Payer routes

The payer view

Unauthenticated. No API key accepted. No merchant data returned. A payer session in Payday-Payer-Session unlocks gated content for exactly one request.

Sessions#

  • Opaque token; 24-hour validity; stored hashed; bound to one deposit request.
  • Minted by: email verification start, client-secret exchange, wallet challenge (permissionless only), or the merchant preview route.
  • Header transport only. Never in a path or query.

Disclosure#

ShownAlwaysAfter verificationAfter the wallet step
Issuer name and heading
Status, deadline, whether it is payable
Amount, remaining, chain, token—
Payer name, notes, reference, PDF—
One-time address, QR, wallet button——
Field availability by state. Permissionless requests begin in the second column.

Never present: payout_address, recovery_address, metadata, customer_id, issuer_id, policy assertions. expected_email is masked (a****@c***.example); absent under merchant_session. Gated fields are null, not omitted.

Locked
{
  "id": "dr_0198f80c-8d2f-7dc1-a369-90556a64f700",
  "issuer_name": "Acme LLC",
  "heading": "March retainer",
  "payer_policy": { "mode": "verified_email", "expected_email_hint": "a****@c***.example" },
  "requirements": { "email": "pending", "wallet": "pending", "merchant_session": "not_required", "complete": false },
  "status": "awaiting_deposit",
  "payable": true,
  "expires_at": "2026-09-06T13:00:00Z",
  "server_timestamp": "1757160000",
  "settlement_tx_hash": null,
  "settlement_explorer_url": null,
  "payer_message": null,
  "content_unlocked": false,
  "chain": null,
  "token": null,
  "amount": null,
  "amount_base_units": null,
  "received": null,
  "received_base_units": null,
  "remaining": null,
  "remaining_base_units": null,
  "payer_wallet": null,
  "address": null,
  "address_explorer_url": null,
  "deposit_uri": null,
  "details": null
}

CORS#

  • Reads (GET): any origin. Payday-Payer-Session allowed.
  • Writes (verification, session exchange, wallet): hosted checkout origin only. Body limit 8 KiB.
  • JSON responses: Cache-Control: no-store.

Routes#