Developer Documentation

Integrate payments, identity, sessions, subscriptions, and access control.

PayLayer is the infrastructure layer for creator applications. Your app does not build local authentication, subscription logic, or payment matching. It asks PayLayer for session and entitlement state.

Getting Started

Create Product
Generate AI Integration Kit
Paste into Codex / Claude Code / Cursor
Users authenticate through PayLayer
Payments unlock access

Authentication

Use PayLayer passwordless OTP authentication. Do not create local passwords or duplicate user accounts.

  • POST /auth/product/request
  • POST /auth/product/verify

Sessions

Validate PayLayer sessions on app startup and before protected backend actions.

  • GET /v2/session
  • POST /v2/logout
  • GET /v2/sessions
  • POST /v2/sessions/revoke

Entitlements

Apps ask whether a user has a permission such as tapescope.pro, discord.vip, or api.basic. The app does not need to know whether access came from a subscription, purchase, trial, coupon, or manual grant.

  • POST /v2/access

Products and Subscriptions

Create products in the dashboard, assign pricing, copy the AI Integration Kit, and let PayLayer manage subscription status and expiry.

  • POST /products
  • GET /products/list
  • GET /access/:userId/:productId remains available for legacy integrations.

Store Checkout

Your website creates the order and calculates the total. Your backend calls PayLayer to create the checkout. PayLayer tracks payment, sends order.paid, and generates a Proof Receipt.

  • POST /store/checkout

Webhooks

Use webhooks for real-time events such as payment confirmation, access granted, subscription expiry, credit low, order paid, and refund markers. Verify signatures using the raw body.

Proof Receipts

Proof Receipts are tamper-evident records of PayLayer-side payment lifecycle events. They help verify checkout creation, payment detection, confirmation checks, order status, and webhook attempts.

AI Integration Kit

The generated prompt is the official implementation specification for AI coding tools. It covers authentication, sessions, entitlements, subscription verification, protected routes, logout, middleware, backend validation, frontend validation, multi-device login, session refresh, and error handling.

Security

Keep merchant API keys and store secret keys on your backend only. Protect backend routes with PayLayer session and entitlement checks. Never expose webhook secrets or private credentials in browser code.