PayMeNow

Getting started

Environments, which host to call, and the ground rules for amounts, time and currency.

Generated from public-api.mdVersion 1.2.0Last updated 2026-09-20

#Environments

Brand identity is environment-driven (BRAND_DOMAIN, see docs/rebranding.md), so this document writes hosts as <domain> placeholders. For the current production brand, <domain> is paymenow.asia.

EnvironmentBase URLCurrent valueData
Productionhttps://api.<domain>/v1https://api.paymenow.asiaReal transactions, live payments
Sandboxhttps://sandbox-api.<domain>/v1https://sandbox-api.paymenow.asiaSimulated transactions, no real money

Sandbox is selected by hostname, not by path and not by a header. The edge gateway routes any host beginning with sandbox to the sandbox instance of the API (regex ^sandbox[a-z0-9-]*\.); every other host goes to production. The request path is never rewritten, because the HMAC signature covers it.

Your API key must match the environment you call: a sandbox merchant key on the production host authenticates but operates on production routing, and a production key on the sandbox host operates on the sandbox instance. Always pair pk_demo_… keys with sandbox-api.<domain> and pk_prod_… keys with api.<domain>.

#Overview

The Public API enables merchants to integrate payment processing capabilities into their applications. All API requests require HMAC-SHA256 authentication.

#Production vs Sandbox

Merchant type (set on your merchant account) determines transaction routing:

  • Production Merchant: real money transactions processed through payment providers; rows live in the production transaction tables.
  • Sandbox Merchant: simulated transactions. Responses are produced locally without calling any provider, and rows live in separate sandbox tables. The QR payload returned is a mock, not a scannable PromptPay code.

Every response carries an X-Environment header (sandbox or production) so you can assert which side you reached. Sandbox responses additionally carry X-Sandbox-Mode: true.

#Money, time and currency

  • All amounts are THB. The currency field is validated for length only and stored verbatim; no currency conversion exists and no other currency is processed.
  • Amounts are JSON numbers with 2 decimals. Fees are truncated (not rounded) to 2 decimals.
  • Timestamps in responses are RFC 3339 in Asia/Bangkok (+07:00), for example 2026-09-20T17:32:05+07:00. They are ordinary ISO-8601 instants, so any standards-compliant date parser reads them unchanged; only the offset differs from the Z form used before 2026-09-20. The business day is Asia/Bangkok, so a timestamp's date part is now the Thai business date.