Charge a stored card token

POST 
/v1/checkout

Charges a previously tokenized card via the merchant's configured PSP (Coinflow today). The request is idempotent on idempotencyKey — re-submitting the same key + payload returns the cached response, while a key reused with a different payload is rejected with 409 Conflict.

On a 3DS challenge the response status is 3ds_required and includes a challengeUrl the SDK must surface to the customer.

Request

Responses

200

Charge captured or 3DS challenge required

400

Invalid or missing request parameters

401

Unauthorized. When returned from tokenization/checkout handlers this reflects an upstream credential or permission failure (for example BasisTheory), not a missing merchant API key on the request.

403

Forbidden (e.g. merchant account inactive)

404

Resource not found

409

Idempotency conflict — same key used with a different payload

429

Upstream rate limit exceeded. The response does not currently include a Retry-After header.

500

Internal server error

502

Upstream provider error (e.g. BasisTheory)