Payments

A payment is one request for money from one of your customers: an amount in US dollars (or in your own currency, converted into dollars), the coin they pay with, and a deposit address only this payment uses. Your server creates it with your secret key, sends the customer to pay, and learns the outcome from webhooks.

All of them take your API key (Authorization: Bearer <key>, see Authentication). The key's mode (test or live) decides which payments you create and see.

Lifecycle

pending ─────────────────────────┐
   │                             ▼
   ├──▶ partially_paid ──▶ detecting ──▶ confirmed
   │          │                 │
   ▼          ▼                 ▼
expired    underpaid          failed
   │          │
   └────┬─────┘
        ▼   the rest arrives within 24 hours
    detecting ──▶ confirmed   ("paid_late": true)

Three more events report deposits rather than status changes: payment.wrong_asset (a deposit in another coin than the payment asked for), payment.late_deposit (a deposit after the payment closed) and, with direct settlement, settlement.completed / settlement.failed for each deposit's money. See Webhooks.

How the payment moves:

• pending → partially_paid when a deposit arrives but the total is short of amount_due_usd (beyond your tolerance).
• pending or partially_paid → detecting when the total covers amount_due_usd.
• detecting → confirmed when every deposit that counts has its confirmations (Currencies lists how many).
• detecting → failed when a deposit it relied on is not found on chain within 6 hours, or not confirmed within 48 hours.
• pending → expired and partially_paid → underpaid at expires_at. A payment in detecting never expires.
• expired or underpaid → detecting → confirmed when the customer pays the rest within 24 hours of closing (late payments); the payment then has "paid_late": true.

Only confirmed means you have been paid. Never fulfil an order from detecting, from a customer landing on your success_url, or from anything the browser says.

The payment object

Every endpoint on this page, and every payment.* webhook, returns this object. Here is a live payment that has been paid and confirmed:

{
  "id": "8f3a2c1e9b7d4a6f05e1c2d3",
  "merchant_id": "3f8a1c27b94e05d6a2c71e90",
  "order_id": "ORD-1001",
  "status": "confirmed",
  "deposit_address": "TNVfZ8m3qR6xW2pL9kC4hJ7bD5sYt1uAeG",
  "token": "USDT_TRC20",
  "chain": "tron",
  "livemode": true,
  "crypto_amount": "49.9",
  "received_amount": "49.9",
  "usd_amount": "49.9",
  "amount_due_usd": "49.9",
  "fees_paid_by_customer": false,
  "network_fee": "6.019231",
  "network_fee_usd": "6.03",
  "settlement": "direct",
  "received_usd": "49.9",
  "rate_locked": "1",
  "tx_id": "c192401935e4ac25bb5f7cdba7443ada0e097cfdb537710236bf7d98c60851bd",
  "deposits": [
    {
      "tx_id": "c192401935e4ac25bb5f7cdba7443ada0e097cfdb537710236bf7d98c60851bd",
      "token": "USDT_TRC20",
      "chain": "tron",
      "amount": "49.9",
      "usd_value": "49.9",
      "counted": true,
      "status": "confirmed",
      "seen_at": "2026-10-10T09:03:02.418Z",
      "confirmed_at": "2026-10-10T09:04:03.77Z",
      "from": "TL8wHk3sD9pQ2vX6mB4nJ7cR5fY1tGzEaW",
      "block": 79412538,
      "made_at": "2026-10-10T09:02:57Z"
    }
  ],
  "expires_at": "2026-10-10T09:15:00.112Z",
  "created_at": "2026-10-10T09:00:00.112Z",
  "confirmed_at": "2026-10-10T09:04:03.77Z",
  "network_fee_note": "Final in about a minute.",
  "qr_payload": "TNVfZ8m3qR6xW2pL9kC4hJ7bD5sYt1uAeG",
  "checkout_token": "6f1e2a9c4d7b3e05a8c1f2d4",
  "checkout_url": "https://pay.example.com/pay/6f1e2a9c4d7b3e05a8c1f2d4",
  "description": "2 x Acme T-shirt",
  "metadata": { "customer_id": "cus_42" },
  "customer_email": "jane@example.com",
  "success_url": "https://acme.example/thanks",
  "cancel_url": "https://acme.example/cart",
  "webhook_url": "https://acme.example/payitgo/orders/ipn"
}

Amounts are decimal strings ("49.9", "0.00117"), so no precision is lost: parse them with a decimal type, not a float. Times are RFC 3339 in UTC; the number of fractional digits varies, so use a real RFC 3339 parser. Fields marked "optional" below are left out of the JSON when they have no value.

The deposit object

Each entry of deposits is one transfer to the payment's address (or its destination tag on XRP):

Every deposit that becomes final is settled to you (the parts of a payment paid in parts together, once it closes: one fee), counted or not, less the fees (Fees and settlement).

QR codes

qr_payload is the deposit address alone, on every network: the same as deposit_address. Show it as a QR code next to the address and the amount.

It carries no amount, token contract or XRP destination tag, on purpose: exchange apps such as Binance, where many customers pay from, reject payment URIs (ethereum:…, bitcoin:…, xrpl:…) as a malformed address. The customer types the amount, and for XRP the tag, so show both as text with copy buttons.

Amounts: what is asked, what is due, what arrived

For a BTC or ETH payment, read the dollars from amount_due_usd, received_usd and each deposit's usd_value; rate_locked is the dollar price of one coin. Settlements and payouts carry their dollar values too (Amounts in dollars).

A payment counts as paid when received_usd reaches amount_due_usd, less your underpayment tolerance.

With fees_paid_by_customer on, amount_due_usd is higher than usd_amount, so you receive your full price after the fees. A $100.00 order in USDT_TRC20 with a $1.39 network fee and the 1% service fee asks the customer for $102.42 (the formula).

Create a payment

POST /v1/payments · API key

Creates a payment for one of your orders. With a token, the payment gets its deposit address, locked rate and 15-minute deadline at once. Without one, the customer chooses the coin on the checkout page first.

Parameters

The body is JSON; send Content-Type: application/json (without it the body is not read, and you get order_id is required).

Give the price as amount_usd, or as price_amount and price_currency together: not both. token and tokens may only name tokens you accept (accepted tokens).

Request

curl -s https://api.payitgo.co/v1/payments \
  -H "Authorization: Bearer $PAYITGO_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "order_id": "ORD-1001",
    "amount_usd": "49.90",
    "token": "USDT_TRC20",
    "description": "2 x Acme T-shirt",
    "metadata": {"customer_id": "cus_42"},
    "customer_email": "jane@example.com",
    "success_url": "https://acme.example/thanks",
    "cancel_url": "https://acme.example/cart"
  }'

Response

201 Created with the new payment (a test key, so livemode is false):

{
  "id": "8f3a2c1e9b7d4a6f05e1c2d3",
  "merchant_id": "3f8a1c27b94e05d6a2c71e90",
  "order_id": "ORD-1001",
  "status": "pending",
  "deposit_address": "TNVfZ8m3qR6xW2pL9kC4hJ7bD5sYt1uAeG",
  "token": "USDT_TRC20",
  "chain": "tron",
  "livemode": false,
  "crypto_amount": "49.9",
  "received_amount": "0",
  "usd_amount": "49.9",
  "amount_due_usd": "49.9",
  "fees_paid_by_customer": false,
  "network_fee": "3.212009",
  "network_fee_usd": "3.22",
  "settlement": "direct",
  "received_usd": "0",
  "rate_locked": "1",
  "deposits": [],
  "expires_at": "2026-10-10T09:15:00.112517888Z",
  "created_at": "2026-10-10T09:00:00.111798165Z",
  "network_fee_note": "Final in about a minute.",
  "qr_payload": "TNVfZ8m3qR6xW2pL9kC4hJ7bD5sYt1uAeG",
  "checkout_token": "6f1e2a9c4d7b3e05a8c1f2d4",
  "checkout_url": "https://pay.example.com/pay/6f1e2a9c4d7b3e05a8c1f2d4",
  "description": "2 x Acme T-shirt",
  "metadata": { "customer_id": "cus_42" },
  "customer_email": "jane@example.com",
  "success_url": "https://acme.example/thanks",
  "cancel_url": "https://acme.example/cart"
}

Send the customer to checkout_url, or show crypto_amount, token, deposit_address and expires_at on your own page (Checkout).

Let the customer choose the coin

Send only the order and the amount:

curl -s https://api.payitgo.co/v1/payments \
  -H "Authorization: Bearer $PAYITGO_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"order_id": "ORD-1002", "amount_usd": 25}'

201 Created. The payment has no coin and no address yet. token_options lists what the customer may choose from (shortened here to three of the twelve tokens), and expires_at is one hour away:

{
  "id": "c41e7a9d2b05f3e8a6d17c90",
  "merchant_id": "3f8a1c27b94e05d6a2c71e90",
  "order_id": "ORD-1002",
  "status": "pending",
  "token_options": [
    { "token": "USDT_TRC20", "chain": "tron", "min_usd": "6.44", "network_fee_usd": "3.22", "fee_note": "Final in about a minute." },
    { "token": "USDT_BEP20", "chain": "bsc", "min_usd": "1", "network_fee_usd": "0.01", "fee_note": "Final in under a minute." },
    { "token": "BTC", "chain": "bitcoin", "min_usd": "10", "network_fee_usd": "0.22", "fee_note": "Final in about 30 minutes (3 confirmations)." }
  ],
  "deposit_address": "",
  "token": "",
  "chain": "",
  "livemode": false,
  "crypto_amount": "0",
  "received_amount": "0",
  "usd_amount": "25",
  "amount_due_usd": "25",
  "fees_paid_by_customer": false,
  "network_fee": "0",
  "network_fee_usd": "0",
  "settlement": "direct",
  "received_usd": "0",
  "rate_locked": "0",
  "deposits": [],
  "expires_at": "2026-10-10T10:00:00.832686526Z",
  "created_at": "2026-10-10T09:00:00.832686526Z",
  "network_fee_note": "",
  "qr_payload": "",
  "checkout_token": "b28d4f61e9a03c75d2e8f1a6",
  "checkout_url": "https://pay.example.com/pay/b28d4f61e9a03c75d2e8f1a6"
}

The customer picks a coin on the hosted checkout, or on your own page: your server then sets it with POST /v1/payments/{id}/token. Only then does the payment get its deposit_address, rate_locked, crypto_amount, qr_payload and a new expires_at 15 minutes later. To offer fewer coins, pass "tokens": ["USDT_TRC20", "USDT_BEP20"].

With its own webhook URL

curl -s https://api.payitgo.co/v1/payments \
  -H "Authorization: Bearer $PAYITGO_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"order_id": "ORD-1003", "amount_usd": 30, "token": "USDT_TRC20", "webhook_url": "https://acme.example/orders/ORD-1003/ipn"}'

The response is the same payment object, with "webhook_url": "https://acme.example/orders/ORD-1003/ipn" at the end. Every payment.* and settlement.* notification of this payment goes to that URL, and none to your account's webhook URL.

Prices in other currencies

To price a payment in your own currency, send price_amount and price_currency (an ISO 4217 code: EUR, GBP, NGN…) instead of amount_usd:

curl -s https://api.payitgo.co/v1/payments \
  -H "Authorization: Bearer $PAYITGO_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"order_id": "ORD-1004", "price_amount": "45.50", "price_currency": "EUR", "token": "USDT_TRC20"}'

payitgo converts the price into dollars when the payment is created, at the exchange rate of the moment, and rounds it to the cent. The response is the usual payment object, priced in dollars, with your price and the rate next to it:

{
  "usd_amount": "49.23",
  "price_amount": "45.5",
  "price_currency": "EUR",
  "price_rate": "1.082",
  "amount_due_usd": "49.23",
  "crypto_amount": "49.23",
  "token": "USDT_TRC20"
}

(Shortened: every other field is there as usual.)

• Everything else is in dollars. usd_amount, amount_due_usd, crypto_amount, the fees, the token minimums and the underpayment tolerance all work from the converted usd_amount, exactly as for a price given in amount_usd. The rate is fixed at creation: the payment does not follow the currency afterwards.
• The payment keeps your price. price_amount, price_currency (in upper case) and price_rate (the dollar value of one unit of the currency) are on the payment in every response, in its webhooks and on the checkout view, so a page can show "€45.50 (≈ $49.23)". They are absent for a payment priced in dollars.
• The rates come from two market data sources (the second when the first does not answer), refreshed every 10 minutes. When neither answers, a rate up to 6 hours old is used; with none at all, the request fails with 503 exchange rate unavailable for price_currency: try again shortly: nothing is created, so send it again a little later.
• A retry for an order that has an open payment returns that payment unchanged, at the rate it was created with (safe retries).

Safe retries

While an order has an open payment (pending, partially_paid or detecting) in the key's mode, creating it again returns that same payment with 200 OK instead of 201, and makes nothing new. The retried request is still checked for errors, but its other fields (amount, token, webhook_url…) are ignored: the customer is never shown a second address or amount. So a request that timed out can simply be sent again.

Once the payment is closed (confirmed, expired, underpaid or failed), the same order_id creates a new payment. Test and live payments never share an order.

Order ids are unique per store. A store's key only finds its own store's open payments: two shops on one account can both send "order_id": "1234" and get two payments, as long as each uses the key of its own store. A key with no store sees the payments made with keys that have no store. So you never change your order numbers to keep shops apart: give each shop its own store and key.

Errors

Every error is {"error": "<message>"}.

Choose the coin later

POST /v1/payments/{id}/token · API key

Sets the coin of a payment created without one, once the customer has picked it on your own page. The answer is the whole payment, as GET /v1/payments/{id} returns it, now with its address, locked rate, amount, QR code payload and a deadline 15 minutes away: everything your page shows. SDKs: payments.selectToken(id, token) (select_token in Python, SelectToken in Go).

curl -s https://api.payitgo.co/v1/payments/c41e7a9d2b05f3e8a6d17c90/token \
  -H "Authorization: Bearer $PAYITGO_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"token": "USDT_TRC20"}'

200 OK:

{
  "id": "c41e7a9d2b05f3e8a6d17c90",
  "merchant_id": "3f8a1c27b94e05d6a2c71e90",
  "order_id": "ORD-1002",
  "status": "pending",
  "deposit_address": "TJr7Wq2nX5kP8sB3vH6mC9dF4gL1tYzRaU",
  "token": "USDT_TRC20",
  "chain": "tron",
  "livemode": false,
  "crypto_amount": "25",
  "received_amount": "0",
  "usd_amount": "25",
  "amount_due_usd": "25",
  "fees_paid_by_customer": false,
  "network_fee": "3.211899",
  "network_fee_usd": "3.22",
  "settlement": "direct",
  "received_usd": "0",
  "rate_locked": "1",
  "deposits": [],
  "expires_at": "2026-10-10T09:16:48.029135472Z",
  "created_at": "2026-10-10T09:00:00.832686526Z",
  "network_fee_note": "Final in about a minute.",
  "qr_payload": "TJr7Wq2nX5kP8sB3vH6mC9dF4gL1tYzRaU",
  "checkout_token": "b28d4f61e9a03c75d2e8f1a6",
  "checkout_url": "https://pay.example.com/pay/b28d4f61e9a03c75d2e8f1a6"
}

The coin can be chosen once, by your server or on the hosted checkout, whichever comes first.

Simulate a test payment

POST /v1/payments/{id}/simulate · API key (test keys only)

A test payment moves no coins. Choose what happens to it instead: payitgo plays the deposits, status changes and webhooks a few seconds apart, through the same processing as live coins. Every outcome, the webhooks it sends and the rules: Test mode.

curl -s -X POST https://api.payitgo.co/v1/payments/c41e7a9d2b05f3e8a6d17c90/simulate \
  -H "Authorization: Bearer $PAYITGO_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"outcome": "partially_paid"}'

200 OK with the payment, its simulation started:

{
  "id": "c41e7a9d2b05f3e8a6d17c90",
  "order_id": "ORD-1002",
  "status": "pending",
  "token": "USDT_TRC20",
  "livemode": false,
  "simulation": { "outcome": "partially_paid", "state": "running" },
  "…": "…"
}

The payment must be pending or partially_paid, and have its coin (except for expired). One simulation runs at a time; once it is done, you can run another (confirmed after partially_paid, to pay the rest). To choose the outcome when you create the payment, pass simulate to POST /v1/payments.

Retrieve a payment

GET /v1/payments/{id} · API key

Returns one payment of the key's mode.

curl -s https://api.payitgo.co/v1/payments/8f3a2c1e9b7d4a6f05e1c2d3 \
  -H "Authorization: Bearer $PAYITGO_KEY"

curl -s https://api.payitgo.co/v1/payments/ORD-1001 \
  -H "Authorization: Bearer $PAYITGO_KEY"

200 OK with the payment object.

Webhooks tell you about every change, so you rarely need to poll. When you do (after your server was down, or to double-check a webhook), fetch the payment from your server and trust what it says over the browser.

List payments

GET /v1/payments · API key

Your payments in the key's mode, newest first. An account-wide key sees all of the account's payments; a storefront key sees only its own store's.

curl -s 'https://api.payitgo.co/v1/payments?status=pending&limit=2&offset=0' \
  -H "Authorization: Bearer $PAYITGO_KEY"

200 OK:

{
  "payments": [
    { "id": "2d9b6e14a7c3f0851e4b9a6c", "order_id": "ORD-1003", "status": "pending", "…": "…" },
    { "id": "c41e7a9d2b05f3e8a6d17c90", "order_id": "ORD-1002", "status": "pending", "…": "…" }
  ],
  "total": 3,
  "limit": 2,
  "offset": 0
}

To page through everything, repeat with offset increased by limit until offset reaches total. An unknown status, token or chain simply matches nothing ("payments": []).

List tokens

GET /v1/tokens · API key · SDKs: tokens.list()

The coins your customers can pay with in the key's mode: the tokens you accept (accepted tokens), each with its network fee and minimum right now. Use it to show the coins before you create a payment, then create the payment with the customer's choice as its token.

curl -s https://api.payitgo.co/v1/tokens -H "Authorization: Bearer $PAYITGO_KEY"

200 OK (test mode, shortened to four of the twelve tokens):

{
  "tokens": [
    { "token": "USDT_TRC20", "chain": "tron", "min_usd": "6.44", "network_fee_usd": "3.22", "fee_note": "Final in about a minute." },
    { "token": "TRX", "chain": "tron", "min_usd": "1", "network_fee_usd": "0", "fee_note": "Final in about a minute." },
    { "token": "USDT_BEP20", "chain": "bsc", "min_usd": "1", "network_fee_usd": "0.01", "fee_note": "Final in under a minute." },
    { "token": "XRP", "chain": "xrp", "min_usd": "1", "network_fee_usd": "0.01", "fee_note": "Final in seconds. Include the destination tag: it is required." }
  ]
}

With an amount, and the fees passed on to the customer, each token says what the customer pays in it:

curl -s 'https://api.payitgo.co/v1/tokens?amount_usd=40' -H "Authorization: Bearer $PAYITGO_KEY"

{
  "tokens": [
    { "token": "USDT_TRC20", "chain": "tron", "min_usd": "6.44", "network_fee_usd": "3.22", "amount_due_usd": "43.66", "fee_note": "Final in about a minute." },
    { "token": "USDT_BEP20", "chain": "bsc", "min_usd": "1", "network_fee_usd": "0.01", "amount_due_usd": "40.42", "fee_note": "Final in under a minute." }
  ]
}

The TokenInfo object

Fees and minimums are quoted for where a payment in the coin will really settle: with direct settlement and a payout address for the coin (in use, or still in its 24 hours: the payment then waits for it), two transfers (to you, and payitgo's fee); with none for the coin, the conversion into one of your payout coins as well (coins you have no payout address for); in your balance, one transfer, and for any coin but USDT on Tron the 1.5% conversion fee. GET /v1/tokens, the minimum checked by POST /v1/payments and a payment's token_options always agree. See Fees and settlement.

When the customer pays the wrong amount

Too little (say 30 of 49.90 USDT). The payment becomes partially_paid and the checkout page asks for the rest. If the rest arrives before expires_at, the payment goes on to detecting and confirmed. If not, it becomes underpaid at the deadline: the 30 USDT are still settled to you (less the fees) once final, so you can refund the customer or agree on the rest. Nothing is left on the deposit address.

A little too little. A payment counts as paid when the shortfall is within your underpayment tolerance: 0.5% by default, so a wallet that rounds or takes a tiny fee does not leave the customer stuck. Owners can set it from 0 to 20% (PATCH /merchant/settings {"underpaid_tolerance_bps": 100} for 1%). A payment keeps the tolerance in force when it was created.

Too much (say 900 of 100 USDT). The payment confirms with "overpaid": true (set when more than 1% too much arrived), and all of it is settled to you. Refund the difference if you wish: the sender's address is in the deposit's from.

Twice, or late. See late payments.

When the customer pays with the wrong asset

A payment's address can only receive coins of its own network: a wallet will not send Bitcoin to a Tron address. The mistakes that do happen are on the same network, and payitgo catches them:

• another token on the same chain, such as USDC or ETH sent to a USDT (ERC-20) payment, or TRX to a USDT (TRC-20) one;
• the other EVM chain: a payment's address is the same on Ethereum and BNB Smart Chain, so USDT sent on BSC to an Ethereum payment's address is found too.

Each such deposit raises payment.wrong_asset. What happens next depends on the accept other assets setting (PATCH /merchant/settings {"accept_other_assets": true}, owner only):

Either way the money is yours to keep or refund. It is settled like any payment in the coin that arrived: with direct settlement, to your payout address for that coin, or converted into one of your payout coins when you have none for it (coins you have no payout address for).

Late payments

A payment's address is watched for 24 hours after it expires, falls short or confirms. A deposit in that time is marked "late": true, settled to you once final, and reported with payment.late_deposit. If it completes an expired or underpaid payment, the payment moves on to detecting and confirmed with "paid_late": true, at the rate locked at creation. A late deposit that is still not enough makes the payment underpaid. A deposit after a payment confirmed (a customer paying twice) marks it overpaid.

XRP

XRP payments share one deposit address and are told apart by destination_tag. The customer must include the tag: a transfer without it cannot be matched to the payment and needs payitgo's support to recover. The hosted checkout shows the tag next to the address; qr_payload does not carry it, so the customer types it in.

Without a library

The libraries wrap these calls. In plain code:

Node.js

const res = await fetch("https://api.payitgo.co/v1/payments", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.PAYITGO_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ order_id: "ORD-1001", amount_usd: "49.90", token: "USDT_TRC20" }),
});
const body = await res.json();
if (!res.ok) throw new Error(`payitgo ${res.status}: ${body.error}`);
// res.status is 201 (created) or 200 (the order's open payment)
const payment = body; // redirect the customer to payment.checkout_url

Python

import os, requests

r = requests.post(
    "https://api.payitgo.co/v1/payments",
    headers={"Authorization": f"Bearer {os.environ['PAYITGO_KEY']}"},
    json={"order_id": "ORD-1001", "amount_usd": "49.90", "token": "USDT_TRC20"},
    timeout=30,
)
if r.status_code >= 400:
    raise RuntimeError(f"payitgo {r.status_code}: {r.json()['error']}")
payment = r.json()

PHP

$ch = curl_init('https://api.payitgo.co/v1/payments');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('PAYITGO_KEY'),
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'order_id' => 'ORD-1001', 'amount_usd' => '49.90', 'token' => 'USDT_TRC20',
    ]),
]);
$body = json_decode(curl_exec($ch), true);
if (curl_getinfo($ch, CURLINFO_HTTP_CODE) >= 400) {
    throw new RuntimeException('payitgo: ' . $body['error']);
}
$payment = $body;

Go

body, _ := json.Marshal(map[string]any{"order_id": "ORD-1001", "amount_usd": "49.90", "token": "USDT_TRC20"})
req, _ := http.NewRequest(http.MethodPost, "https://api.payitgo.co/v1/payments", bytes.NewReader(body))
req.Header.Set("Authorization", "Bearer "+os.Getenv("PAYITGO_KEY"))
req.Header.Set("Content-Type", "application/json")
resp, err := http.DefaultClient.Do(req)
if err != nil {
	return err
}
defer resp.Body.Close()
var payment map[string]any
json.NewDecoder(resp.Body).Decode(&payment)
if resp.StatusCode >= 400 {
	return fmt.Errorf("payitgo %d: %v", resp.StatusCode, payment["error"])
}