Authorize Payment

This endpoint initiates an authorization referring to a specific stored payment instrument with a paymentInstrumentReference requried in the request.

The endpoint starts an online transaction that:

  • Tries a low-value expemption if applicable (supported by the payment method and amount lower than limits). If successful, a success response is returned.
  • If the low-value expeption is not possible or the issuer requires authentication, a checkoutUrl for rendering is included in the response. If no checkoutUrl is included in the response, the Authorize request is approved or declined without shopper interaction.

All subsequent operations — such as capture, cancel, refund, update, and status retrieval — must refer to the pspReference generated by this request.



Request Structure

{
  "header": {
    "merchantId": "Aera Merchant ID",
    "idempotency-key": "UUID v7 provided by merchant to uniquely identify the request"
  },
  "body": {    
    "transactionData": {
      "merchantReference": "Merchant provided reference to the payment (e.g. order number)",
      "paymentInstrumentReference": "Mandatory: Reference to a pre selected payment instrument",
      "immediateCapture": "Optional, true if immediate capture requested, default false",
      "splitShipment": "Optional, true if shipment potentially can be split into multiple shipments",
      "amountDetails": {
        "amount": "Gross amount in minor units",
        "currency": "ISO 4217 alphabetic code (e.g.NOK), must be the same as the merchant currency"        }
    }
  }
}

Response Structure

The response contains session metadata and checkout information.

{
  "responseInfo": {
    "responseCode": "000",
    "responseText": "Approved"
  },
  "sessionInfo": {
    "pspReference": "018f7a2e-8f5c-7a9b-b123-123456789abc",
    "createdAt": "2026-03-01T10:15:30Z",
    "expiredAt": "2026-03-01T10:30:30Z",
  }
}

Field reference: Authorize Payment

HTTP Headers

🔒

Keep your x-api-key and Authorization token secret. Store them in environment variables or a secrets manager — never hard-code credentials in source files, client-side code, public repositories, or browser requests. Rotate compromised keys immediately through the Aera dashboard.

FieldTypeRequiredDefaultDescription
x-api-keystringYesAPI key assigned by Aera.
merchant-idstringYesMerchant ID assigned by Aera.
idempotency-keystring (UUID v7)YesUnique key identifying this request. Safe retries must reuse the same key.
AuthorizationstringYesBearer <access token>
AcceptstringYesapplication/vnd.payments.v1+jsonAPI versioned accept header.
Content-TypestringYesapplication/vnd.payments.v1+jsonAPI versioned content type.

Request body

transactionData object

FieldTypeRequiredDefaultDescription
merchantReferencestringYesMerchant reference (for example, order number).
paymentInstrumentReferencestringYes-Pre-selected stored payment instrument.
immediateCapturebooleanNofalseIf true, authorizes and captures immediately. If false, authorizes first and requires capture later
splitShipmentbooleanNofalseSet totrueif shipment potentially can be split into multiple shipments.
amountDetailsobjectYesAmount object (minor units).
transactionData.amountDetails
FieldTypeRequiredDefaultDescription
amountintegerYesGross amount in minor units (for example, 19900 = NOK 199.00).
currencystring (ISO 4217)YesCurrency code (for example, NOK), must be the same as the merchant currency.


Field reference: response

High-level processing result information.

FieldTypeRequiredDescription
responseCodestring (3 digits)YesResponse code from a predefined list.
responseTextstringYesHuman-readable description of the response code.

sessionInfo

Authorize Payment metadata.

FieldTypeRequiredDescription
pspReferencestring (UUID v7)YesUnique session identifier generated by Aera. Use this reference for all subsequent operations (capture, cancel, refund, status).
createdAtstring (ISO 8601)YesTimestamp when the session was created (UTC).
expiredAtstring (ISO 8601)YesTimestamp when the session expires (UTC).
checkoutUrlstring (URL)NoURL used to redirect the customer to initiate the hosted checkout session if the request cannot be completed without shopper authentication.



What’s Next

Did this page help you?