Integrate on your own. No waiting, no approvals.
Your API key is available in the dashboard right after sign-up. Create invoices, send customers to the hosted checkout and receive signed webhooks — the whole flow is described in the API reference.
From sign-up to the first payment
- 01
Sign up
Create an account and confirm your email. No approval from our side is needed.
- 02
Get your Shop ID and API key
Settings → General: your Shop ID is shown there, and the “Create New Key” button issues an API key.
- 03
Set your callback URL
On the same tab, fill in the Callback URL — payment status updates will be sent there. The HMAC secret for verifying webhook signatures is shown there too.
- 04
Create an invoice
Send the customer to the payment page and wait for the webhook with the payment status.
Three ways to integrate
Hosted checkout
Create an invoice via the API or in the dashboard and send the customer a payment link. Zero frontend code.
REST API
Invoices, payments, subscriptions, donation and POS links, withdrawals — all over HTTPS with token authentication.
Webhooks
A POST to your URL on every payment status change, signed with your shop's HMAC secret.
Code samples
Real requests to the production API — replace the placeholders with your shop ID and token.
curl -X POST \
https://api.zionpayment.com/shops/<SHOP_ID>/invoices/ \
-H "Authorization: Token <API_TOKEN>" \
-H "Content-Type: application/json" \
-d '{
"amount": "100.00",
"currency": "USDTTRC20",
"order_id": "order-2026-001"
}'{
"id": "e5cf9fc4-35af-456c-9f15-17823f44488d",
"reference": "e477b48c41",
"order_id": "order-2026-001",
"amount": "100.000000",
"currency": "USDTTRC20",
"method": "ONLINE"
}
# Send the customer to the payment page:
https://checkout.zionpayment.com/invoice/<id>import crypto from 'node:crypto';
// X-Signature = hex HMAC-SHA1 of the raw body,
// keyed with your shop's HMAC secret
app.post('/zion/webhook',
express.raw({ type: 'application/json' }),
(req, res) => {
const expected = crypto
.createHmac('sha1', process.env.ZION_HMAC_SECRET)
.update(req.body)
.digest('hex');
const got = req.get('X-Signature') ?? '';
const ok = got.length === expected.length &&
crypto.timingSafeEqual(Buffer.from(got), Buffer.from(expected));
if (!ok) return res.sendStatus(401);
const payment = JSON.parse(req.body);
// payment.status → update the order
res.sendStatus(200);
});What you get from day one
Everything you need to go live is in the dashboard right after sign-up.
Self-serve API tokens
Generate API tokens in the dashboard yourself, whenever you need — no requests to support.
Signed webhooks
Every webhook carries an X-Signature header: an HMAC of the request body made with your shop's secret.
OpenAPI spec
A machine-readable spec in the API reference — generate a typed client in any language.
Team access
Invite teammates and choose which sections each of them can see and manage.
2FA on withdrawals
Withdrawals are protected with two-factor authentication; API withdrawals also with an IP allowlist.
Sandbox
There's no test mode or sandbox yet — it's in the works and will definitely arrive soon. Until then, test with a small real payment.
Ready to integrate?
Sign up and get your API key in a couple of minutes — no calls, no approval.
Stuck? Our team answers in Telegram.