> ## Documentation Index
> Fetch the complete documentation index at: https://developer.gcashier.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Cross-Border Payment API for SMEs

> Gcashier Pay is a cross-border payment API platform built for SMEs. This documentation covers integration, encryption, authentication, and all available APIs.

Gcashier Pay is a cross-border payment API platform designed specifically for small and medium-sized enterprises that need to collect, convert, and move money across borders. Every API call travels over HTTPS 1.2 and JSON, and every message is protected by a layered encryption scheme — AES for payload confidentiality, RSA for session-key exchange, and SHA1withRSA for request signing — so your transaction data stays secure end to end. Whether you are integrating collection flows, executing foreign-exchange trades, or reconciling payouts, this documentation gives you everything you need to go from zero to a working integration.

<CardGroup cols={2}>
  <Card title="Collection" icon="circle-dollar-to-slot">
    Accept payments from international customers through hosted and API-driven collection flows, with real-time status callbacks delivered to your server.
  </Card>

  <Card title="Foreign Exchange" icon="arrow-right-arrow-left">
    Execute FX conversions at competitive rates directly through the API. Lock in a rate, confirm the trade, and track settlement status in one workflow.
  </Card>

  <Card title="International Remittance" icon="paper-plane">
    Send funds to beneficiaries worldwide. Submit beneficiary details, confirm debit amounts, and receive arrival confirmations — all programmatically.
  </Card>

  <Card title="Payouts" icon="money-bill-transfer">
    Disburse funds to bank accounts in supported corridors. The withdrawal API handles routing details and returns status updates as the payment progresses.
  </Card>

  <Card title="E-Commerce Collection" icon="cart-shopping">
    Integrate checkout-ready collection links and callbacks into your e-commerce storefront for a seamless buyer experience.
  </Card>

  <Card title="Accounting & Reconciliation" icon="file-invoice-dollar">
    Query balances, retrieve transaction histories, and associate flow orders to keep your books in sync with every API-driven movement.
  </Card>
</CardGroup>

## How the API works

Every request you send and every response you receive follows the same encrypted envelope pattern. You build a JSON payload, sign it with your RSA private key, encrypt it with a freshly generated AES session key, wrap that session key with Gcashier Pay's RSA public key, and POST all four fields — `merchantNo`, `jsonEnc`, `keyEnc`, and `sign` — to the appropriate endpoint. Gcashier Pay verifies the signature with your public key, decrypts the session key with its own private key, and decrypts the payload. Responses arrive in the same envelope structure so you reverse the process on your end.

This dual-key design means neither party ever transmits a long-lived secret in the clear. AES keys are ephemeral — one per request — and RSA key pairs are held exclusively by their respective owners.

<Note>
  All API communication must use **HTTPS 1.2**. Plain HTTP connections are rejected. All text encoding is **UTF-8** and the `Content-Type` header must be `application/json`.
</Note>

## Request and response structure

Every JSON payload — before encryption — shares a common envelope:

```json theme={null}
{
  "head": {
    "version": "1.0.0",
    "tradeType": "00",
    "tradeTime": "1551341750",
    "tradeCode": "sp1301",
    "language": "cn"
  },
  "body": {}
}
```

`tradeType` is `"00"` in requests and `"01"` in responses. Successful responses carry `respCode: "S00000"` in the head. Every other field in the body is specific to the API operation you are calling.

## Changelog

| Version | Date       | Summary                  |
| ------- | ---------- | ------------------------ |
| 1.0.4   | 2025-01-23 | Payment API updates      |
| 1.0.3   | 2024-12-13 | Contact maintenance APIs |
| 1.0.2   | 2024-10-24 | Merchant access fields   |
| 1.0.1   | 2024-09-01 | E-commerce collection    |
| 1.0.0   | 2024-07-30 | Initial release          |

## Next steps

Ready to make your first API call? The Quickstart walks you through generating your RSA key pair, exchanging public keys with Gcashier Pay, and sending your first encrypted request in under 30 minutes.

<Card title="Quickstart →" icon="rocket" href="/quickstart">
  Generate your keys, download the demo SDK, and send your first encrypted request.
</Card>