rostopay Documentation & API
rostopay is non-custodial biometric payment infrastructure. Your buyer authorizes with their live face on their own device; money moves bank-to-bank over RTP® and lands in the merchant account as an instant cash payment. You never touch card numbers, PCI scope or chargebacks.
Quickstart — 4 lines
Drop the SDK on your checkout. The rosto-pay button renders next to your other payment methods and handles the full face flow.
That's it. On success the buyer sees the receipt, you receive a charge.settled webhook, and the money is already in your account — cash, final, no card networks in between.
Test mode & test faces
Keys prefixed pk_test_ run the entire flow against the sandbox — no real banks, no real faces. Use the built-in test personas to exercise every outcome:
Test charges appear in the dashboard with a TEST badge and anchor to the Polygon Amoy testnet.
Checkout SDK
The web component accepts attributes for amount, metadata and callbacks. Events fire at every step so your UI can react.
Payment links — no code
A payment link is a URL that is a checkout. Create one in the dashboard (or via API), send it by text, email, WhatsApp or a QR — the buyer opens it, glances, and you're paid. Perfect for invoices, services, social selling and anyone without a website.
Links can be single-use or reusable, carry an expiry, and settle exactly like SDK charges — instant cash, webhook, verifiable receipt.
QR & in-person
Every payment link renders as a QR in the dashboard — print it at the counter, on the valet ticket or the table tent. For fixed points of sale, the merchant terminal shows a rotating QR bound to your register. The buyer scans with their phone camera; the face flow runs on their device, so you need zero hardware.
Already on Shopify, WooCommerce, Square, Toast or another platform? rostopay plugs in without code — see all Integrations →
Authentication
The API is REST over HTTPS at api.rostopay.com. Authenticate with your secret key as a bearer token. Secret keys (sk_live_…) live only on your server — the public key in the SDK can't move money.
Charges
A charge is created by the SDK or a payment link when the buyer's face authorizes. You read them; you don't create them server-side — only a live face can.
List with GET /v1/charges?from=…&to=… — cursor-paginated, filterable by status, location and register.
Refunds
Full or partial. The refund is a new bank-to-bank push back to the buyer, chained to the original proof hash — so it's publicly verifiable too.
Errors
Standard HTTP codes plus a machine-readable body. The ones you'll actually see:
Events
Register an endpoint in the dashboard and rostopay POSTs signed JSON on every state change:
Signatures & retries
Every delivery carries a Rosto-Signature header (HMAC-SHA256 of the body with your endpoint secret). Verify it before trusting the payload. Failed deliveries retry with exponential backoff for 72 hours; events are idempotent by event_id.
Libraries & SDKs
Changelog & versions
The API is date-versioned — pin yours with the Rosto-Version header. Breaking changes only ship in new versions; the SDK auto-updates within a major.
cancelled event; button renders 40% faster on low-end Android./v1/invoices, /v1/estimates) with public status; invoice.paid webhook.delivery-address="sync" now returns a structured address object; legacy string form still accepted in v3.page= pagination (removed 2027-01-01).