Getting Started with AuxCORE#

Welcome to AuxCORE — the merchant payment platform behind AuxPAY. This guide covers how merchants and developers integrate card, ACH, payment links, and the no-code SDK.

What is AuxCORE?#

AuxCORE is the payment orchestration platform behind AuxPAY. Merchants use the dashboard for Virtual Terminal, payment links, and reporting. Developers integrate via:

• Public REST API (/api/v1/public/*) — ERP, plugins, server-side automation
• No-code SDK (auxVault.js) — hosted PCI fields in any website
• Dashboard APIs (/api/v1/*) — admin operations with JWT

Core capabilities:

• Payment processing — Card, ACH, auth/capture, voids, refunds
• Payment links & invoicing — Hosted pay pages and Text-to-Pay
• Customer vault — Stored customers and payment methods
• Recurring billing — Subscription plans
• Multi-gateway routing — FluidPay, NMI, TSYS, and more (configured per merchant)
• PCI-safe tokenization — Card data collected via vault.auxcore.net, not your server

Merchant workflow (AuxCORE)#

Typical merchant setup:

1. Admin provisions merchant — Gateway, pricing, and VT settings in the dashboard
2. Credentials — Gateway keys saved under Merchants → Gateways (or deferred for external gateway onboarding)
3. API keys — Merchant creates keys in Settings → Developer & Integrations → API Keys (Secret for REST and the WooCommerce plugin, SDK Public for website embed)
4. Test — Virtual Terminal or the SDK tester in Settings → Developer & Integrations
5. Go live — Switch to production host and live gateway credentials

Developers integrating ERP/checkout use the Public API with a Secret API key. Website embeds use an SDK Public key (lpk_live_…) — never expose secret keys in HTML.

Quick Start (5 minutes)#

The Quick Start takes you from an API key to an approved, looked-up and refunded Sandbox payment in five copy-paste steps:

1. Get a secret API key — Settings → Developer & Integrations → API Keys
2. Test the connection — POST /testConnection
3. Tokenize a test card and charge it — POST /tokenize-card, then POST /transaction with the pciToken
4. Look up the transaction — GET /transaction/:id
5. Refund it — POST /refund

For an external integration team, invite them as Merchant Integrator (Team). That role can create SDK keys, use the live SDK tester, and configure webhooks without access to Virtual Terminal, transactions, or team management. Staff does not include the developer portal.

Start the Quick Start →

Base URLs#

See Environments for every host and URL.

Required headers#

Server integrations send both headers on every authenticated Public API call:

x-api-key: YOUR_API_KEY
Content-Type: application/json

No tenant header is needed: the tenant and merchant are resolved from the key (X-Tenant-ID is ignored on /api/v1/public/*). Tenant-wide ERP keys (lv_erp_…) also send X-Merchant-ID to pick the merchant.

Customer-facing hosted payment links (GET /payment-links/:linkId, etc.) do not require an API key — those are browser flows.

Security best practices#

1. Never expose secret API keys (api-…) in client-side code
2. Use SDK Public keys (lpk_live_…) for website embeds only
3. Collect cards with the PCI SDK so card numbers never reach your server — the API only charges a pciToken
4. Validate webhook signatures (X-Webhook-Signature)
5. Rotate API keys periodically

Test card numbers (Sandbox)#

See the test card list on the Testing page.

Additional resources#

• Authentication
• Environments
• Quick Start (detailed)
• SDK embed guide
• All endpoints
• Developer Portal — live SDK tester (when logged in)

Need help? Contact support@auxcore.net