Cashwo API · v1

Take PayTo payments from your own system

Create PayTo agreements, send your customer a secure link to authorise them with their bank, collect payments on schedule, and get a signed webhook the moment money arrives.

How it works

Cashwo collects payments through PayTo, Australia's real-time payments service. Your customer authorises an agreement once in their own banking app. Cashwo then collects the payments that agreement allows: on a schedule, when you ask, or once.

1 · Your server

Create agreement

POST the customer, amount and schedule. Cashwo returns a payment link.

2 · Your customer

Open the link

They verify a one-time code sent to their email or mobile.

3 · Their bank

Authorise PayTo

They approve the agreement in their banking app. It becomes ACTIVE.

4 · Cashwo

Collect & notify

Payments are debited when due, and your webhook hears about each one.

Quickstart

Ask Cashwo for sandbox access. You'll get a sandbox merchant account and its API endpoint.
Sign in to the sandbox merchant portal and create an API key under Settings → API Credentials.
Create your first agreement:

cURL

curl -X POST "$CASHWO_API_URL" \
  -H "Authorization: Bearer $CASHWO_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: quickstart-001" \
  -d '{
    "action": "create_agreement",
    "payment_ref": "INV-10482",
    "merchant_reference": "CUST-2291",
    "customer_name": "Jane Citizen",
    "customer_email": "jane@example.com",
    "customer_phone": "0412345678",
    "frequency": "MONTHLY",
    "amount": 120.00
  }'

Open the url from the response, verify with the code you receive, and authorise with a test bank.
Set a webhook endpoint under Settings → Webhooks and watch agreement_activated and payment_settled arrive.

API basics

Environment	API endpoint	Merchant portal	Money moves?
Sandbox	Sent with your sandbox access	Sent with your sandbox access	No, test banks only
Production	`https://api.cashwo.com.au/`	`https://merchant.cashwo.com.au/`	Yes

Every request is an HTTPS POST to the endpoint with a JSON body. The action field names the operation.
Authenticate with Authorization: Bearer <API key>. Sandbox and production keys are separate.
Every response has success. Failures add error and a machine-readable error_code, with a matching HTTP status.
Amounts are Australian dollars with up to two decimals. Dates are YYYY-MM-DD; times are Australian Eastern time.

Explore the API

Authentication

API keys, request format and safe retries with Idempotency-Key.

Agreements

Create, read, list, cancel, suspend and resume PayTo agreements.

Payments

Read and list the payments collected under your agreements.

Webhooks

Signed events for agreements, payments and payouts, with retries.

Errors

Status codes and every error_code, with what to do.

Testing & go-live

Sandbox access, test scenarios and the go-live checklist.