Terminals (Public ID / API Secret)
Basic-auth allow-list. A wrong pair gets the documented 401 with an EMPTY body and WWW-Authenticate: Basic realm="CloudPayments". The API Secret also signs webhooks (Content-HMAC / X-Content-HMAC).
Webhook endpoints
Per-kind notification URLs (merchant-cabinet model). Empty = disabled (env default applies when set). Check is delivered synchronously and vetoes payments with codes 10/11/12/13/20 — or on any delivery failure.
Transactions
Actions transition state immediately and fire the matching webhook. "re-notify" re-fires for the CURRENT state (duplicate-delivery testing).
Card tokens
Subscriptions
No real timers: "charge now" runs one billing tick with the documented semantics (24h retry ⇒ PastDue after 1–2 failures, 3 strikes ⇒ Rejected, MaxPeriods ⇒ Expired).
Orders (payment links)
Test cards
| Number | Brand | 3-DS | Payment | Token payment |
|---|---|---|---|---|
| 4242424242424242 | Visa | yes | success | success |
| 5555555555554444 | Mastercard | yes | success | success |
| 2200000000000004 | МИР | yes | success | success |
| 4012888888881881 | Visa | yes | InsufficientFunds (5051) | — |
| 5105105105105100 | Mastercard | yes | InsufficientFunds (5051) | — |
| 2202202202202200 | МИР | yes | InsufficientFunds (5051) | — |
| 4000000000003055 | Visa | no | success | success |
| 5205000000003055 | Mastercard | no | success | success |
| 2202000000003055 | МИР | no | success | success |
| 4111111111111111 | Visa | no | success | InsufficientFunds (5051) |
| 5200828282828210 | Mastercard | no | success | InsufficientFunds (5051) |
| 2200000022222222 | МИР | no | success | InsufficientFunds (5051) |
| 4000056655665556 | Visa | no | InsufficientFunds (5051) | — |
| 5404000000000043 | Mastercard | no | InsufficientFunds (5051) | — |
| 2203000000000043 | МИР | no | InsufficientFunds (5051) | — |
Cryptogram convention: base64(JSON.stringify({number, exp, name})). Hosted card form: /widget.