A short summary of the HissPay merchant API. The complete reference is the official documentation v1.13.0 (2026-10-27), currently published in Simplified Chinese.
The complete, up-to-date integration documentation is https://mch.hisspay.com/docs/ (v1.13.0 · 2026-10-27, continuously updated). This page only summarizes it; if anything differs, the official documentation prevails.
HissPay offers pay-in (collect from your customers) and payout (pay to a recipient account) over HTTPS POST with JSON bodies. Production gateway: https://transaction.hisspay.com; sandbox gateway: https://sandbox-api.hisspay.com.
| Operation | Path |
|---|---|
| Create pay-in order | POST /transaction/payin/v1/apply |
| Query pay-in order | POST /transaction/payin/v1/query |
| Create payout order | POST /transaction/payout/v1/apply |
| Query payout order | POST /transaction/payout/v1/query |
| Query balance | POST /transaction/payout/v1/balance |
Currencies in the product catalog: AUD, EUR, GBP, INR, JPY, THB, USD, USDT. A catalog entry is not an activation: the product codes, amount ranges and fees for your account come with your activation notice.
Before integrating: your merchant account is approved; you created an API application in the merchant portal (mch.hisspay.com → App keys) and have its appId and appSecret; pay-in and payout products are signed; your server's public egress IPs are whitelisted for payouts; and you have a public HTTPS notification URL. Test end to end in the sandbox first.
Every request carries the headers appId, timestamp (Unix milliseconds, within 30 seconds of platform time), nonce (at least 10 characters, never reused) and sign. sign is the lowercase hex SHA-256 of the body fields plus appId, timestamp and nonce, sorted by name as key=value pairs joined with &, with appSecret appended directly. It is not HMAC. Never send null values, and never put appSecret in a browser or app.
POST /transaction/payin/v1/apply creates a pay-in order and returns payUrl for the payer. Confirm payment only from a verified notification or an order query, never from the browser return page.
POST /transaction/payout/v1/apply is asynchronous: code=0 means accepted, not paid. A timeout or code 500 means the result is unconfirmed: query the original order first and follow the handling rules in the full documentation before submitting anything again.
USDT pay-in uses currency=USDT and a network-specific product code assigned by the platform; amounts have at most 4 decimal places. The result is confirmed by notification or query.
Thailand (THB): PromptPay QR pay-in and Thai bank transfer payout. Bank codes for pay-in: SCB, KBANK, KTB, BAY, GSB, TTB; for payout: SCB, KBANK, KTB, BAY, GSB, TTB, BBL (the banks usable for your account are listed in your activation notice). Default range per transaction: 500.00–49999.00 THB.
POST /transaction/payin/v1/query and POST /transaction/payout/v1/query take merchantOrderNo or orderNo. Queries are limited to 5 per second per appId; poll every 3–5 seconds with back-off.
POST /transaction/payout/v1/balance returns balance (book), balanceActive (available) and balanceFreeze (held) for a currency.
The platform POSTs JSON to your notifyUrl with the same four signature headers. Verify the signature, process idempotently per order, then reply with exactly SUCCESS or OK. Unacknowledged notifications are retried a limited number of times.
Use payStatus together with paymentStatus and isFinal. A pay-in query with payStatus=0 does not mean the payment failed.
code=0 means the API call succeeded; the payment result is a separate order status. Each error code and the recommended handling are listed in the full documentation.
Create a sandbox merchant, run the quickstart pack and the 5-minute self-check from the sandbox guide, then follow the go-live checklist.
Open an account online to receive test credentials and product codes — go live with one click once your sandbox integration is verified.
HissPay provides technology for payment integration, order management, notifications and reconciliation. Payment processing, clearing and settlement are handled by the contracted licensed payment institution. HissPay does not receive, hold or handle transaction funds.
Displayed rates comprise the licensed payment institution’s processing fees plus HissPay’s technology service fee; they are not solely HissPay fees. The breakdown, billing method and applicable conditions are specified in the merchant’s signed agreements and fee schedule.