How do I authenticate?
With OAuth 2.0 client credentials. Create a Client ID and Client Secret in the dashboard under Developers, API Credentials, exchange them for an access token at https://sso.omno.com/realms/omno/protocol/openid-connect/token, and send it on every request:
Authorization: Bearer <access_token>
All requests go to https://api.omno.com. See Getting started for the full token request.
Which endpoints are available?
| Area | Endpoint | Purpose |
|---|---|---|
| Customers | POST /public/customer | Create or update a customer and their KYC data |
| Hosted checkout | POST /public/cashier/session | Create a hosted checkout session |
| Pay-in | POST /public/payin | Create a pay-in |
| Pay-in, Direct Link | POST /public/payin/{id}/process/direct-link | Process a Direct Link pay-in and get the redirect URL |
| Transaction info | GET /public/payin/{id} | Status and details of a pay-in |
| Transaction info | GET /public/payout/{id} | Status and details of a payout |
| Pay-out | Payout endpoints | Create and process pay-outs |
| Payout approval | Confirm or Reject Payout | Approve or reject payouts waiting for manual confirmation |
| Providers | PSP endpoint | Read the providers enabled for your merchant account |
Which statuses can a transaction have?
| Status | Meaning |
|---|---|
SUCCESS | Completed successfully |
PENDING, PENDING_3DS | Waiting; the final status follows by webhook |
DECLINED | Declined by the provider |
FAILED | Processing failed before or at the provider |
TIMEOUT | No final answer from the provider in time |
WAITING_FOR_CONFIRMATION | Payout waiting for your manual confirmation |
Statuses can arrive out of order. Never overwrite a final status with an earlier one; see Webhooks.
Which fields shape routing?
customer.customerGroups, customer.kyc.kycLevels, kycVerified and previousTransactionCount on hosted checkout session, pay-in and payout requests, plus at most one of routerId or directRouteId. The routing and PSP eligibility guide explains each one.
How do I keep my integration safe?
Keep credentials and tokens on your backend, treat the checkout token as opaque and never log it, take final statuses only from webhooks or the transaction endpoints, and ignore transactions from fake providers in your balance logic.