Ship fintech features in hours, not months.

Interactive API reference, official SDKs, webhook signing, rate-limit playbooks and end-to-end auth guides. Everything you need to go live.

Quickstart — Verify a PAN

// npm i @coolpay/node
import CoolPay from "@coolpay/node";
const cp = new CoolPay({ apiKey: process.env.COOLPAY_LIVE_KEY });

const r = await cp.pan.verify({ pan: "ABCDE1234F" });
console.log(r.name, r.status);

Sandbox base: https://api.coolpay.in/v1

Bearer auth

One live key per environment. Rotate via dashboard with zero downtime.

Signed webhooks

HMAC-SHA256 signed callbacks with automatic retries + replay guard.

Rate limits

60 req/s sandbox · 500 req/s live · burst 5x. Response headers included.

PCI-DSS + ISO

PCI-DSS Level 1 vault, SOC2, ISO 27001. Hosted in ap-south-1.

Official SDKs

6 downloads · MIT license

v2.4.1

Node.js SDK

TypeScript / JavaScript

v2.4.0

Python SDK

Python 3.8+

v1.7.2

PHP SDK

PHP 8.0+

v1.5.0

Java SDK

Java 11+

v1.2.4

Go SDK

Go 1.19+

2025.11

Postman Collection

JSON

Authentication

Every request must include your live secret in the Authorization header:

    Authorization: Bearer sk_live_xxxxxxxxxxxx

Sandbox keys start with sk_test_ and only hit the sandbox environment. Rotate keys any time from your dashboard — old keys are invalidated within 60 seconds.

Webhooks

Register up to 5 webhook URLs per environment. We POST JSON with a Coolpay-Signature header (HMAC-SHA256 over the raw body + your webhook secret). Retries: 5 attempts with exponential backoff over 24 hours.

Verify with:

    require('crypto').createHmac('sha256', SECRET).update(rawBody).digest('hex')

Rate limits

• Sandbox: 60 req/s · burst 300
• Live: 500 req/s · burst 2500

Every response returns X-RateLimit-Remaining and Retry-After headers. Requests over the limit receive HTTP 429 with a JSON body {"code":"rate_limited","retry_after":1.2}.

Security

PCI-DSS Level 1 vault for card data. All traffic is TLS 1.3. Data-at-rest encrypted with AES-256. Yearly SOC 2 Type II + ISO 27001 audits. Deployed in Mumbai (ap-south-1) with active-active DR to Delhi.