Card Payments

Server-to-server (S2S) charging lets your backend send card details directly to Axra. It puts your servers in PCI DSS scope, so it is off by default — approval of your business account does not enable it.

Most integrations do not need S2S. Checkout sessions and payment links keep card data on Axra’s hosted page, which keeps you out of PCI scope. Those work on every approved account with no extra step.

Check whether it’s enabled

GET /v1/business/config returns your current entitlement:

curl https://api.useaxra.com/api/v1/business/config \
  -H "x-api-key: YOUR_API_KEY"

{
  "id": "…",
  "businessName": "…",
  "isActive": true,
  "s2sChargingEnabled": false
}

If s2sChargingEnabled is false, contact support to request access. Charging before it is granted returns 403:

{
  "statusCode": 403,
  "message": "Server-to-server card charging is not enabled for this business. Use a checkout session or payment link, or contact support to request access."
}

Charge a card

curl -X POST https://api.useaxra.com/api/v1/business/payment/charge \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 50.00,
    "currency": "USD",
    "card": {
      "number": "4111111111111111",
      "expiryMonth": "12",
      "expiryYear": "2030",
      "cvv": "123",
      "holderName": "Jane Doe"
    },
    "customerIp": "203.0.113.42",
    "email": "jane@example.com",
    "returnUrl": "https://your-site.example/order/1234/complete",
    "browser": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 ...",
    "browserDetails": {
      "acceptHeaders": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
      "colorDepth": 24,
      "javaEnabled": false,
      "javascriptEnabled": true,
      "language": "en-US",
      "screenHeight": 1080,
      "screenWidth": 1920,
      "timeZone": -60
    }
  }'

returnUrl is still the payer’s destination after 3DS. After the challenge they return via Axra’s page; we then send them to your returnUrl with 3ds=complete or 3ds=failed and paymentId appended. That URL is never shared with the card processor. customerIp must be your customer’s IP address, not your server’s. It feeds risk scoring and the 3DS authentication request; sending your own IP degrades both.

Always send browser and browserDetails. The card issuer uses these EMV-3DS2 signals to decide whether it can authenticate the cardholder without a challenge. When they are missing, the issuer commonly falls back to demanding a challenge — and in production we have seen issuers then fail the authentication outright rather than present one, so the payment dies with no prompt ever shown to the customer.They cannot be derived on our side: on a server-to-server charge the HTTP request comes from your server, not the cardholder’s browser. Collect them in the browser and pass them through, exactly as you already do for customerIp.

Collecting the browser signals

// Run this in the cardholder's browser and post the result to your server
// alongside the card details.
function collectBrowserData() {
  const tz = new Date().getTimezoneOffset();
  return {
    browser: navigator.userAgent,
    browserDetails: {
      acceptHeaders: 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
      colorDepth: screen.colorDepth ?? 24,
      javaEnabled: typeof navigator.javaEnabled === 'function' ? navigator.javaEnabled() : false,
      javascriptEnabled: true,
      language: navigator.language || 'en-US',
      screenHeight: screen.height,
      screenWidth: screen.width,
      timeZone: tz,
    },
  };
}

If a payment fails authentication and these were absent, the payment’s failure.hint will say so — see Retrieving a payment.

3DS handling

If the card requires 3D Secure, the response comes back with requiresAction and a redirectUrl. Send the customer there, then confirm via POST /v1/business/payment/confirm-3ds. See the 3DS guide for the full flow. Confirming and refunding are not gated on the S2S entitlement, so a charge already in flight always completes.

API Reference

See full endpoint documentation.

Payments

Treasury

Webhooks

SDKs

Card Payments

Check whether it’s enabled

Charge a card

Collecting the browser signals

3DS handling

API Reference

​Check whether it’s enabled

​Charge a card

​Collecting the browser signals

​3DS handling

API Reference

Check whether it’s enabled

Charge a card

Collecting the browser signals

3DS handling