This section is intended for developers who are integrating the Paisr API into an e-commerce or SaaS platform. If you are looking to integrate payments for a single business, use the go-live checklist to get started.
Paisr 💜 developers. Whether you're building a simple plugin, an e-commerce platform, or a custom integration that lets your merchants accept payments and manage their Paisr accounts — we want to support you and your community.
This guide covers how to get access, what you'll need, and how to reach us when you need help.
What is a Partner Integration?
A partner integration is any software built by a third party that accesses the Paisr API on behalf of merchant accounts. Common examples include:
- E-commerce plugins — WooCommerce, OpenCart, Shopify apps, and similar
- Platform connectors — SaaS platforms that let their merchants connect a Paisr account
- Custom clients — bespoke integrations built for a specific merchant or industry
Merchants who use your integration grant it access to their account through an access token with scoped permissions. Your integration then makes server-side API calls on their behalf.
Get a Sandbox Account
All partner integrations start with a sandbox environment. Visit dashboard.staging.paisr.tech if you already have a sandbox account. To request access, reach out to our team:
- Email: support@paisr.tech
- Subject line:
Partner Integration Request — [Your Integration Name]
Include a brief description of what you're building and the merchant use case it serves. We'll provision a sandbox account and walk you through the onboarding process with you.
We aim to respond to all partner requests within one business day as we're genuinely excited to see what you build.
API Reference
The full Paisr API is described in an OpenAPI 3.1 spec hosted publicly on our GitHub:
https://github.com/paisrtechnologies/pcb-openapiYou can use this spec to:
- Generate typed client SDKs in any language using tools like Swagger
- Import it into Postman, Insomnia, or any OpenAPI-compatible client
- Power your own documentation using tools like Redoc or Scalar
The full reference is available at API Reference.
Authentication
Merchants authenticate API calls using Bearer tokens scoped to specific permissions. Your integration should guide the merchant through creating an access token with only the scopes it needs — never request broader access than necessary.
See the Permissions reference for the full list of available scopes.
Storing Access Tokens
Merchant access tokens are sensitive credentials that grant access to a merchant's Paisr account. Your integration is responsible for keeping them safe — treat them with the same level of care as passwords or private keys.
Keys expire 90 days after creation. Include steps to request a new token to prevent downtime.
Do:
- Encrypt before storing. Use an authenticated encryption scheme such as AES-256-GCM before writing any token to your database. Manage the encryption key separately through a dedicated secrets service — AWS KMS, HashiCorp Vault, Azure Key Vault, or GCP Secret Manager — so that a database breach alone does not expose usable credentials.
- Keep tokens server-side only. Tokens must never be sent to the browser, stored in cookies, or bundled into a frontend application.
- Rotate your data encryption key regularly and re-encrypt stored tokens when you do.
Don't:
- Store tokens as plaintext in a database, config file, or
.envfile that isn't itself protected. - Log tokens — in application logs, request logs, or error tracking tools.
- Transmit tokens to the client browser for any reason.
If you experience a data breach or security incident involving merchant tokens, immediately notify the affected merchants and contact security@paisr.tech so we can revoke compromised credentials before they are misused.
Technical Support
Once you have a sandbox account, you can reach our developer team through the same support channel:
- Email: support@paisr.tech
- Subject line:
Partner Technical Support — [Your Integration Name]
We're happy to review your integration architecture, answer questions about the API, or debug unexpected behaviour together. Don't hesitate to reach out early — we'd rather help you get it right the first time.
Before you go live
Before your integration goes live with real merchants:
- Review the Best Practices guide
- Confirm your User-Agent header follows the required format
- Test all API calls from a server environment, not the browser
- Verify that access token scopes are minimal and merchant-controlled
- Notify us so we can monitor your rollout and be available if anything comes up