Compare the 12 best payment APIs for developers in 2026, from unified platforms to payout-only tools.
Getting your payment API wrong is one of the most expensive infrastructure mistakes you can make.
But choosing a payment API is not easy. The choice comes down to a handful of architectural decisions: do you need to accept payments, pay people out, or both? Do you want a unified API, or are you prepared to integrate a suite of separately versioned ones for more control? Do you build your own checkout UI, or drop in something prebuilt?
Here's a look at the best payment APIs for developers in 2026, what to look for, and how to pick the right one for your use case.
How we chose and evaluated these payment APIs
For the following list of top payment APIs, we included the providers developers most frequently use, and compared them against one another.
We grouped the payment APIs into four categories: full-stack, unified APIs that handle checkouts and payouts together, modular API suites built for larger engineering teams, payout-only infrastructure, and bank debit or recurring payment specialists.
Every feature claim below is verified against the provider's own documentation as of September 2026.
Payment APIs compared
| API | Money direction | API structure | SDK languages | Sandbox + docs quality | Pricing transparency |
|---|---|---|---|---|---|
| Whop | Accept + payout | Single unified API | TypeScript, Python, Ruby | Sandbox + API Playground; clear docs | Public |
| Stripe | Accept + payout (via Connect) | Single unified API | Ruby, Python, Go, Java, Node.js, PHP, .NET | Sandbox; extensive docs | Public |
| Checkout.com | Accept + payout | Single unified API | Go, Java, .NET, Node.js, PHP, Python, Ruby | Sandbox; clear docs | Quote |
| PayPal | Accept + payout (multi-party) | Suite of REST APIs, one credential set | .NET, Java, PHP, Python, Ruby, TypeScript | Sandbox; clear docs | Public |
| Square | Accept + payout | Single unified API | PHP, Java, Python, Node.js, Ruby, .NET, Go | Sandbox; clear docs | Public |
| Adyen | Accept + payout | Suite of independently-versioned APIs | PHP, Java, Node.js, .NET, Go, Python, Ruby | Sandbox; interactive API Explorer | Partial |
| Airwallex | Accept + payout | Two APIs (Client + Partner) | Node.js only (server-side, beta) | Sandbox; clear docs | Public |
| Worldpay | Accept + payout | Modular APIs, individually or orchestrated | PHP, Java, .NET, Python | Sandbox; docs spread across product areas | Quote |
| Tipalti | Payout only | Single unified API | No general-purpose SDK | Sandbox; clear docs | Partial |
| Trolley | Payout only | Single unified API | JavaScript, PHP, Ruby, Python, Java, C# | Sandbox; clear docs | Public |
| Dwolla | Accept + payout (bank-to-bank) | Single unified API | Node, Ruby, Python, PHP, C#/Kotlin, TypeScript | Sandbox; clear docs | Quote |
| GoCardless | Accept (recurring bank debit) | Single API, Merchant/Partner paths | Ruby, Python, PHP, Java, .NET, Node.js, Go, iOS, Android | Sandbox; clear docs | Public |
12 best payment APIs, from full-stack to payout-only
Full-stack, unified payment APIs
Handle checkout and payouts together in one API.
Whop

The Whop API covers the full payment lifecycle: checkout, saved payment methods, refunds, disputes, and withdrawals, meaning platforms and marketplaces can manage both sides of a transaction from one integration.
Whop API features:
- Embedded and link-based checkout: create shareable checkout links in seconds, or embed checkout into your own site using a React component or script tag so customers can complete purchases from your site.
- Sub-merchant onboarding and identity verification: onboard sellers as sub-merchants under your account, and generate short-lived onboarding links that walk them through identity verification before they're set up to get paid.
- Saved payment methods and off-session charging: save a customer's payment details during checkout, then charge them later without them being active on your site (for subscriptions and recurring billing).
- Webhooks for the full payment lifecycle: real-time events let your system react to payment and payout status changes.
- Payouts and virtual card issuing: route earnings to sellers or creators, and issue cards tied to their balance.
- Embedded components: prebuilt, customizable components for checkout, KYC, and payout components for use inside your own product.
Creating a one-time charge with Whop:
import Whop from '@whop/sdk';
const client = new Whop({
apiKey: process.env['WHOP_API_KEY'], // This is the default and can be omitted
});
const payment = await client.payments.create({
company_id: 'biz_xxxxxxxxxxxxxx',
confirmation_token: 'confirmation_token',
plan: { currency: 'usd' },
});
console.log(payment.id);
Charges in one call. Requires a confirmation_token collected client-side. Idempotency: Idempotency-Key header (Experimental API)
Under the hood:
- Auth: Account/Company API keys (scoped) or OAuth 2.1 + PKCE
- Rate limits: 600 req/min per credential per operation (429 on breach)
- Webhooks: signed via
webhook-signatureheader; delivered at-least-once (dedupe onwebhook-id); failed deliveries retried 12 times over ~71 hours, then the endpoint is auto-disabled if failures continue for 72 hours with 10+ deliveries failed - API request retries: SDKs auto-retry connection errors, 408/409/429, and 5xx with exponential backoff
- Versioning: dated
api_version_datepin, similar to Stripe's approach - Idempotency: supported via an
Idempotency-Keyheader on POST requests (currently documented under Whop's Experimental API); a successful response is cached and replayed for 24 hours on retry
Whop's SDKs are available in TypeScript, Python, and Ruby, and the API Playground in the developer docs lets you test endpoints before writing any code.
The Whop API is best for developer teams building a platform or marketplace that needs to onboard users, KYC, accept payments, and pay them out from a single integration.
Stripe
Stripe offers one unified set of REST APIs for accepting payments, managing billing and subscriptions, sending payouts, and building other financial workflows.
For platforms and marketplaces, that same API supports Stripe Connect, which adds support for onboarding multiple sellers, splitting a payment between parties, and paying each of them out.
Stripe Connect features:
- Connected account management: programmatically onboard sellers, run identity verification, and set routing rules across multiple connected accounts.
- Flexible fund routing: split a single payment between parties and set custom fees per transaction, without extra code.
- Webhooks: real-time event notifications across the payment lifecycle mean your system doesn't need to continually check for status updates.
- Sandbox environments: test payment flows safely before going live, without affecting real data.
- Embedded components: prebuilt, customizable components (Elements, Connect embedded components) for checkout, onboarding, and payout management, so sellers can view balances and request payouts inside your own product.
Creating a PaymentIntent with Stripe:
curl https://api.stripe.com/v1/payment_intents \
-u "sk_test_wsFx86XDJWwmE4dMskBgJYrt:" \
-d amount=1099 \
-d currency=usd
Creates a $10.99 PaymentIntent. Two steps: confirmation and payment-method collection happen client-side, which is how 3DS/SCA is supported. Idempotency: Idempotency-Key.
Under the hood:
- Auth: secret API key (Basic Auth style); restricted keys available to scope access
- Rate limits: 100 req/sec globally in live mode, 25/sec in sandbox; individual endpoints carry their own tighter limits (e.g., 1,000 update operations per PaymentIntent per hour)
- Webhooks: signed (
Stripe-Signatureheader); at-least-once delivery; retried for up to 3 days with exponential backoff in live mode, 3 attempts over a few hours in sandbox - Idempotency: supported via an
Idempotency-Keyheader on POST requests - Versioning: dated versions (e.g.,
2026-08-26.dahlia), named major releases contain breaking changes, monthly releases within a major are backward-compatible; override viaStripe-Versionheader, and webhook endpoints are pinned to a version independently - PCI scope: Stripe is PCI Level 1 certified; integrations using Checkout, Elements, or mobile SDKs (card data never touches your servers) typically qualify for the simplest SAQ A, and Stripe's Dashboard helps identify the correct validation form
Stripe is a good choice for developer-led platforms that want fully customizable payment and payout workflows on one core API (and have the engineering resources to configure them). Teams without that capacity may find the flexibility comes at the cost of a steeper setup.
Checkout.com

Checkout.com runs on a single unified API: one base URL and one set of credentials that lets a business accept payments, manage payouts, onboard sub-entities, verify identity, and issue cards, all through the same integration.
Checkout.com API features:
- Payments and payouts: request a payment or payout through the same endpoint, and manage refunds, captures, and disputes.
- Platform tools: onboard sub-entities, manage their payment instruments, and configure payout schedules and reserves.
- Identity verification: run KYC, AML screening, and document verification directly through the API.
- Card issuing: create cardholders, issue cards, and manage spending controls.
- Embedded components: Flow, Checkout.com's prebuilt payment UI, drops directly into your site or app so customers can pay without leaving your product.
Requesting a payment with a token on Checkout.com:
{
"source": {
"type": "token",
"token": "tok_4gzeau5o2uqubbk6fufs3m7p54"
},
"amount": 6500,
"currency": "USD",
"processing_channel_id": "pc_ovo75iz4hdyudnx6tu74mum3fq",
"reference": "ORD-5023-4E89",
"metadata": {
"udf1": "TEST123",
"coupon_code": "NY2024",
"partner_id": 123989
}
}
Request body only; Checkout.com documents the payload rather than the full request. POST /payments with a Bearer secret key and Cko-Idempotency-Key. Charges $65.00 against a token from Flow.
Under the hood:
- Rate limits: 100 requests/sec for both read and write operations, applied globally across the whole account rather than per credential or sub-entity, adaptive, with lower limits in sandbox
- Webhooks: signed via a
Cko-Signatureheader (HMAC-SHA256, hex-encoded); your server must acknowledge within 10 seconds; failed deliveries are automatically resent up to 8 times - Idempotency: supported via a
Cko-Idempotency-Keyheader on payment and payment-action endpoints; retrying with the same key returns the original response instead of reprocessing, and keys expire after 24 hours - PCI scope: tied directly to integration method: using full raw card details requires SAQ D, while tokenized payments (e.g., via Flow) avoid that scope
Checkout.com works well for platforms that want payments, payouts, identity verification, and card issuing handled through one integration. It isn't the right fit for small teams or simple use cases that only need to accept card payments.
PayPal

PayPal REST APIs let developer teams integrate PayPal's main payment features directly into their own mobile apps and websites, so businesses can accept PayPal alongside credit and debit cards.
The APIs also cover invoicing and recurring subscription payments. And for platforms and marketplaces, that extends to support multi-party payments.
You need a PayPal Business account to go live with integrations and test integrations outside of the US.
PayPal API features:
- Invoicing and subscriptions: send invoices and manage recurring billing through the same API used for one-time payments.
- Multi-party payments: split a transaction between a platform and a seller, and route partner fees, using the same core checkout and refund endpoints.
- Webhooks: real-time event notifications.
- Embedded components: JavaScript and React SDKs render PayPal's buttons and checkout flow directly inside your site or app, so customers complete payment without redirecting away from your product.
Creating an order with PayPal:
curl -v -X POST "https://api-m.sandbox.paypal.com/v2/checkout/orders/"
-H 'Content-Type: application/json'
-H 'Authorization: Bearer ACCESS-TOKEN'
-d '{
"intent": "CAPTURE",
"purchase_units": [
{
"reference_id": "d9f80740-38f0-11e8-b467-0ed5f89f718b",
"amount": {
"currency_code": "USD",
"value": "100.00"
}
}
],
"payment_source": {
"paypal": {
"address": {
"address_line_1": "2211 N First Street",
"address_line_2": "17.3.160",
"admin_area_1": "CA",
"admin_area_2": "San Jose",
"postal_code": "95131",
"country_code": "US"
},
"email_address":"payer@example.com",
"payment_method_preference": "IMMEDIATE_PAYMENT_REQUIRED",
"experience_context": {
"return_url": "https://example.com/returnUrl",
"cancel_url": "https://example.com/cancelUrl"
}
}
}
}'
Creates a $100.00 order. Three steps: create, buyer approves on PayPal, then a separate capture call. Idempotency: PayPal-Request-Id, endpoint-dependent.
Under the hood:
- Auth: OAuth 2.0 client credential: exchange a client ID + secret for a Bearer access token
- Rate limits: PayPal doesn't publish specific numeric limits; requests over the threshold return a
429 RATE_LIMIT_REACHEDerror. PayPal's own guidance is to cache OAuth tokens rather than generate one per request, and to use webhooks instead of polling - Webhooks: each notification carries
PAYPAL-TRANSMISSION-ID,PAYPAL-TRANSMISSION-SIG,PAYPAL-TRANSMISSION-TIME,PAYPAL-CERT-URL, andPAYPAL-AUTH-ALGOheaders; verify either by recomputing the signature yourself against PayPal's public certificate, or by posting the same values to PayPal'sverify-webhook-signatureendpoint for it to confirm - Idempotency: supported via a
PayPal-Request-Idheader on POST calls (not universal, support varies by endpoint); PayPal recommends a UUID, and retries with the same ID return the original result rather than reprocessing - Versioning: the Orders API is versioned (
v2), with older versions like Orders v1 explicitly marked deprecated
PayPal is a good choice for businesses that want the consumer trust and reach of a widely recognized brand at checkout, less so for platforms that want a fully headless flow with no PayPal branding.
Square

Square's docs group endpoints into named sections – Payments, Payouts, Checkout – but it's one unified API underneath. Square's API integrates directly with Square's own POS hardware, so a business selling online and in person can manage a sale from either channel through the same system.
Square API features:
- Hosted checkout: accept payments through a prebuilt, Square-hosted checkout page, or connect a payment request directly to a paired Square Terminal for in-person sales.
- Payments and payouts: take and manage payments, issue refunds, and pull a list of deposits and withdrawals from a seller's connected account.
- Cards and subscriptions: save a card on file and create recurring subscriptions using the same customer and payment objects across the API.
- Webhooks: subscribe to real-time events across payments, orders, and disputes.
- Embedded components: the Web Payments SDK (and In-App Payments SDK for mobile) lets you build a fully custom, PCI-compliant checkout inside your own site or app (or skip the build with Square's prebuilt, hosted checkout page).
Creating a payment for a card saved on file with Square:
curl https://connect.squareup.com/v2/payments \
-X POST \
-H 'Square-Version: 2026-08-19' \
-H 'Authorization: Bearer ACCESS_TOKEN' \
-H 'Content-Type: application/json' \
-d '{
"idempotency_key": "7b0f3ec5-086a-4871-8f13-3c81b3875218",
"amount_money": {
"amount": 1000,
"currency": "USD"
},
"source_id": "ccof:GaJGNaZa8x4OgDJn4GB",
"autocomplete": true,
"customer_id": "W92WH6P11H4Z77CTET0RNTGFW8",
"location_id": "L88917AVBK2S5",
"reference_id": "123456",
"note": "Brief description",
"app_fee_money": {
"amount": 10,
"currency": "USD"
}
}'
Charges $10.00 to a card on file in one call. idempotency_key is mandatory, not optional.
Under the hood:
- Rate limits: not publicly disclosed, Square's own guidance is to build a retry mechanism with exponential backoff and jitter for
429responses - Webhooks: signed via an
x-square-hmacsha256-signatureheader (HMAC-SHA256); retry count and reason are tracked viasquare-retry-number/square-retry-reasonheaders; your endpoint must respond within 1 minute to avoid a retry - Idempotency: required (not optional), every
CreatePaymentcall needs a uniqueidempotency_key; retrying with the same key returns the original response rather than double-charging - Versioning: dated via the
Square-Versionheader (e.g.,2026-08-19)
If you sell online and in person and want payments, inventory, and hardware integrations handled through one system, Square is a valid choice. It's less suited to platforms that need a pure payments API without the retail layer.
Modular API suites for larger engineering teams
Separately versioned APIs you integrate and combine yourself.
Adyen

Adyen is one platform for accepting payments, managing risk, and moving funds across channels, but under the hood, it's built from a suite of separate, independently versioned APIs grouped into two categories: Payments APIs (Checkout, Recurring, Payouts, BinLookup, and more) for accepting payments, and Platforms APIs (Balance Platform, Transfers, Legal Entity Management) for marketplaces and card issuing.
A team typically integrates several of these together, depending on what it's building.
Adyen API features:
- Unified commerce: manage online, mobile, and in-person payments through the same account structure, for a consistent view across all channels.
- Balance account and transfers: hold and move funds between account holders before paying them out externally.
- Card issuing: issue physical or virtual cards tied to a balance account through Platform APIs.
- Webhooks: real-time notifications for payments, payouts, disputes, and platform events (specific to each API).
- Embedded checkout UI: integrate via Web Drop-in (a prebuilt, all-in-one checkout form) or Web Components (individual components per payment method you assemble yourself), depending on how much control you need.
Creating a card payment authorization charge with Adyen:
curl https://checkout-test.adyen.com/v72/payments \
-H 'x-api-key: {hint:Your API key from your Customer Area.}ADYEN_API_KEY{/hint}' \
-H 'idempotency-key: YOUR_IDEMPOTENCY_KEY' \
-H 'content-type: application/json' \
-d '{
"merchantAccount": "{hint:Name of your merchant account.}YOUR_MERCHANT_ACCOUNT{/hint}",
"reference": "My first Adyen test payment",
"amount": {
"value": {hint:10 euros in minor units}1000{/hint},
"currency": "EUR"
},
"paymentMethod": {
"type": "scheme",
"encryptedCardNumber": "test_4111111111111111",
"encryptedExpiryMonth": "test_03",
"encryptedExpiryYear": "test_2030",
"encryptedSecurityCode": "test_737"
}
}'
Charges a test card €10.00 in one call. Amount is in minor units. Idempotency: idempotency-key header.
Under the hood:
- Auth:
X-API-Keyheader (or Basic Auth with username/password for the classic integration) - Rate limits: no published number for the Checkout/Payments API specifically; Adyen does publish limits for some other APIs (e.g., Legal Entity Management: 700 requests/5 sec live, 200/5 sec test)
- Webhooks: signed via HMAC (verified using a secret key linked to each webhook endpoint); your server must respond within 10 seconds or the delivery counts as failed; on failure, Adyen retries immediately 3 times (at 9s, 18s, 27s), then enters a retry queue with increasing intervals for up to 30 days, with an alert email sent after 5 retries
- Idempotency: supported via an
Idempotency-Keyheader on payment requests - Versioning: dated-style version suffix in the URL itself (
vXX, e.g./v72/payments), each API is versioned independently - PCI scope: merchants must sign an SAQ regardless of integration method; using Drop-in, Components, or plugins reduces compliance burden since card data is handled on Adyen's servers rather than the merchant's
Adyen is best for larger platforms and marketplaces that have the engineering resources to work across its multi-API structure. Smaller teams or those wanting a single API may find Adyen's structure adds to integration overhead.
Airwallex

Airwallex offers two APIs. The Client API is for building on top of Airwallex infrastructure: business accounts, payment acceptance, and spend management, with Connected Accounts handling onboarding connected accounts and moving funds between them.
The Partner API is for platforms and software providers integrating wallets into third-party workflows (like lending) and uses its own OAuth 2.0 or partner access token setup.
Airwallex API features:
- Global payouts and FX: send international transfers in multiple currencies, with built-in conversion quotes and live rates to manage FX costs.
- Programmatic account onboarding: onboard connected accounts and sellers.
- Card issuing: create cardholders and issue physical or virtual cards.
- Webhooks: real-time notifications across payments, payouts, and account status changes.
- Embedded components: prebuilt UI components let you add payment acceptance, onboarding, or account management directly into your product.
Creating a PaymentIntent with Airwallex:
curl -X POST https://api.sandbox.airwallex.com/api/v1/pa/payment_intents/create \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer {{ACCESS_TOKEN}}' \
-d '{
"request_id": "ed11e38a-7234-11ea-aa94-7fd44ffd1b89",
"amount": 100,
"currency": "USD",
"merchant_order_id": "85d7b0e0-7235-11ea-862e-9f6aa1adfca6",
"return_url": "https://www.airwallex.com"
}'
Creates a $100.00 PaymentIntent. Two steps: a separate /confirm call attaches the payment method. Idempotency: request_id
Under the hood:
- Auth: OAuth 2.0 (Partner API, for third-party workflows on behalf of a user) or a Client ID + API key exchanged for a Bearer access token (Client API, for building directly on Airwallex)
- Rate limits: not publicly documented
- Webhooks: signed via HMAC-SHA256, computed from a timestamp + raw body, compared against an
x-signatureheader; secret is unique per subscription; your endpoint must return200 OKimmediately or Airwallex retries (exact schedule not published); events may arrive more than once (dedupe on the eventid) and are not guaranteed to arrive in order - Idempotency: supported via a
request_idfield on create/confirm calls - PCI scope: Airwallex is PCI DSS Level 1 certified; using their tokenized Embedded Elements checkout reduces merchant scope to the simplest tier, SAQ A
Airwallex is best for SaaS or ecommerce businesses that want automation and cross-border payments and payouts rather than complex multi-entity payment workflows.
Worldpay

Worldpay's core API is modular by design: tokenization, fraud screening, 3DS verification, and payouts each have their own API, and the orchestrated Payments API folds tokenization, fraud screening, and 3DS into the payment request itself. Payouts stay a separate call either way.
Platforms and marketplaces needing merchant boarding and multi-party processing use a separate product – Worldpay for Platforms.
Worldpay API features:
- Modular and orchestrated APIs: call individual services (tokens, fraud, verification, payouts) on their own, or use the orchestrated Payments API to handle risk checks, 3DS, and the payment itself in a single request.
- Merchant boarding for platforms: Worldpay for Platforms handles onboarding, profile management, and status tracking for sub-merchants (separate from the core payments API).
- Fraud and dispute management: built-in fraud scoring and automated dispute/chargeback workflows.
- Embedded components: a PCI-compliant Checkout SDK lets you build card payments directly into your own site (or use Worldpay's Hosted Payment Pages if you don't want to build a checkout UI).
Taking a one-time card payment with Worldpay:
{
"transactionReference": "Memory265-13/08/1876",
"orderReference": "order-12345",
"merchant": {
"entity": "default"
},
"instruction": {
"method": "card",
"paymentInstrument": {
"type": "plain",
"cardHolderName": "Sherlock Holmes",
"cardNumber": "4000000000001091",
"expiryDate": {
"month": 5,
"year": 2035
},
"billingAddress": {
"address1": "221B Baker Street",
"address2": "Marylebone",
"address3": "Westminster",
"postalCode": "SW1 1AA",
"city": "London",
"state": "Greater London",
"countryCode": "GB"
},
"cvc": "123"
},
"narrative": {
"line1": "trading name"
},
"value": {
"currency": "GBP",
"amount": 42
}
}
}
Charges £0.42 using full plain-text card details. This path puts you in full PCI scope (SAQ D), the Checkout SDK avoids it. No documented idempotency guarantee on Payments.
Under the hood:
- Auth: Basic Auth: base64-encoded username/password issued by your Worldpay Implementation Manager
- Rate limits: not publicly documented
- Webhooks: delivered from a fixed set of Worldpay IP addresses (must be allowlisted on your firewall); your endpoint must respond
200within 10 seconds or Worldpay retries the event - Idempotency: the Payouts API has an explicit
Idempotency-Keyheader (up to 35 characters); for the Payments API, only a client-generatedtransactionReferenceis documented as identifying a payment throughout its lifecycle, no confirmed idempotency guarantee against duplicate submissions - Versioning: dated version string passed via the
WP-Api-Versionheader (e.g.,2024-06-01) - PCI scope: submitting full card details (
paymentInstrument.type: "plain") puts full PCI scope on the merchant; using the Checkout SDK instead qualifies for the simplest tier, SAQ-A
Worldpay suits enterprise or high-volume businesses that need broad global payment method coverage and are ready to work across a modular API structure. Smaller teams wanting one simple integration may find better fits elsewhere on this list.
Payout-only infrastructure
Built for paying people out, no card acceptance.
Tipalti

Tipalti's API is a single, unified system built specifically for payouts. It is not a general-purpose payments API: its own docs describe it as 'one API' for sending money to freelancers, contractors, creators, and suppliers globally.
The Tipalti API offers three ways to integrate: a no-code branded portal where vendors self-manage their own payment details, an embeddable component that drops into an existing payee registration flow, or a full REST API for pushing payment batches directly, with a sandbox and developer documentation.
Tipalti API features:
- Global payouts at scale: send batch payments to more than 200 countries and territories, in 120 currencies, through 50+ payment methods.
- Compliance automation built in: KYC, tax form collection, OFAC screening, and VAT validation run automatically during onboarding.
- ERP integrations: prebuilt connectors for NetSuite, SAP, QuickBooks, Xero, Sage, and more.
- Embedded components: a low-code, brandable embed drops into your existing payee registration flow, letting payees set their currency and payment method without leaving your product.
Creating a payment batch (payout) with Tipalti:
curl --request POST \
--url https://api-p.tipalti.com/api/v1/payment-batches \
--header 'accept: application/json' \
--header 'content-type: application/json'
Creates an empty payment batch; instructions are added in the request body, each with a payee, amount, and unique refCode. Returns a batch ID only, status is polled separately.
Under the hood:
- Auth: Bearer JWT
- Rate limits: not publicly documented
- Idempotency: each payment instruction requires a unique
refCode, which Tipalti has described as a safeguard against duplicate payments - Webhooks: delivered via Tipalti's own IPN (Instant Payment Notification) system
- Batch limits: up to 5,000 payment instructions per batch; the create call returns only a batch ID, with status checked via a separate polling endpoint
Tipalti is a good choice for growing companies that need to run mass, cross-border payouts with built-in tax and compliance automation. It has no product for accepting payments from customers – it's built exclusively for paying money out, not taking it in.
Trolley

Trolley has a payout-focused API for paying contractors, freelancers, and suppliers globally. A single REST API handles recipients, payments, and batches, with SDKs in JavaScript, PHP, Ruby, Python, Java, and C#.
Like Tipalti, Trolley is built for one-directional payouts, not accepting payments from customers.
Trolley API features:
- Global payout methods: pay recipients via bank transfer or through PayPal, Venmo, checks, debit cards, and mobile wallets.
- Batch payments: group multiple payments into a batch and send them for processing together.
- Compliance status tracking: each recipient carries a compliance status (pending, review, verified, or blocked) based on AML screening.
- Embedded components: the Trolley Widget is an iframe-based, self-onboarding flow where recipients add their own payment method and tax forms without your team collecting that information manually.
Creating a payment with Trolley:
require 'trolley'
client = Trolley.client('YOUR_ACCESS_KEY', 'YOUR_SECRET_KEY')
response = client.payment.create(
batch.id,
{
sourceAmount: '10.00',
recipient: {
id: recipient.id
},
tags: ['tag1', 'tag2']
})
print response
Adds a payment to a batch. Both batch.id and recipient.id come from earlier calls not shown here.
Under the hood:
- Auth: custom
prsignscheme: an HMAC-SHA256 signature computed overtimestamp + method + requestPath + body, sent via theAuthorizationheader with anX-PR-Timestampheader; requests are rejected if the timestamp is more than 30 seconds old; optional IP allowlisting available in dashboard settings - Rate limits: enforced, returning a
429with arate_limit_exceedederror; no published numeric threshold - Webhooks: delivered sequentially, so events arrive in order; fired on model changes (e.g., a recipient updated, a payment failed)
- Compliance status: each recipient carries a
complianceStatusfield (confirmed values includependingandverified) based on screening against watchlists (OFAC, EU, OSFI, HMT)
Trolley works well for platforms and marketplaces that need to pay a global network of contractors or suppliers. It's not a good fit if you need to accept payments.
Bank debit and recurring payment specialists
Move money directly between bank accounts, built for recurring and scheduled payments rather than card transactions.
Dwolla

Dwolla calls itself the 'Unified API for Programmable Bank Payments'. The Dwolla API covers ACH, same-day ACH, real-time payments, and wire transfers. It's white-labeled by design, with transfers, notifications, and account details all appearing under your own brand, not Dwolla's.
Dwolla API features:
- Flexible end-user types: support personal and business accounts with different verification levels, including a receive-only account type built specifically for payout-only use cases.
- Open banking verification: instant bank account verification and real-time balance checks.
- Security and compliance: SOC 2 Type 2 compliance, tokenized bank account data, and both API key and OAuth authentication.
- Embedded components: drop-in components are prebuilt, white-labeled UI elements for customer creation, identity document upload, and balance display.
Initiating a transfer with Dwolla:
// Initiate a transfer
const transfer = await dwolla.transfers.create({
_links: {
source: {
href: "https://api-sandbox.dwolla.com/funding-sources/source-id",
},
destination: {
href: "https://api-sandbox.dwolla.com/funding-sources/destination-id",
},
},
amount: {
currency: "USD",
value: "10.00",
},
});
// Get transfer details
const transferDetails = await dwolla.transfers.get({
id: "transfer-id-here",
});
// Cancel a transfer (if eligible)
await dwolla.transfers.cancel({
id: "transfer-id-here",
});
Shows create, retrieve, and cancel. A 201 confirms creation, but funds settle over ACH or RTP/FedNow rather than immediately.
Under the hood:
- Auth: OAuth2 client credentials (
clientID/clientSecret) - Rate limits: concurrency-based (rapid transfers from the same Wallet) and volume-based (per-endpoint) limits, both returning
429; a volume-based block persists for 5 minutes - Idempotency: supported via an
Idempotency-Keyheader on transfer creation - Webhooks: signed via an
X-Request-Signature-SHA-256header (HMAC-SHA256 of the payload, keyed with your webhook secret); delivered asynchronously and not guaranteed in order; no event filtering (you receive everything); a subscription auto-pauses after 400 consecutive failed deliveries, with an email sent to the account admin; IP whitelisting is explicitly not supported, since Dwolla's IPs are dynamic
Dwolla is best for US-based platforms that want to embed white-labeled, account-to-account bank payments, less suited to platforms operating outside the US, or that need to accept card payments.
GoCardless

GoCardless's REST API is built specifically around bank debit and recurring payments. There are two ways to integrate: as a Merchant (taking payments on your own behalf) or as a Partner (connecting your users' own GoCardless accounts through OAuth and acting on their behalf).
Payments can't be taken directly through the API on their own. A customer must first complete authorization on a secure payment page before any payment can be requested via the API.
GoCardless API features:
- Partner accounts: your users connect their own GoCardless account to your app through OAuth, which gives you an access token to manage and process payments on their behalf.
- Client libraries: official libraries in Ruby, Python, PHP, Java, .NET, Node.js, and Go, plus Android and iOS SDKs.
- Webhooks: get notified of status changes on any resource.
- Embedded components: GoCardless offers a JavaScript Drop-in that embeds a payment flow directly on your site without a redirect, along with GoCardless Components for more custom UI. You can also redirect to GoCardless's hosted payment page, or, on Advanced and Pro plans, design and host your own.
Creating a Billing Request with GoCardless:
const billingRequest = await client.billingRequests.create({
payment_request: {
description: "First Payment",
amount: "500",
currency: "GBP",
},
mandate_request: {
scheme: "bacs"
}
});
Creates a Billing Request for a £5.00 Bacs mandate. The customer must authorize on a hosted page before any payment can be requested.
Under the hood:
- Webhook signature:
Webhook-Signatureheader, verified against a per-endpoint secret - Delivery guarantee: at-least-once, not exactly-once: the same event can be delivered more than once
- Deduplication: use the individual
event.idvalues inside theeventsarray, explicitly notmeta.webhook_id, which identifies the delivery attempt, not the event itself - Signature failure handling: GoCardless specifically instructs returning 498 for an invalid signature (not 200, which would mark it delivered, and not 400, which triggers unnecessary retries)
- IP allowlisting: GoCardless publishes static sending IPs, with at least 2 weeks' notice before any change
- HTTPS required, with the full TLS certificate chain
GoCardless is best for businesses built around recurring or invoice-based bank debit payments. It's not suited to platforms that need to accept one-time card payments as their primary flow, or that need to pay money out rather than collect it.
A note on agentic payments in 2026
As ACP launched in 2025, it's worth knowing how these APIs support agentic payments today.
Stripe, PayPal, Worldpay, and Adyen all back at least one of the emerging standards (ACP, UCP, or AP2). Square chose a more direct route, launching free ChatGPT and Claude ordering for restaurants.
Whop's angle is different: the Whop CLI lets a business owner's AI agent run the seller side – creating products or moving money – through commands that plug straight into Claude or Cursor.
The payout-only providers on this list have no agentic initiative yet.
How to choose a payment API
The list above names 12 different payment APIs, and not each API suits every business use case. Here's how to evaluate them:
Define your requirements first
Before comparing API features, get specific about what you really need.
Do you need to accept payments and pay out users (in which case Whop, Stripe, PayPal, Checkout.com and Airwallex all handle both from one integration) or do you need payouts only (Tipalti and Trolley are purpose-built for that)?
Building a creator marketplace paying out sellers? This is the textbook case for a unified API. Stripe Connect has 249 reviews on G2 with an average rating of 4.3/5 stars (as of September 2nd, 2026), and developers are keen to point out ease of use and easy integrations, with one reviewer saying:
Comprehensive Tax Support, Full API Access, and World-Class Stripe Support. It helped us move from another vendor who did not have such comprehensive support for different tax jurisdictions. It also offers us full API access to the app, so we can build our SaaS product and not be limited by any other interface.
- Verified user in 'computer software'
But at the same time, users also point out poor customer support and slow payments, with another user saying:
Account verification takes some time in the beginning. Sometimes payout timing depends on the platform which can be confusing.
- Harshad R, Software Developer
And if you're building something where people need to pay you directly, you don't want to end up locked into an API that only handles payouts.
So consider your target markets and whether they need particular payout methods (rails, currencies, and countries) not just now, but in a year's time, too.
Weigh up API integration against control
A single, unified API (Whop, Stripe, PayPal, Square) gets you to launch faster than a suite of APIs that you have to learn and combine yourself (Adyen, Worldpay). But, in some cases, that speed comes at the cost of control.
That's what happened to Josh Fabian, founder of Metafy, the coaching platform for the world's best gamers. Payouts ran through PayPal in the early days, but Metafy outgrew this fast.
PayPal worked until it didn't. As we scaled, the gaps showed up fast. And when a coach can't get paid reliably, it becomes a trust problem. That's the worst possible problem for us to have.
- Josh Fabian, Metafy
Metafy moved to Whop to power every payout. When choosing an API, consider if you have the flexibility to make changes as you grow.
Evaluate the developer experience
For each API you are considering, pull up the docs, not just the marketing page.
Are the docs clear and easy to use? Is there copy-paste code? Is there a sandbox environment so you can safely test actions?
But docs will only tell you so much, make sure to check real reviews to see how other developers have found the experience. And don't just check G2, but look through Dev.to, Reddit, and X.
On X, Cal.com's Head of Engineering posted about his experience partnering with Whop to embed Whop's payment components directly into its product, saying:
Very happy for this partnership. Technically was a breeze to integrate
- Keith Williams, Head of Engineering, Cal.com
That kind of firsthand account is worth digging for.
Check how reliable the platform is
All businesses run into problems at some point. Ask the API provider what happens when something breaks – does the API retry failed requests automatically, or is that your problem to solve? What are the support response times?
Whop: the API for every payment flow your business needs
Each of the payment APIs covered in this guide brings something different to the table. Some are built for global reach and multi-currency support, while others focus on recurring billing or embedded checkout flows.
The right choice for you depends on where your business operates, how technical your team is, and the kind of payment experience you want to offer your customers.
If you're looking for a payment API that handles the full payment lifecycle – including checkout links, embedded checkouts, saved payment methods, payouts, refunds, disputes, and off-session charging – then you need Whop. Whop is built to let you accept and manage payments however fits your product, with the flexibility to scale as your business grows.
One API, every payment flow.
FAQs
What to look for in a payment API
There are a few things worth checking before you choose a payment API. Start with the direction of money movement: does it accept payments, pay people out, or both?
Then, look at the API's structure – is it a unified API, or a suite of separate, independently versioned ones that you combine yourself?
Finally, check whether it offers embedded UI you can drop directly into your product, or whether it relies on hosted or redirect-based pages instead.
What is the best payment API for developers?
The Whop API is a strong choice for teams that want full control over the payment lifecycle, from checkout links and embedded checkouts, to off-session charging and payouts.
Which payment API should I use if I also need to pay out sellers?
Whop's API handles payment acceptance and paying out sellers. It supports charges, refunds, disputes, and payouts through the same system. If you need a payments API that handles both sides of the payment lifecycle, choose Whop.
Which payment API is easiest to integrate for a small dev team?
For small dev teams, Whop's API is easy to get started with. Simply install the SDK, grab your company API key from the dashboard, and you can create a working checkout link or embedded checkout with just a few lines of code – and you don't need to build separate systems for billing, payouts, or disputes.
What's the difference between a payment API and a payment gateway?
A payment gateway authorizes the card transaction, passing the card details to the networks and returning an approval or decline. A payment API is the programmable interface you build against, usually covering far more than authorization, like saved payment methods, refunds, disputes, subscriptions, and webhooks.