Developers
Built for Developers, Backed by the Peneu Team
One API pattern across every Peneu product. Sandbox access during onboarding, and help from the Peneu team through go-live.
One API, Every Product
The same integration pattern works across Payment Gateway, Payouts, Verification, and Banking products.
Webhooks for Status Changes
Notifications when a payment, payout or verification changes status, so your systems don't have to poll.
Security Principles
Encryption, access controls and audit logging are principles Peneu applies; evidence is shared during due diligence.
Reference & Support
The API reference comes with sandbox access, with the Peneu team available from sandbox to production.
Integration Guide
From sandbox to production, with guided support
- 1
Get Sandbox Access
Sandbox credentials are provided during onboarding, after the business evaluation.
- 2
Integrate the API
Use the same request pattern across whichever Peneu products your business needs.
- 3
Test End-to-End
Run test transactions, payouts, or verification calls in the sandbox environment.
- 4
Go Live
Move to production credentials, with the Peneu team on hand for go-live.
Any language that can make HTTPS requests works, for example:
curl -X POST https://api.peneu.com/v1/payments \
-H "Authorization: Bearer <PENEU_API_KEY>" \
-H "Content-Type: application/json" \
-d '{
"amount": 149900,
"currency": "INR",
"order_id": "ORDER_10234",
"payment_methods": ["upi", "card", "netbanking"]
}'API Reference
A consistent request pattern across every product
A sample of the core endpoints businesses integrate against most — collection, payouts, verification, and account data all follow the same authentication and request shape.
curl -X POST https://api.peneu.com/v1/collections/order \
-H "Authorization: Bearer <PENEU_API_KEY>" \
-H "Content-Type: application/json" \
-d '{
"amount": 249900,
"currency": "INR",
"order_id": "ORDER_10234",
"payment_methods": ["upi", "card", "netbanking"]
}'{
"order_id": "order_SP9V21x",
"status": "created",
"amount": "₹2,499.00",
"checkout_url": "checkout.peneu.com/pay/9V21x"
}API & Security
Security built into every request
Integration practices
What makes a payment integration last
These apply to any payment integration, with Peneu or anyone else. Most production incidents in payments come from skipping one of them.
Treat notices as the source of truth
A customer's browser returning to your site doesn't prove payment. Mark orders paid from the server-to-server notice (webhook) or a status check, never from the redirect alone.
Verify every notice
Check the signature on each webhook with your secret before acting on it, and reject anything that fails. Anyone can send a request to a public URL.
Expect duplicates and disorder
Notices can arrive twice, late or out of order. Make handling idempotent: processing the same event twice must have no extra effect, and a later status must not be overwritten by an earlier one.
Use idempotency keys for money-moving requests
When you retry a payout or refund after a timeout, send the same idempotency key so the request can't be executed twice.
Handle 'pending' as a real state
Some payments take time to reach a final status. Don't show failure, and don't ask the customer to pay again, until the status is final.
Keep secrets on the server
API keys and webhook secrets belong in server-side configuration, never in browser or app code, and are rotated when people with access leave.
| Test | Expect |
|---|---|
| Successful payment | Order paid from the notice; confirmation sent once |
| Declined payment | Clear message; customer can retry without a second order |
| Customer closes the tab after paying | Order still paid from the notice |
| Same notice delivered twice | No duplicate fulfilment or email |
| Refund, full and partial | Customer credited; your records updated |
| Request times out and is retried | No duplicate payout or refund, thanks to the idempotency key |
A worked example of notices and status checks: collection API handbook.
Ready to start building?
Request sandbox access and we'll set you up with test keys and the API reference.