Overview
Inspect connection health, create setup handoffs, control checkout availability, and manage custom payment methods.
Payment-method APIs require a Sanctum token carrying the payment-method ability and matching team permission for the store selected by X-STORE. Tokens using the superseded payment_method ability are rejected. Existing administrators may continue using the stronger legacy store ability and permission.
Status responses are intentionally safe: status reports whether a provider is disconnected, configured, or enabled, while health_status reports disconnected, healthy, or attention-required state. Responses also include typed required-input metadata and actionable setup errors. They never return API keys, OAuth tokens, wallet addresses, webhook secrets, or provider credentials.
OAuth-style providers expose a connect_url handoff and a status_url that agents can poll. Enabling a disconnected method returns a validation error instead of accepting an unusable configuration.
NMI, Mercado Pago, Razorpay, Mollie, LiFi, and Bitcart-backed crypto methods support direct configuration through the configuration endpoint. Secret inputs are marked writeOnly in OpenAPI. Provider credentials are validated with the same setup services used by the dashboard; crypto wallet addresses and keys are sent to the existing Bitcart wallet setup flow.
Custom payment methods are separate store-scoped resources. Redirect destinations use the same dashboard validation rules, and clients cannot submit arbitrary storage paths for icons.