0Gate API

0Gate is the primary public integration path for hosted payment, ramp, and swap experiences. Partners create server-owned sessions, hand browser-safe values to the widget, verify webhook events, and reconcile final state from server records.

This page is the curated partner reference. It uses the OpenAPI contract as source material, but removes generated-tool noise and keeps the public boundary clear.

Contract snapshot

The API is product-scoped and partner-scoped. A credential only sees resources owned by the partner account and environment that issued it. Examples use fake ids, fake keys, fake domains, fake wallets, and fake users.

What this API covers

• Hosted session creation, retrieval, listing, and cancellation.
• Capability and eligibility reads before showing a flow.
• Indicative quote previews and account-gated locked quotes.
• Partner transaction reads for support and reconciliation.
• Customer records where the account is entitled to use the customer resource.
• Browser-safe embed bootstrap and approved co-branding controls.
• Webhook delivery diagnostics, replay, and test delivery.
• Account-gated pay-in and pay-out rail operations for approved partners.

Public boundary

This reference covers endpoint behavior, authentication, idempotency, webhook verification, request/response objects, status models, and support-safe record joins. It does not expose private operational credentials, payout-instruction details, treasury balances, internal route logic, reserve allocation, operational worker names, or unsupported availability claims.

Authentication map

Operation map

Hosted session lifecycle

Store the session id, your own order id, the idempotency key, the client_secret delivery time, webhook event ids, request ids, and final transaction reference. Do not rely on a redirect URL alone.

Start with capabilities

Capability endpoints stop you from hard-coding promises that can change by account, region, asset, payment method, payout method, and compliance state.

If a capability disappears, your integration should hide or disable that option and show a retry-safe unavailable state. Do not convert a missing capability into an unsupported marketing claim.

Example: create a hosted session

curl -X POST https://gate-api-sandbox.0bit.app/v1/gate_sessions \
  -H "Authorization: Bearer sk_test_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 00000000-0000-4000-8000-000000000123" \
  -d '{
    "amount": "100.00",
    "currency": "EUR",
    "return_url": "https://partner.example/complete",
    "cancel_url": "https://partner.example/cancel",
    "flow": "on_ramp",
    "target_token": "USDC",
    "metadata": {
      "order_id": "order_test_123"
    }
  }'

const response = await fetch('https://gate-api-sandbox.0bit.app/v1/gate_sessions', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.OBIT_SECRET_KEY}`,
    'Content-Type': 'application/json',
    'Idempotency-Key': crypto.randomUUID(),
  },
  body: JSON.stringify({
    amount: '100.00',
    currency: 'EUR',
    return_url: 'https://partner.example/complete',
    cancel_url: 'https://partner.example/cancel',
    flow: 'on_ramp',
    target_token: 'USDC',
    metadata: { order_id: 'order_test_123' },
  }),
});

const session = await response.json();

import os
import uuid
import requests

response = requests.post(
    "https://gate-api-sandbox.0bit.app/v1/gate_sessions",
    headers={
        "Authorization": f"Bearer {os.environ['OBIT_SECRET_KEY']}",
        "Content-Type": "application/json",
        "Idempotency-Key": str(uuid.uuid4()),
    },
    json={
        "amount": "100.00",
        "currency": "EUR",
        "return_url": "https://partner.example/complete",
        "cancel_url": "https://partner.example/cancel",
        "flow": "on_ramp",
        "target_token": "USDC",
        "metadata": {"order_id": "order_test_123"},
    },
)

session = response.json()

The response includes a client_secret once. Hand it to the browser for widget bootstrap, but keep the session id and your own order id in your database.

Example: bootstrap the widget

const response = await fetch('https://gate-api-sandbox.0bit.app/v1/embed/bootstrap', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${publishableKey}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    clientSecret: sessionClientSecret,
  }),
});

const bootstrap = await response.json();

Only publishable keys belong in browser code. If bootstrap fails, do not fall back to a secret key in the client. Return to your server and create or recover the session.

Object model

Status and reconciliation joins

Webhook event families

Verify the raw body before parsing, reject stale timestamps, dedupe by event id, persist the state transition, and return 2xx only after durable handling.

Error and retry model

Every production integration should log the HTTP status, machine-readable error code, request id, endpoint, environment, idempotency key for writes, and your own order id.

Production checklist

• Product access and environment are approved.
• Secret keys are server-only.
• Publishable keys are client-only and cannot call protected routes.
• Webhook receiver verifies raw-body signatures.
• Writes use Idempotency-Key.
• Browser callbacks are not treated as settlement truth.
• Capability checks drive UI availability.
• Customer endpoints are used only where enabled.
• Rail endpoints are used only where enabled.
• Logs include request ids and your own correlation ids.
• Support tooling can retrieve sessions, transactions, webhook deliveries, and relevant internal order state without secrets.

Related pages