SteadFast Gateway

Links

OpenAPI 3 spec
SteadFast app simulator (demo users SF-100001 to SF-100006, PIN 1234; pay from the balance or a linked Visa / Mastercard)
Checkout SDK: steadfast.js
Health check

1 · Create a session on your server

curl -X POST $GATEWAY/api/v1/payments/create \
  -H "X-Client-Id: cli_demo_store" -H "X-Api-Key: sk_test_demo_store_key" \
  -H "Content-Type: application/json" -H "Idempotency-Key: ORD-1" \
  -d '{"order_details":{"order_number":"ORD-1","amount":20.50,"currency":"GBP"},
       "callback_url":"https://shop.example/webhooks/steadfast"}'

2 · Add the button to your checkout

<div id="steadfast-button"></div>
<script src="$GATEWAY/sdk/v1/steadfast.js"></script>
<script>
  SteadFast.Buttons({
    createPayment: () => fetch('/checkout/steadfast', { method: 'POST' }).then(r => r.json()),
    onSuccess: (p) => location.href = '/thank-you?order=' + p.order_number,
  }).render('#steadfast-button');
</script>

3 · Verify the webhook

Header SteadFast-Signature: t=<unix>,v1=<hex> where v1 = HMAC-SHA256(webhook_secret, t + "." + rawBody). Reject if older than 5 minutes. Answer 2xx; anything else is retried.