Charge a Hosted Fields token

• Sandbox: POST https://sandbox.payme.io/api/generate-sale
• Production: POST https://live.payme.io/api/generate-sale

Credentials

• Request body field seller_payme_id (required): The seller's MPL. Send it in the JSON body: generate-sale doesn't read the PayMe-Merchant-Key header, so a request without a body MPL returns error 1. Partners may send seller_id with payme_client_key instead.
• Request body field payme_client_key (optional): Partners only: your partner key (or send the PayMe-Partner-Key header). With seller_payme_id, the seller must belong to you, otherwise error 20.

Overview

Charges the token that instance.tokenize() returned, from your server, in one call: send it as buyer_key. There is no payment page and no sale_url. Read the result from status_code: a declined charge also returns HTTP 200.

POST https://sandbox.payme.io/api/generate-sale (production: https://live.payme.io/api/generate-sale), with a JSON body (Content-Type: application/json).

This is the server step of the Hosted Fields guide. The same call charges any saved token; see Save a card and charge it later.

Credentials

Send seller_payme_id (the MPL) in the JSON body: this endpoint doesn't read the PayMe-Merchant-Key header, so a request without a body MPL returns error 1. Partners add payme_client_key (or the PayMe-Partner-Key header) and may name the seller by seller_id instead. See Authentication.

What to expect

• Success: status_code: 0 and the sale and transaction fields, the same as the callback.
• Decline: HTTP 200 with status_code: 1, status_error_code (for example 20004) and status_error_details.
• Every call creates a new sale, even when the charge is refused. Check the sale before you retry; see Idempotency and Retries.
• The token's own payment method is used.
• Errors: buyer_key with capture_buyer returns 601, with sale_type token/seller-token 602, with template 606, and with multi-capture 357. A token of another seller returns 605; an inactive or already-used single-use token returns 604; a charge over the seller's processing limit returns 130.
• Never put card numbers in any field (error 20), and don't send the legacy price field (major units; it overrides sale_price).

Callbacks

When the sale is paid, PayMe sends a POST with an application/x-www-form-urlencoded body to sale_callback_url. The notification types and fields are on Callbacks.

Issuing an invoice to a business

With the invoicing service active on the account, send buyer_business_name and buyer_business_code to issue the invoice to a business. Send both, or neither.

Parameters

This endpoint takes no path, query or header parameters.

Request body

Content type: application/json

Request example

{
  "seller_payme_id": "MPLDEMO-MPLDEMO-MPLDEMO-1234567",
  "buyer_key": "BUYERDEMO-BUYERDEMO-BUYERDEMO-1234567",
  "sale_price": 1000,
  "currency": "ILS",
  "product_name": "Smartphone",
  "transaction_id": "order-1001",
  "installments": "1",
  "sale_callback_url": "https://your-server.example.com/payme/callback",
  "language": "en"
}

Code samples

curl

curl -X POST 'https://sandbox.payme.io/api/generate-sale' \
  -H 'Content-Type: application/json' \
  --data-raw '{
  "seller_payme_id": "MPLDEMO-MPLDEMO-MPLDEMO-1234567",
  "buyer_key": "BUYERDEMO-BUYERDEMO-BUYERDEMO-1234567",
  "sale_price": 1000,
  "currency": "ILS",
  "product_name": "Smartphone",
  "transaction_id": "order-1001",
  "installments": "1",
  "sale_callback_url": "https://your-server.example.com/payme/callback",
  "language": "en"
}'

Node.js

const response = await fetch("https://sandbox.payme.io/api/generate-sale", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "seller_payme_id": "MPLDEMO-MPLDEMO-MPLDEMO-1234567",
    "buyer_key": "BUYERDEMO-BUYERDEMO-BUYERDEMO-1234567",
    "sale_price": 1000,
    "currency": "ILS",
    "product_name": "Smartphone",
    "transaction_id": "order-1001",
    "installments": "1",
    "sale_callback_url": "https://your-server.example.com/payme/callback",
    "language": "en"
  }),
});

console.log(await response.text());

Python

import requests

response = requests.post(
    "https://sandbox.payme.io/api/generate-sale",
    json={
        "seller_payme_id": "MPLDEMO-MPLDEMO-MPLDEMO-1234567",
        "buyer_key": "BUYERDEMO-BUYERDEMO-BUYERDEMO-1234567",
        "sale_price": 1000,
        "currency": "ILS",
        "product_name": "Smartphone",
        "transaction_id": "order-1001",
        "installments": "1",
        "sale_callback_url": "https://your-server.example.com/payme/callback",
        "language": "en",
    },
)

print(response.text)

PHP

<?php

$body = <<<'BODY'
{
  "seller_payme_id": "MPLDEMO-MPLDEMO-MPLDEMO-1234567",
  "buyer_key": "BUYERDEMO-BUYERDEMO-BUYERDEMO-1234567",
  "sale_price": 1000,
  "currency": "ILS",
  "product_name": "Smartphone",
  "transaction_id": "order-1001",
  "installments": "1",
  "sale_callback_url": "https://your-server.example.com/payme/callback",
  "language": "en"
}
BODY;

$ch = curl_init('https://sandbox.payme.io/api/generate-sale');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => $body,
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

Responses

200 — Token charged. The response holds the sale and transaction fields, the same as the callback, and has no sale_url. (success)

{
  "status_code": 0,
  "payme_status": "success",
  "status_error_code": 0,
  "payme_sale_id": "SALE1700-000000AA-EXAMPLE1-SALE0001",
  "payme_sale_code": 12345678,
  "sale_status": "completed",
  "sale_type": "Sale",
  "sale_payment_method": "credit-card",
  "price": 1000,
  "currency": "ILS",
  "transaction_id": "order-1001",
  "is_token_sale": false,
  "payme_signature": "f8ffc5bb45fe6c3ad326c439f1a21c28",
  "payme_transaction_id": "TRAN1700-000000AA-EXAMPLE1-TXN00001",
  "payme_transaction_total": 1000,
  "payme_transaction_auth_number": "0123456",
  "buyer_card_mask": "455743******3431",
  "installments": 1,
  "sale_paid_date": "2026-11-09 10:15:02",
  "sale_3ds": false
}

200 — Declined. A declined token charge returns HTTP 200; check status_code. (error)

{
  "status_code": 1,
  "status_error_code": 20004,
  "status_error_details": "Refusal by credit company. Please try a different card",
  "payme_sale_id": "SALE1700-000000AA-EXAMPLE1-SALE0001",
  "sale_url": "https://sandbox.payme.io/sale/generate/SALE1700-000000AA-EXAMPLE1-SALE0001"
}

500 — Request refused. Most request errors return HTTP 500 with status_code: 1; some return 400, 403, 422 or 429. See Errors. (error)

{
  "status_code": 1,
  "status_error_details": "Seller was not found",
  "status_additional_info": "seller_payme_id",
  "status_error_code": 251,
  "session": "AtsJ0as5"
}