Developer dashboard

Quick Start Guide#

Process your first payment in 5 minutes with AuxCORE on Sandbox.


What you'll build#

  • Authenticate with your API key
  • Test the connection
  • Process a test sale
  • Look up the transaction
  • Issue a refund

Time: ~5 minutes
Level: Beginner


Prerequisites#

  • A Sandbox dashboard login at https://uat.auxcore.net
  • A Secret API key (api-…) — Dashboard → Settings → Developer & Integrations → API Keys. Not the SDK public key (lpk_live_…): that one only works in the browser.
  • curl or any HTTP client

The key alone identifies your tenant and merchant, so no tenant or merchant ID is needed.


Base URL#

Pick the host that matches your dashboard login:

Environment BASE_URL
Sandbox https://uat.auxcore.net/api/v1/public
Production https://app.auxcore.net/api/v1/public

This guide uses Sandbox. Replace the host if you are on production.


Step 1: Environment variables#

Export your key once. Every snippet below reads it from the environment, whichever language you pick.

bash
export API_KEY="YOUR_SECRET_API_KEY"
export BASE_URL="https://uat.auxcore.net/api/v1/public"

The Node.js, Python and PHP snippets share this small helper. Paste it at the top of your script:

// quickstart.mjs — Node.js 18+ (built-in fetch)
const BASE_URL = process.env.BASE_URL ?? 'https://uat.auxcore.net/api/v1/public';

async function auxcore(method, path, body) {
  const res = await fetch(`${BASE_URL}${path}`, {
    method,
    headers: { 'x-api-key': process.env.API_KEY, 'Content-Type': 'application/json' },
    body: body ? JSON.stringify(body) : undefined,
  });
  return { status: res.status, body: await res.json() };
}

Step 2: Test connection#

curl -X POST "$BASE_URL/testConnection" \
  -H "x-api-key: $API_KEY"

Expect HTTP 200 with "success": true and a message naming the merchant the key belongs to.


Step 3: Process a test sale#

The Public API never accepts raw card numbers on Sandbox or Production. You first exchange the card for a pciToken, then charge the token.

3a. Tokenize a test card#

On Sandbox, the quickest way to get a token is to send a test card to /tokenize-card with your secret key:

curl -X POST "$BASE_URL/tokenize-card" \
  -H "x-api-key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "cardNumber": "4111111111111111",
    "expiryMonth": "12",
    "expiryYear": "2030",
    "cvv": "123",
    "cardHolderName": "Test Customer"
  }'

# Copy data.pciToken from the response
export PCI_TOKEN="pci_tok_8f2c1a9b7e4d"
json
{
  "success": true,
  "data": {
    "pciToken": "pci_tok_8f2c1a9b7e4d",
    "last4": "1111",
    "cardBrand": "visa",
    "singleUse": true,
    "status": "active"
  }
}

Tokenize the card again for each new sale. To charge the same card later, save it on file with saveCard (see Transactions).

Production: sending card numbers from your server puts that server in PCI scope. For real customers, collect the card in the browser with the PCI SDK, which tokenizes inside a hosted iframe and hands your page only the pciToken.

3b. Charge the token#

curl -X POST "$BASE_URL/transaction" \
  -H "x-api-key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "Amount": 10.00,
    "SuggestedMode": "Card",
    "pciToken": "'"$PCI_TOKEN"'",
    "BillingCustomerName": "Test Customer",
    "BillingEmail": "test@example.com",
    "BillingPostalCode": "78701"
  }'

# Copy data.TransactionId from the response
export TRANSACTION_ID="550e8400-e29b-41d4-a716-446655440020"

Approved response (abbreviated):

json
{
  "success": true,
  "status": "success",
  "status_code": 200,
  "message": "Transaction approved",
  "data": {
    "TransactionId": "550e8400-e29b-41d4-a716-446655440020",
    "Status": "1",
    "Amount": 10.00,
    "BaseAmount": 10.00,
    "ConvenienceFee": 0,
    "AuthCode": "123456",
    "ResponseCode": "100",
    "ResponseMessage": "Approved"
  }
}
  • Status: "1" = approved ("2" pending, "9" declined)
  • ResponseCode: "100" = approval (codes are normalized to the NMI convention)
  • A decline returns HTTP 402 with "status": "declined"

Step 4: Get transaction details#

curl "$BASE_URL/transaction/$TRANSACTION_ID" \
  -H "x-api-key: $API_KEY"

Step 5: Refund#

curl -X POST "$BASE_URL/refund" \
  -H "x-api-key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "transactionId": "'"$TRANSACTION_ID"'"
  }'

transactionId (also accepted as TransactionId or transaction_id) is the data.TransactionId from the sale. Add amount for a partial refund; omit it for a full refund.


Test cards (Sandbox)#

To try a decline or another card brand, repeat Step 3 with a different card from the test card list.


Next steps#

  1. SDK embed → — no-code checkout with lpk_live_… keys
  2. Transactions →
  3. Payment links →
  4. Webhooks →
  5. All endpoints →

Troubleshooting#

Error Fix
401 API key required Send the x-api-key header
401 API key validation failed (or Invalid API key) Key unknown, disabled or from the other environment — check /settings/developer/api-keys
400 PCI_SCOPE_VIOLATION Raw card data not allowed here — send a pciToken
403 on /tokenize-card You used the SDK public key — use the secret key
402 declined (Status: "9") Tokenize an approved test card on Sandbox

Questions? Contact support@auxcore.net