TypeScript-first REST API. Webhook-driven. Idempotent by default. First charge in 30 minutes.
API docs →import { Tap2 } from '@tap2-payments/sdk'
const client = new Tap2({ apiKey: process.env.TAP2_API_KEY })
const intent = await client.payments.createIntent({
amountCents: 2450,
currency: 'usd',
captureMethod: 'automatic',
metadata: { orderId: 'ord_92xkf' }
})
// → { id: "pi_8xjKf…", status: "requires_payment_method" } curl -X POST https://merchant-api.tap2payments.com/api/v1/payments/create-intent \
-H "Authorization: Bearer $TAP2_API_KEY" \
-H "Content-Type: application/json" \
-d '{"amountCents":2450,"currency":"usd","captureMethod":"automatic"}'
# → {"id":"pi_8xjKf…","status":"requires_payment_method"} import tap2, os
client = tap2.Client(api_key=os.environ["TAP2_API_KEY"])
intent = client.payments.create_intent(
amount_cents=2450,
currency="usd",
capture_method="automatic"
)
# → {"id": "pi_8xjKf…", "status": "requires_payment_method"} API capabilities
Bearer token auth with per-key scopes. Rotate without downtime.
DB-layer idempotency on every write. Retry freely — duplicate requests return the original response.
13 event types. Dead-letter queue for failed deliveries. HMAC-signed payloads.
BFF workers verify HMAC before forwarding to Rust core. No direct core exposure.
170+ endpoints. Postman collection. TypeScript types generated from schema.
ML scoring on every transaction. Sanctions check fails-closed on KV error.
Endpoints