Authorize Payment
This endpoint initiates an authorization referring to a specific stored payment instrument with a paymentInstrumentReference requried in the request.
The endpoint starts an online transaction that:
- Tries a low-value expemption if applicable (supported by the payment method and amount lower than limits). If successful, a success response is returned.
- If the low-value expeption is not possible or the issuer requires authentication, a
checkoutUrlfor rendering is included in the response. If nocheckoutUrlis included in the response, the Authorize request is approved or declined without shopper interaction.
All subsequent operations — such as capture, cancel, refund, update, and status retrieval — must refer to the pspReference generated by this request.
Request Structure
{
"header": {
"merchantId": "Aera Merchant ID",
"idempotency-key": "UUID v7 provided by merchant to uniquely identify the request"
},
"body": {
"transactionData": {
"merchantReference": "Merchant provided reference to the payment (e.g. order number)",
"paymentInstrumentReference": "Mandatory: Reference to a pre selected payment instrument",
"immediateCapture": "Optional, true if immediate capture requested, default false",
"splitShipment": "Optional, true if shipment potentially can be split into multiple shipments",
"amountDetails": {
"amount": "Gross amount in minor units",
"currency": "ISO 4217 alphabetic code (e.g.NOK), must be the same as the merchant currency" }
}
}
}Response Structure
The response contains session metadata and checkout information.
{
"responseInfo": {
"responseCode": "000",
"responseText": "Approved"
},
"sessionInfo": {
"pspReference": "018f7a2e-8f5c-7a9b-b123-123456789abc",
"createdAt": "2026-03-01T10:15:30Z",
"expiredAt": "2026-03-01T10:30:30Z",
}
}Field reference: Authorize Payment
HTTP Headers
Keep your
x-api-keyandAuthorizationtoken secret. Store them in environment variables or a secrets manager — never hard-code credentials in source files, client-side code, public repositories, or browser requests. Rotate compromised keys immediately through the Aera dashboard.
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
x-api-key | string | Yes | – | API key assigned by Aera. |
merchant-id | string | Yes | – | Merchant ID assigned by Aera. |
idempotency-key | string (UUID v7) | Yes | – | Unique key identifying this request. Safe retries must reuse the same key. |
Authorization | string | Yes | – | Bearer <access token> |
Accept | string | Yes | application/vnd.payments.v1+json | API versioned accept header. |
Content-Type | string | Yes | application/vnd.payments.v1+json | API versioned content type. |
Request body
transactionData object
transactionData object| Field | Type | Required | Default | Description |
|---|---|---|---|---|
merchantReference | string | Yes | – | Merchant reference (for example, order number). |
paymentInstrumentReference | string | Yes | - | Pre-selected stored payment instrument. |
immediateCapture | boolean | No | false | If true, authorizes and captures immediately. If false, authorizes first and requires capture later |
splitShipment | boolean | No | false | Set totrueif shipment potentially can be split into multiple shipments. |
amountDetails | object | Yes | – | Amount object (minor units). |
transactionData.amountDetails
transactionData.amountDetails| Field | Type | Required | Default | Description |
|---|---|---|---|---|
amount | integer | Yes | – | Gross amount in minor units (for example, 19900 = NOK 199.00). |
currency | string (ISO 4217) | Yes | – | Currency code (for example, NOK), must be the same as the merchant currency. |
Field reference: response
High-level processing result information.
| Field | Type | Required | Description |
|---|---|---|---|
responseCode | string (3 digits) | Yes | Response code from a predefined list. |
responseText | string | Yes | Human-readable description of the response code. |
sessionInfo
Authorize Payment metadata.
| Field | Type | Required | Description |
|---|---|---|---|
pspReference | string (UUID v7) | Yes | Unique session identifier generated by Aera. Use this reference for all subsequent operations (capture, cancel, refund, status). |
createdAt | string (ISO 8601) | Yes | Timestamp when the session was created (UTC). |
expiredAt | string (ISO 8601) | Yes | Timestamp when the session expires (UTC). |
checkoutUrl | string (URL) | No | URL used to redirect the customer to initiate the hosted checkout session if the request cannot be completed without shopper authentication. |
Updated 13 days ago