Create ACH Authorization

POST

https://api-sandbox.coinflow.cash/api/checkout/ach-authorization

POST

/api/checkout/ach-authorization

$ curl -X POST https://api-sandbox.coinflow.cash/api/checkout/ach-authorization \
>      -H "x-coinflow-auth-session-key: <apiKey>" \
>      -H "Content-Type: application/json" \
>      -d '{
>   "renderedAuthorizationText": "string",
>   "consentTimestamp": "2024-01-15T09:30:00Z",
>   "sessionAuthRef": "string",
>   "idempotencyKey": "string",
>   "token": "string",
>   "orderType": "one_time_purchase",
>   "structuredTerms": {}
> }'

200Successful

1 {
2   "createdAt": "2024-01-15T09:30:00Z",
3   "revoked": true,
4   "statusHistory": [
5     {
6       "eventType": "archived",
7       "occurredAt": "2024-01-15T09:30:00Z",
8       "recordedAt": "2024-01-15T09:30:00Z"
9     }
10   ],
11   "accountLastFour": "string",
12   "routingNumber": "string",
13   "renderedAuthorizationText": "string",
14   "consentTimestamp": "2024-01-15T09:30:00Z",
15   "sessionAuthRef": "string",
16   "merchant": "string",
17   "customerId": "string",
18   "idempotencyKey": "string",
19   "_id": "string",
20   "revokedAt": "2024-01-15T09:30:00Z",
21   "status": "archived",
22   "paymentId": "string",
23   "orderType": "one_time_purchase",
24   "structuredTerms": {}
25 }

Creates an ACH authorization record before the payment it will back. Callable either as the authenticated customer (SDK/iframe flow — the customer is resolved from the session, customerId in the body is ignored) or as merchant-admin/admin (direct-API integrators — the body’s customerId is required and reconciled server-side). Pass the returned record’s _id as achAuthorizationId on the ACH checkout call this authorization backs.

Creates an ACH authorization record *before* the payment it will back. Callable either as the authenticated customer (SDK/iframe flow — the customer is resolved from the session, `customerId` in the body is ignored) or as merchant-admin/admin (direct-API integrators — the body's `customerId` is required and reconciled server-side). Pass the returned record's `_id` as `achAuthorizationId` on the ACH checkout call this authorization backs.

Authentication

x-coinflow-auth-session-keystring

The session key generated for the end user - see https://docs.coinflow.cash/api-reference/api-reference/authentication/get-session-key

Authorizationstring

The API key of the merchant - see https://docs.coinflow.cash/api-reference/api-reference/authentication/get-session-key

Authorizationstring

API Key authentication via header

Request

This endpoint expects an object.

renderedAuthorizationTextstringRequired

Exact disclosure text shown to the end user at consent time.

consentTimestampdatetimeRequired

sessionAuthRefstringRequired

Reference/ID for the customer’s authenticated session at consent time.

idempotencyKeystringRequired

A key unique to this intended checkout (a UUID you generate is fine). Passing the same key on a retried call returns the original authorization instead of creating a duplicate.

tokenstringRequired

Purse token for the bank account being authorized.

customerIdstringOptional

Required when authenticating as merchant-admin/admin (no customer session to resolve one from); ignored for customer session-key calls, where the customer is resolved from the session instead.

Response

createdAtdatetime

revokedboolean

Once true, no further payments may use this authorization.

statusHistorylist of objects

accountLastFourstring

routingNumberstring

renderedAuthorizationTextstring

consentTimestampdatetime

sessionAuthRefstring

merchantstring

customerIdstring

idempotencyKeystring

Guarantees at most one authorization per intended checkout even if the create call is retried.

_idstring

revokedAtdatetimeOptional

statusenumOptional

paymentIdstringOptional

The founding ACH payment’s external paymentId, linked in once that payment is created. Unset until then — the authorization itself must exist before its founding payment does. achAuthorizationId on checkout/subsequent-debit calls always refers to this record’s own _id, not this field.