Skip to navigation
API ReferenceCheckout

Create ACH Authorization

Creates an ACH authorization record before the payment it will back. Callable either as the authenticated customer (SDK/iframe flow — the customer is resolved from the session, customerId in the body is ignored) or as merchant-admin/admin (direct-API integrators — the body’s customerId is required and reconciled server-side). Pass the returned record’s _id as achAuthorizationId on the ACH checkout call this authorization backs.

Authentication

x-coinflow-auth-session-keystring
OR
OR
Authorizationstring
API Key authentication via header

Request

This endpoint expects an object.
renderedAuthorizationTextstringRequired
Exact disclosure text shown to the end user at consent time.
consentTimestampdatetimeRequired
sessionAuthRefstringRequired

Reference/ID for the customer's authenticated session at consent time.

idempotencyKeystringRequired

A key unique to this intended checkout (a UUID you generate is fine). Passing the same key on a retried call returns the original authorization instead of creating a duplicate.

tokenstringRequired
Purse token for the bank account being authorized.
customerIdstringOptional

Required when authenticating as merchant-admin/admin (no customer session to resolve one from); ignored for customer session-key calls, where the customer is resolved from the session instead.

Response

Ok
createdAtdatetime
revokedboolean
Once true, no further payments may use this authorization.
statusHistorylist of objects
accountLastFourstring
routingNumberstring
renderedAuthorizationTextstring
consentTimestampdatetime
sessionAuthRefstring
merchantstring
customerIdstring
idempotencyKeystring
Guarantees at most one authorization per intended checkout even if the create call is retried.
_idstring
revokedAtdatetimeOptional
statusenumOptional
Allowed values:
paymentIdstringOptional

The founding ACH payment's external paymentId, linked in once that payment is created. Unset until then — the authorization itself must exist before its founding payment does. achAuthorizationId on checkout/subsequent-debit calls always refers to this record's own _id, not this field.