DOCUMENTATION API v2

Checkout sessions

Create a checkout session

POST/v2/orders/{orderId}/checkout-sessions

Issue another checkout link for an existing order. Creating a new session does not revoke previous sessions.

Required scope: orders_write

Authorization

API key · Send the complete secret in x-api-key.

Path parameters

orderIdstringrequired
The identifier returned by the creation request. Must belong to your merchant.

Header parameters

x-api-keystringrequired
Your server-side merchant secret key.
Content-Typerequired
application/json
Idempotency-Keystringrequired
16–128 letters, numbers, underscores or hyphens. Reuse the same key when retrying the same operation. Retry guidance.

Request body

expiresAtUTC timestampoptional
Optional; defaults to the earlier of 24 hours from now or order expiry. Must be future and no later than order expiry. Include milliseconds: YYYY-MM-DDTHH:mm:ss.sssZ.

Behavior

  • Send an empty JSON object {} to use the default expiry. Idempotency-Key is required; use a new key for each intended new session.
  • Every response includes X-Tyga-Request-Id. Save it with the sessionId and environment so support can trace the request across the gateway and checkout services.
  • A matching retry returns the original session, even if it has since expired or been revoked. Use a new idempotency key to request a new session while the order remains open.

Responses

200 OK · illustrative session. See errors and retry guidance.

Create a checkout session — TypeScript
// Node.js 22+. Run on your server, never in the browser.
const apiKey = process.env.TYGA_SECRET_KEY;
if (!apiKey) throw new Error('Set TYGA_SECRET_KEY');
const resourceId = process.env.ORDER_ID;
if (!resourceId) throw new Error('Set ORDER_ID');

const apiBase = process.env.TYGA_API_BASE;
if (!apiBase) throw new Error('Set TYGA_API_BASE from the API keys page');
const response = await fetch(`${apiBase.replace(/\/+$/, "")}/v2/orders/${encodeURIComponent(resourceId)}/checkout-sessions`, {
  method: 'POST',
  headers: {
    'x-api-key': apiKey,
    'Content-Type': 'application/json',
    'Idempotency-Key': 'order-1042-session-001',
  },
  body: JSON.stringify({}),
});
if (!response.ok) throw new Error(`Request failed: HTTP ${response.status}`);
const result = response.status === 204 ? null : await response.json();
// Use result in your server flow. Do not log checkout URLs or credentials.
200 OK · illustrative session
{
  "orderId": "11111111-1111-4111-8111-111111111111",
  "sessionId": "22222222-2222-4222-8222-222222222222",
  "checkoutUrl": "https://tyga-pay-checkout-dev.web.app/#checkout=<sessionId>.<secret>",
  "expiresAt": "2026-09-10T12:00:00.000Z"
}

Revoke a checkout session

DELETE/v2/checkout-sessions/{sessionId}

Disable a specific checkout link using its sessionId. This does not delete the order or revoke other sessions.

Required scope: orders_write

Authorization

API key · Send the complete secret in x-api-key.

Path parameters

sessionIdstringrequired
The identifier returned by the creation request. Must belong to your merchant.

Header parameters

x-api-keystringrequired
Your server-side merchant secret key.

Behavior

  • No body, query parameters or Idempotency-Key are needed. Success returns 204 with no response body.
  • Repeating revocation of a known, already-revoked session also returns 204. Unknown or other-merchant sessions return 404.

Responses

204 No Content. See errors and retry guidance.

Revoke a checkout session — TypeScript
// Node.js 22+. Run on your server, never in the browser.
const apiKey = process.env.TYGA_SECRET_KEY;
if (!apiKey) throw new Error('Set TYGA_SECRET_KEY');
const resourceId = process.env.SESSION_ID;
if (!resourceId) throw new Error('Set SESSION_ID');

const apiBase = process.env.TYGA_API_BASE;
if (!apiBase) throw new Error('Set TYGA_API_BASE from the API keys page');
const response = await fetch(`${apiBase.replace(/\/+$/, "")}/v2/checkout-sessions/${encodeURIComponent(resourceId)}`, {
  method: 'DELETE',
  headers: {
    'x-api-key': apiKey,
  },
});
if (!response.ok) throw new Error(`Request failed: HTTP ${response.status}`);
const result = response.status === 204 ? null : await response.json();
// Use result in your server flow. Do not log checkout URLs or credentials.
204 No Content
HTTP/2 204 No Content