Base URL
There is a single base URL for both test and live traffic. There is no separate sandbox host.
| Environment | Base URL |
|---|---|
| All requests (test and live) | https://api.quatapay.com/api/v1 |
Test vs live
Test and live use the same host. What differs is the API key prefix and the create-payment path:
| Mode | Key prefix | Create-payment endpoint |
|---|---|---|
| Test | qpay_test_… | POST /api/v1/gateway/sandbox/payments |
| Live | qpay_live_… | POST /api/v1/gateway/payments |
The sandbox path mirrors the live API exactly — same request and response shape; only the path and key prefix differ. The live /gateway/payments endpoint rejects a test key with 403, and the sandbox path rejects a live key the same way.
Versioning
All endpoints are prefixed with /api/v1. We bump the version only on breaking changes; additive changes (new fields, new endpoints) happen in place, so ignore response fields you do not recognise.
What differs in sandbox
- No real money moves, and a test key only sees test payments.
- A test checkout cannot be paid in the browser: finish it with
POST /gateway/sandbox/payments/{slug}/simulate(see Sandbox). - Webhooks fire on the same events as production, signed the same way, with
"simulated": truein the payload. You can replay any delivery from the merchant panel.
TLS and IP allow-listing
Use HTTPS only. There is no IP allow-list on calls to us. QuataPay does not publish a fixed range of webhook source IPs: authenticate webhooks by their signature, not by address.