Card Payments & Vaults
Charge cards with 3-D Secure into an account, and refund them in full or in part.
Depa acquires debit and credit card payments and settles the proceeds into an account on The Book. You collect the card details, create the payment from your server, and the customer completes authentication, including 3-D Secure, in an iframe.
PCI DSS
In this flow card numbers pass through your servers, so you need to be PCI DSS compliant. If you'd rather not handle card data, use Payment Links: Depa hosts the whole checkout.
1. Creating a Card Payment
Request
curl -X POST https://sandbox.depasify.com/api/v1/accounts/8f3a2c1e-5b7d-4e9a-9c21-7d4b6e0f1a23/card_payments \
-H "Authorization: Bearer <your_jwt_token>" \
-H "Content-Type: application/json" \
-d '{
"trx_uuid": "01976967-364c-7824-9046-d4dbd50e3daf",
"amount": 120.00,
"currency": "EUR",
"card_number": "4000000000002701",
"expiration_month": 8,
"expiration_year": 2028,
"cvc": "123",
"card_holder_name": "Jane Doe",
"address_line_1": "Calle de Alcalá 42",
"postal_code": "28014",
"city": "Madrid",
"country_code": "ES",
"success_redirect_url": "https://shop.example.com/checkout/success",
"failure_redirect_url": "https://shop.example.com/checkout/failure"
}'Response
{
"data": {
"id": "0197a671-4c41-70ac-b9e1-ea60b8c41403",
"transaction_reference": "TXN-1750844132-7146d1e6",
"trx_uuid": "01976967-364c-7824-9046-d4dbd50e3daf",
"amount": "120.0",
"currency": "EUR",
"status": "processing",
"continue_url": "https://sandbox.depasify.com/card_payments/0197a671-4c41-70ac-b9e1-ea60b8c41403",
"created_at": 1750844132
}
}2. Completing the Payment
Load continue_url in an iframe on your page. When the flow finishes, the iframe sends a
postMessage event to your page with the result:
<iframe src="https://sandbox.depasify.com/card_payments/0197a671-…" width="100%" height="500"></iframe>
<script>
window.addEventListener("message", (event) => {
// Show the outcome to your customer, then fetch the payment to confirm its status.
});
</script>3. Refunding a Card Payment
Leave amount out to refund everything still refundable, or send an amount for a partial refund.
You can refund several times until refundable_amount reaches 0:
curl -X POST https://sandbox.depasify.com/api/v1/accounts/8f3a2c1e-5b7d-4e9a-9c21-7d4b6e0f1a23/card_payments/0197a671-4c41-70ac-b9e1-ea60b8c41403/refund \
-H "Authorization: Bearer <your_jwt_token>" \
-H "Content-Type: application/json" \
-d '{ "amount": 25.50 }'The payment becomes partially_refunded, then refunded once nothing is left to refund.