Payment Flow

When you initiate an APM payment, the response includes an apmResponseData.actionType field that determines what happens next. There are three flow types: Redirect, QR Code, and Server-to-Server (S2S).

All three flows use the same API endpoint and the same webhook-based final result. The difference is what happens between the initial response and the webhook.

The webhook callback is always the source of truth for the final transaction result. Do not rely on redirects, QR confirmation, or the initial response.

---

Quick Reference

---

Flow 1: Redirect (actionType = REDIRECTION)

The customer is redirected to the payment provider to complete authentication and authorization.

1. Receive transactionStatus: "CUSTOMER_VERIFICATION" with apmResponseData.redirectUrl (and optionally iframeUrl)
2. Redirect the customer to redirectUrl or embed iframeUrl
3. Customer completes authentication
4. Provider redirects back to your successRedirectUrl or failureRedirectUrl
5. Final result arrives via webhook

Redirect vs Iframe

If both are available, use iframe on desktop and redirect on mobile.

---

Flow 2: QR Code (actionType = QR)

Used when the customer scans a QR code with a mobile payment app.

1. Receive transactionStatus: "CUSTOMER_VERIFICATION" with:
   • qrData (Base64 QR image)
   • qrDeepLink
   • qrCodeImageUrl
2. On desktop: display QR for scanning
3. On mobile: open deep link
4. Customer stays on your page during payment
5. Final result arrives via webhook

QR Expiration

QR codes usually expire within 1–5 minutes. Show a countdown and allow regeneration. Do not reuse expired QR codes.

---

Flow 3: Server-to-Server (actionType = NONE)

No customer interaction after the request.

The response can be:

• Final (SUCCEED or FAILED)
• Async (PROCESSING or PENDING)

If async:

• Wait for webhook
• Poll after ~5 minutes only as fallback

---

Common Patterns

---

Related

• API Reference: POST /api/v1/payments/apm
• Handling the Callback
• Checksum Authentication
• APM Payload References