Getting started

#Environments

Brand identity is environment-driven (BRAND_DOMAIN, see docs/rebranding.md), so this document writes hosts as <domain> placeholders. For the current production brand, <domain> is godpay.cash.

There is one base URL for production and sandbox. Which side a request runs on is decided by the merchant type of the API key that signs it: a sandbox merchant's key (pk_demo_…) gets simulated transactions in the sandbox tables, a production merchant's key (pk_prod_…) gets real ones. There is no separate sandbox host, path or header to switch — use the same URL and swap the credentials.

#Overview

The Public API enables merchants to integrate payment processing capabilities into their applications. All API requests require HMAC-SHA256 authentication.

#Production vs Sandbox

Merchant type (set on your merchant account) determines transaction routing:

• Production Merchant: real money transactions processed through payment providers; rows live in the production transaction tables.
• Sandbox Merchant: simulated transactions. Responses are produced locally without calling any provider, and rows live in separate sandbox tables. The QR payload returned is a mock, not a scannable PromptPay code.

Every response carries an X-Environment header (sandbox or production) so you can assert which side you reached. Sandbox responses additionally carry X-Sandbox-Mode: true.

#Money, time and currency

• All amounts are THB. The currency field is validated for length only and stored verbatim; no currency conversion exists and no other currency is processed.
• Amounts are JSON numbers with 2 decimals. Fees are truncated (not rounded) to 2 decimals.
• Timestamps in responses are RFC 3339 in Asia/Bangkok (+07:00), for example 2026-09-20T17:32:05+07:00. They are ordinary ISO-8601 instants, so any standards-compliant date parser reads them unchanged; only the offset differs from the Z form used before 2026-09-20. The business day is Asia/Bangkok, so a timestamp's date part is now the Thai business date.