Getting Started

This guide helps you integrate with the Aera Online Payments API.

It explains how to authenticate your requests, configure required headers, obtain access tokens, and understand the core concepts needed to initiate and manage payments. By the end of this page, you will understand the required security model, request structure, and the fundamental operations that power the payment lifecycle.

This is the recommended starting point before implementing any operations to support your checkout processes.

Prerequisites

Before you begin, complete the following:

1. Apply for API credentials by following the access procedure. You will receive a merchant-id, API key, client ID, and client secret.
2. Store your credentials securely — save your client ID, client secret, and API key in environment variables or a secrets manager. Never hardcode them in source code.
3. Review the HTTP data integrity requirements at HTTP Data Integrity — all requests and responses are signed.

Environments

You can interact with the API using the following base URLs:

• Sandbox: {{ SANDBOX_BASE_URL }}
• Production: {{ PRODUCTION_BASE_URL }}

All endpoints in this documentation are relative to the selected base URL.

Signing Certificate – Test Environment

-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwzMbbGnhPqkLKaUDWx1z
myrQDWFu1z1pG0dvKhLGs4r1Mv5BpAEaCEi6VLNzOXLy0d8Q41B8qIW3USxP+KTS
ASmBpQGBU+nlCz3eooUv7fbEPB4QwG1FRU9GeTMk8OeHpfMqd4swzt2SsklIYCuV
d120C+FWmyayKl4GpUTUA7csSKtcvIfXzuIj3KxLuImK51Clw9eP1Envxy8jENxi
oBBcSN+mkONSA3qOtLZjG2uxXoGBQJuEkVRIv4z/f45zXCnYqr6qvNaNJzWKxwdS
vlfQbY5jTQA/vu6W0DcvU2/7xsssxVnFZ6ZHqXg9MOSK8D6BtLL5pORoikQ07Qw5
zwIDAQAB
-----END PUBLIC KEY-----

Signing Certificate – Production Environment

-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAviARcZqbhiMV2dwd/3kY
OTJLmm6nn0akv9EJzTKkL8+4MpuqDEvW/ZKUA+p7uKcGcBfse10okU4XkSk0Prl6
sh2fn+D5uWpbCejNW7Itxlc60kb9wsaljrUXH/XfE7yt147/+A6F0KLkz4PJg8u5
TGyxMJsEnYJAdCHMRytKn+L4i+26n2nXb6Iv1RsRNmusdq9O+PErUIUbamjgBvRS
TK9giQPQ5skU7ZzSuk9e8IpMikVG8MezqGX35IAYa99nYXJdT0bfqlbEG6z87iDv
fL/0AdllvwpuDBNXXaxFiV0vnh+EYVjQsN3pl7XI7pRW5ho+kpzFEu8TfY97mnQB
MwIDAQAB
-----END PUBLIC KEY-----

HTTP Headers

All operations require the following HTTP headers:

Get Access Token

Before calling protected endpoints, you must obtain an access token.

Endpoint

POST /access/v1/oauth2/token

Parameters

Example Request

curl -X POST {{ SANDBOX_BASE_URL }}/access/v1/oauth2/token \
  -H "Content-Type: application/json" \
  -d '{
    "grantType": "password",
    "username": "'"$AERA_CLIENT_ID"'",
    "password": "'"$AERA_CLIENT_SECRET"'"
  }'

Idempotency

All requests to the platform are idempotent.

The idempotency-key header is mandatory.

This ensures:

• Safe retries
• No duplicate captures
• No duplicate refunds
• No duplicate payment creation

If the exact same request is resent with the same idempotency key, the original response will be returned.

If the same key is reused with a different request body, an error is returned.

Amount Format

All amounts must be sent in minor units.

Examples

• NOK 199.00 → 19900
• EUR 10.50 → 1050
• USD 25.00 → 2500

Amount Structure

{
  "value": 19900,
  "currency": "NOK"
}