Information
- OpenAPI version:
3.1.0
Overview
Payplug Elements API 1.40.0
Section titled “Payplug Elements API 1.40.0”Split-payment orchestration for the Payplug Elements.
Two callers, and the split is the whole security model.
Your SERVER speaks OAuth2: a client_credentials access token from POST /oauth/token, then session creation, searches and refunds.
The BROWSER only ever holds the opaque session token that session creation hands back : the sessionId, your credentials and the access token never reach a page.
You do not integrate the browser endpoints (/elements/*), the Payplug Elements calls them for you. They are documented because you will see them leave your own page in your browser developer tools. Reads keep working for a short grace period after the session ends; actions do not. The client POLLS GET /elements/session for updates.
Every endpoint here is one YOU call, except the webhooks: the reverse direction, our calls to your server when a session ends or a dispute is raised — the only way to learn the PSP references and the card alias.
Authentication
Section titled “ Authentication ”elementsToken
Section titled “elementsToken”Opaque elements token (pst_…)
Security scheme type: http
apiToken
Section titled “apiToken”OAuth2 access token (POST /oauth/token)
Security scheme type: http
Bearer format: JWT
notificationSecret
Section titled “notificationSecret”The value agreed with you, sent verbatim in the authorization header of every notification: check it before trusting the body.
Security scheme type: apiKey
Header parameter name: authorization