Sandbox open · live processing after underwriting

A payment gateway you actually own, not another reseller integration

Chargezoom exposes its own merchant API and routes authorizations to the acquiring platform of your choice. Tokenization, batch settlement, funding reconciliation and signed webhooks are part of the platform — not bolt-ons.

Start in sandbox Merchant sign in

POST /api/public/gateway/v1/transactions
Authorization: Basic <apiLoginId:transactionKey>
Idempotency-Key: order-1001

{ "type": "purchase", "amount": "24.99",
  "card": { "number": "4111111111111111", "expMonth": 12, "expYear": 2030 } }

201 { "status": "captured", "transactionId": "…", "authCode": "T7A91C" }

Everything a gateway has to do

Card acceptance is the easy part. The hard part is state, money movement and evidence — which is where this platform spends its complexity.

Processor-agnostic routing

One gateway contract, many acquirers. Fiserv / First Data Commerce Hub ships first, with priority-based routing, per-currency accounts and a sandbox simulator for tests.

Tokenized card vault

PANs are encrypted with AES-256-GCM the moment they hit the boundary. Only brand, expiry and last four stay queryable, and vault columns are unreachable from client APIs.

Full transaction lifecycle

Authorize, purchase, verify, capture, void, refund and unreferenced credit — each transition recorded as an immutable event with normalized decline codes.

Batching and funding

Captures accumulate into a daily batch, close on schedule or on demand, then reconcile against processor funding with gross, fee and net deposit tracking.

Merchant + operator portals

Merchants get a virtual terminal, transaction search and developer settings. Platform operators get underwriting, live enablement, funding and a full audit log.

Safety rails by default

Idempotency keys, duplicate detection, velocity limits, redacted logging, HMAC-signed webhooks with retries and role-scoped row level security.

Compliance posture

Raw card numbers are accepted only at the API boundary and never persisted in plaintext, never logged and never returned to a client.

Live processing stays disabled until a platform operator approves the merchant and PCI controls are attested. Sandbox uses test cards exclusively.

Every privileged action — key issuance, revocation, status changes, funding — is written to an append-only audit trail.