted",
  "status_additional_info": "Duplicated action detected, please retry later",
  "status_error_code": 998,
  "session": "Ab12Cd34"
}

500 — Request errors. 1: a required field is missing (named in status_additional_info). 350: no sale has this payme_sale_id. 305: the sale isn't initial or failed. 354, 355, 356: invalid CVV, card number or expiry. 37: invalid buyer_zip_code. 351: invalid installments. 2: the sale isn't a card sale. 357: buyer_key or token sent on a token sale. 600, 604, 605: the saved card doesn't exist, is no longer active, or belongs to another seller. (error)

{
  "status_code": 1,
  "status_error_details": "Cannot perform action due to an incorrect status",
  "status_additional_info": "completed",
  "status_error_code": 305,
  "session": "Ab12Cd34"
}