--- title: "Payment API and webhooks · Fungies" description: "A REST API over products, orders, payments and subscriptions, with HMAC-signed webhooks. We stay Merchant of Record, so tax never enters your integration." image: "https://fungies.io/og-image.jpg" canonical: "https://fungies.io/payment-api/" --- Developers · Payment API # A payment API with the tax return already handled One REST API over products, offers, orders, payments, subscriptions and customers. Signed webhooks push every state change to your server. Underneath all of it we are the Merchant of Record, so VAT, GST and US sales tax never become code you have to write. [Start free](https://app.fungies.io/register) [Book a demo](https://calendly.com/duke-vuh/fungies-io-demo-clone) No upfront costs. No credit card required. Already selling with Fungies [![Leadsin.io](/logos/clients/leadsin.png)](/customer-story/hosted-checkout-solution-for-leadsin-io-a-saas-business "Leadsin.io — read the story")[![RenderAI](/logos/clients/renderai.png) ](/customer-story/helping-renderai-reduce-their-ai-saas-payment-integration-from-days-to-just-a-couple-of-minutes "RenderAI — read the story")[![SuperScale](/logos/clients/superscale.png) ](/customer-story/nimblebits-revenue-boost-with-a-web-store-solution "SuperScale — read the story")[![FreeVocals](/logos/clients/freevocals.png) ](/customer-story/freevocals-com-and-fungies-io-a-seamless-solution-for-digital-e-commerce "FreeVocals — read the story")![STATSCORE](/logos/clients/statscore.png)![SimFabric](/logos/clients/simfabric.png)![BotRix](/logos/clients/botrix.png)![Enhance AI](/logos/clients/enhance-ai.png)![The Humanize AI](/logos/clients/humanize-ai.png)![Kenerate AI](/logos/clients/kenerate.png) Two headers ## Authenticate, listen, fulfil A public key reads and a secret key writes. Everything that happens afterwards arrives at your endpoint as a signed POST, retried until you acknowledge it. [API reference](https://docs.fungies.io/api-reference/introduction) [Webhook guide](https://docs.fungies.io/developers/webhooks/overview) AuthenticateWebhook payloadVerify a deliveryFulfil an order ``` # The public key goes on every request. # Writes — POST, PATCH, DELETE — also carry the secret key. curl https://api.fungies.io/v0/orders \ -H "x-fngs-public-key: $FNGS_PUBLIC_KEY" \ -H "x-fngs-secret-key: $FNGS_SECRET_KEY" # Keys are issued at app.fungies.io/devs/api-keys. # 401 means the key is missing or wrong. 403 means it lacks the permission. # Plain HTTP is rejected outright. ``` ## What the API covers Products One-time purchases, subscriptions, memberships and game keys, each with variants and plans for the configurations you sell. Offers The price on top of a product: currency, billing interval, trial. Licence and game keys are uploaded against an offer and handed out on purchase. Orders List, retrieve, cancel and refund. Refunds can be partial, and archived records stay readable for reporting. Payments Every charge, renewal and refund as its own object. A payment still pending can be cancelled mid-checkout. Subscriptions Create, update with proration, pause collection, charge a one-off amount, end a trial early, and preview the next renewal before it happens. Users Customer records with billing details, plus the inventory of everything a given customer currently owns. Discounts Coupon codes and automatic sale discounts, fixed or percentage, returned with their usage statistics. Checkout elements Create the hosted, overlay or embedded checkout that your buy buttons point at, without opening the dashboard. Tax Ask what an offer costs a buyer in a given country with tax included, before they ever reach a checkout. Webhooks Register endpoints, choose event types, rotate secrets, fire a synthetic test event, and read the delivery history attempt by attempt. ## How a payment moves through it 1. 01 ### You describe what you sell A product holds the thing, variants and plans hold its configurations, and offers hold the price. One product can carry as many offers as you have price points. 2. 02 ### A checkout element opens Point a button at a checkout URL and choose hosted, overlay or embedded. Billing details, discount codes, quantities and your own custom fields can all be passed in at the moment it opens. 3. 03 ### We take the payment, and the liability Tax is calculated for the buyer's country, the charge is screened for fraud, and the sale is made under our name rather than yours. The contract, the filing and the chargeback are ours. 4. 04 ### Your server hears about it A POST signed with HMAC-SHA256 arrives at your endpoint within seconds. We allow thirty seconds per attempt and retry five times, and every delivery is recorded whether it succeeded or not. 5. 05 ### You reconcile from the API Events tell you that something changed, not what the state is now — deliveries are asynchronous and can arrive out of order. When it matters, read the object back and treat that as the answer. ## Why build on this one 01 ### The tax return is not part of your integration Most payment APIs stop at the charge and leave you a spreadsheet. As Merchant of Record we calculate, collect, remit and file VAT across 27 EU states, plus GST and US sales tax, and we take the audit that follows. 02 ### Webhooks that admit how distributed systems behave At-least-once delivery, five retries, and an idempotency key on every event. The documentation says outright which events can race each other and which one actually means money arrived, instead of leaving you to discover it in production. 03 ### Reading and writing are different keys A public key reads. A secret key is required for anything that changes state. The public one can survive being in a build; the secret one stays on your server, and the two rotate independently. 04 ### HTTP is not the only way in The same API backs a command-line tool, an MCP server for Cursor and Claude, a JavaScript SDK for checkout, and a WooCommerce plugin. Most integrations need less code than they were budgeted. ## Questions a developer asks first ### What is the base URL, and is the API versioned? ### How do I authenticate? ### How do I know a webhook really came from you? ### Which event should I fulfil an order on? ### What happens if my endpoint is down? ### Can I test without taking real money? ### Do I need the API at all? ## Build against it before you commit to it Create an account, generate a test key, and run a full purchase through the sandbox. Nothing is charged and no card is needed to get that far. [Start free](https://app.fungies.io/register) [Book a demo](https://calendly.com/duke-vuh/fungies-io-demo-clone) No upfront costs. No credit card required. ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://fungies.io/#organization","name":"Fungies","legalName":"Fungies Inc.","url":"https://fungies.io/","description":"Merchant of Record for SaaS, games, and digital products. Fungies handles global payments, VAT and sales tax, and checkout. Free to start, commission only.","slogan":"Tax-compliant payments for everything digital","logo":{"@type":"ImageObject","url":"https://fungies.io/brand/fungies-logo-black.svg"},"image":"https://fungies.io/og-image.jpg","address":{"@type":"PostalAddress","streetAddress":"2100 Geng Road, Suite 210","addressLocality":"Palo Alto","addressRegion":"CA","postalCode":"94303","addressCountry":"US"},"sameAs":["https://www.facebook.com/fungies.io","https://www.linkedin.com/company/fungies","https://twitter.com/fungies_io","https://t.me/fungies_announcements","https://discord.gg/yfH5ZyTZH4","https://www.youtube.com/@Fungies","https://www.tiktok.com/@fungies_io"],"contactPoint":[{"@type":"ContactPoint","contactType":"customer support","email":"support@fungies.io","url":"https://help.fungies.io/","availableLanguage":["en"]}]},{"@type":"WebSite","@id":"https://fungies.io/#website","name":"Fungies","url":"https://fungies.io/","description":"Merchant of Record for SaaS, games, and digital products. Fungies handles global payments, VAT and sales tax, and checkout. Free to start, commission only.","inLanguage":"en","publisher":{"@id":"https://fungies.io/#organization"}},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://fungies.io/"},{"@type":"ListItem","position":2,"name":"Payment API and webhooks","item":"https://fungies.io/payment-api"}]},{"@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What is the base URL, and is the API versioned?","acceptedAnswer":{"@type":"Answer","text":"https://api.fungies.io/v0. Endpoints are grouped by resource — /v0/products, /v0/orders, /v0/subscriptions and so on — and every request has to be HTTPS."}},{"@type":"Question","name":"How do I authenticate?","acceptedAnswer":{"@type":"Answer","text":"Two headers. x-fngs-public-key on every request, and x-fngs-secret-key on anything that writes. Keys are issued in the dashboard under Developers, public ones prefixed pub_ and secret ones sec_. A missing or wrong key returns 401; a valid key without the right permission returns 403."}},{"@type":"Question","name":"How do I know a webhook really came from you?","acceptedAnswer":{"@type":"Answer","text":"Every delivery carries an x-fngs-signature header: an HMAC-SHA256 of the raw request body using your webhook secret, prefixed with sha256_. Verify against the raw bytes — if you parse the JSON and re-serialise it before hashing, the signature will not match."}},{"@type":"Question","name":"Which event should I fulfil an order on?","acceptedAnswer":{"@type":"Answer","text":"payment_success, for both the initial charge and renewals. subscription_created can fire while the first payment is still pending, so fulfilling on that alone hands out access that was never paid for. Enable payment_success on every endpoint that grants anything."}},{"@type":"Question","name":"What happens if my endpoint is down?","acceptedAnswer":{"@type":"Answer","text":"We retry five times, allow thirty seconds per attempt, and expect any 2xx in reply. Delivery is at-least-once, so the same event can reach you twice — store the event id and skip anything you have already handled."}},{"@type":"Question","name":"Can I test without taking real money?","acceptedAnswer":{"@type":"Answer","text":"Yes. There is a sandbox with test payments, events carry a testMode flag so you can tell them apart, and you can fire a synthetic event of any type at your live endpoints to check the receiving end before a real purchase ever happens."}},{"@type":"Question","name":"Do I need the API at all?","acceptedAnswer":{"@type":"Answer","text":"No. The store, the checkout and the customer portal are configured visually, and a drop-in buy button is one HTML attribute. The API is for when the store needs to be part of your own product rather than sit beside it."}}]}]} ```