API and MCP

Create a test or live key in Dashboard -> Developers. The raw key is shown once; only a hash is stored. A revoked or expired key stops working immediately.

Send it as Authorization: Bearer tp_test_... or tp_live_.... Test keys can only act on the test workspace. A live key works in live mode.

• read: list transactions, links, orders, analytics, refunds, subscriptions and loyalty.
• write: create links and orders, confirm or reject payments, and record refunds.

A request that needs a scope the credential does not have returns 403.

x-toropay-mode: test or live selects the workspace. API keys are bound to their own mode; test keys can never act on live data.

• GET /api/v1/transactions
• POST /api/v1/transactions/{id}/confirm
• POST /api/v1/transactions/{id}/reject
• POST /api/v1/orders, GET /api/v1/orders/{id}, GET /api/v1/orders/{id}/payment-status
• GET/POST /api/v1/links
• GET/POST /api/v1/refunds
• GET /api/v1/subscriptions
• GET/POST /api/v1/coupons
• GET /api/v1/loyalty/{customer_id}
• GET /api/v1/analytics

Requests are logged with the route, status and the credential that made them.

ToroPay exposes an OAuth 2.0 authorization server for the external ToroPay MCP connector. In Settings -> Connected apps, add the MCP URL shown there (https://toropay-mcp.vercel.app/mcp) to your AI client and sign in with your ToroPay account.

The consent screen lists the scopes. read lets the assistant see transactions, links and analytics. write lets it create and confirm payments on your behalf.

Access tokens last 30 days and can be revoked from Connected apps at any time. Revoking takes effect immediately.

• A write-scoped assistant can confirm a payment as received, create an order marked paid, and record a refund.
• It can act on the live workspace, not only test data.
• Every change is audit-logged and can fire your webhooks.
• Grant write only to an assistant you trust with payment records.

The MCP server itself is a separate deployment. This repository contains the OAuth endpoints, tokens, scopes and the v1 API the assistant calls. The assistant’s own tool list and prompts are outside this codebase.