Cards, Apple Pay and Google Pay, plus SBP, SberPay, T-Pay and YooMoney for payments in RUB. Take payments in AZN, USD, EUR or RUB on the MAXFI payment page or in the MAXFI Widget on your site, and handle refunds and webhooks through the same API.
curl https://maxfi-api.exezine.az/v2/payments/checkout \ -H "Authorization: Bearer sk_test_…" \ -H "Content-Type: application/json" \ -d '{ "amount": 4900, "currency": "USD", "description": "Pro plan (annual)", "order_id": "order_2842", "success_url": "https://yourapp.com/success", "cancel_url": "https://yourapp.com/pricing", "webhook_url": "https://yourapp.com/maxfi" }'
{
"id": "cs_7c1e9a4f2b6d4e8a9f0b3c5d7e1a2b4c",
"checkout_url": "https://maxfi-api.exezine.az/checkout/cs_7c1e9a4f2b6d4e8a9f0b3c5d7e1a2b4c",
"expires_at": "2026-11-13T10:30:00.000Z",
"amount": 4900,
"currency": "USD",
"status": "open",
"livemode": false
}One integration covers the whole payment: create it, learn the result from a webhook, refund it if needed.
Create a session with POST /v2/payments/checkout and send the customer to checkout_url, or open the same page over your site with the MAXFI Widget.
Customers enter card details on the MAXFI payment page, so card data never reaches your servers. MAXFI is being assessed against PCI DSS 4.0.1 as a service provider; the assessment is not yet complete.
MAXFI notifies your server when a payment needs 3-D Secure, succeeds, fails, is refunded or expires. Requests are signed with HMAC-SHA256 when a webhook secret is set; up to 8 delivery attempts.
Send an Idempotency-Key header with POST /v2/payments, POST /v2/payments/checkout, /capture, /void, /refund and POST /v2/payouts. A repeat of the same request with the same key gets the saved response for 24 hours and is not executed again; the same key with a different request is rejected.
Refund a payment in full or in part with POST /v2/payments/{id}/refund. Capture an authorization with /capture or cancel it with /void.
MAXFI is operated by M.A.X SİSTEMLƏRİ PLYUS LLC (Max Systems), a payment institution licensed by the Central Bank of the Republic of Azerbaijan. The platform runs in AzInTelecom data centres in Azerbaijan.
MAXFI sends these events to your webhook URL:
payment.requires_actionpayment.succeededpayment.failedpayment.refundedpayment.expiredpayout.processingpayout.succeededpayout.failedpayout.canceledpayout.expiredpayout.reversedX-MAXFI-Signature: sha256=<hex> — HMAC-SHA256 of the raw request body, sent when a webhook secret is set. Reject requests where it does not match.X-MAXFI-Event-Id — the same on every attempt: use it to process each event once.X-MAXFI-Attempt — attempt number, from 1 to 8.webhook_url — set it when you create a checkout session to send that session’s payment status events (requires_action, succeeded, failed) to another URL; payment.refunded and payment.expired always go to the account URL.import crypto from "node:crypto"; export default function handler(req, res) { // req.rawBody: the request body exactly as it was received // X-MAXFI-Signature: sha256=<hex> const received = Buffer.from(req.headers["x-maxfi-signature"] || ""); const expected = Buffer.from("sha256=" + crypto .createHmac("sha256", process.env.MAXFI_WEBHOOK_SECRET) .update(req.rawBody) .digest("hex")); const valid = received.length === expected.length && crypto.timingSafeEqual(received, expected); if (!valid) return res.status(401).end(); const event = JSON.parse(req.rawBody); if (event.type === "payment.succeeded") { fulfillOrder(event.data.payment_id, event.data.amount); } res.status(200).end(); // answer 2xx within 10 s, otherwise MAXFI retries }
Requests made with an sk_test_ key go to the MAXFI test environment and never reach a bank. Test responses contain "livemode": false, and a test key cannot see or change live payments.
Live keys start working after MAXFI enables live mode for your account, once onboarding is complete.
Customers choose how to pay on the MAXFI payment page. It shows the methods enabled for your account; SBP, SberPay, T-Pay and YooMoney are for payments in RUB.
Apply for access. After onboarding you create API keys in the merchant portal. Start with an sk_test_ key; live keys work once MAXFI enables live mode for your account.