# OrionPay

> Brazilian payment platform for hospitals and digital products. PIX, credit/debit card,
> crypto wallets (Liquid Network: L-BTC/DePix/USDt, Bitcoin via peg-out, multi-chain via SideShift),
> outbound webhooks (HMAC-SHA256), and a Streamable HTTP MCP server.

OrionPay's API is authenticated with an X-API-Key header. Two key types exist:
**product API keys** (scoped to a product) and **personal API keys** (productId=null, full account access).
Generate keys at https://pay.orion.moe/dashboard/api-webhooks.

## Docs

- [API & Webhooks Reference](https://pay.orion.moe/docs): Human-readable docs with request/response examples.
- [Developer Portal](https://pay.orion.moe/desenvolvedores): Quickstart, SDKs, and use cases.
- [OpenAPI 3.1 Spec (JSON)](https://payapi.orion.moe/openapi.json): Machine-readable, every endpoint covered.
- [OpenAPI 3.1 Spec (YAML)](https://payapi.orion.moe/openapi.yaml): Same content, YAML.
- [llms-full.txt](https://pay.orion.moe/llms-full.txt): Full inlined endpoint reference for LLM context.
- [MCP Tool List](https://payapi.orion.moe/mcp-tools.json): Discoverable list of MCP tools and their inputs.

## MCP server

OrionPay ships a Streamable HTTP MCP server with 22 tools covering every user-facing endpoint.
Add it to Claude Code:

```
claude mcp add orionpay --transport http https://payapi.orion.moe/mcp --header "X-API-Key: $ORIONPAY_API_KEY"
```

Or via the local stdio bridge:

```
claude mcp add orionpay -- npx -y @orionpay/mcp
# (set ORIONPAY_API_KEY in your env)
```

Endpoint: https://payapi.orion.moe/mcp (POST JSON-RPC 2.0). Discovery: https://pay.orion.moe/.well-known/mcp.json.

## Endpoints

### PIX (BRL → DePix)
- POST https://payapi.orion.moe/api/v1/pix/generate — Generate PIX for product payment.
- POST https://payapi.orion.moe/api/v1/pix/personal — Generate PIX for personal deposit (personal API key).
- GET https://payapi.orion.moe/api/v1/pix/status/{id} — Check payment status by purchaseId/transactionId/eulenDepositId.

### Card
- POST https://payapi.orion.moe/api/v1/card/generate — Process credit/debit card payment.
- GET https://payapi.orion.moe/api/v1/card/status/{paymentId} — Check card payment status.

### Integration (product/buyer management)
- GET https://payapi.orion.moe/integration/verify-access — Check buyer access by email or accessToken.
- GET https://payapi.orion.moe/integration/buyers — List product buyers.
- GET https://payapi.orion.moe/integration/buyers/{purchaseId} — Get buyer details.
- GET https://payapi.orion.moe/integration/content — Get product content for an authenticated buyer.
- POST https://payapi.orion.moe/integration/grant-access — Manually grant access to a buyer.
- DELETE https://payapi.orion.moe/integration/revoke-access/{purchaseId} — Revoke buyer access.
- POST https://payapi.orion.moe/api/v1/integration/deposit/pix — Generate PIX deposit with payer CPF.

### Personal API (personal API key only, productId=null)
- GET https://payapi.orion.moe/api/v1/personal/balance — All wallet balances (BRL + crypto).
- GET https://payapi.orion.moe/api/v1/personal/limits — Withdrawal limits.
- GET https://payapi.orion.moe/api/v1/personal/transactions — Transaction history.
- POST https://payapi.orion.moe/api/v1/personal/withdraw/pix — Queue a PIX withdrawal.
- POST https://payapi.orion.moe/api/v1/personal/withdraw/crypto — Queue a crypto withdrawal (L-BTC/BTC-PEGOUT/DePix/USDt/USDC).
- GET https://payapi.orion.moe/api/v1/personal/withdraw/status/{id} — Withdrawal status.
- POST https://payapi.orion.moe/api/v1/personal/swap/quote — Get a swap quote.
- POST https://payapi.orion.moe/api/v1/personal/swap/execute — Execute a swap.
- GET https://payapi.orion.moe/api/v1/personal/withdraw-enabled — Are API withdrawals enabled?
- POST https://payapi.orion.moe/api/v1/personal/enable-withdrawals — Enable API withdrawals (7-day deposit hold).

### Webhooks (outbound, HMAC-SHA256 signed)
Events: payment.success, purchase.created, access.granted, payment.refunded_med,
med.created, webhook.test, withdrawal.completed, withdrawal.settled, withdrawal.failed,
swap.completed, swap.failed.

Headers: X-OrionPay-Signature: sha256=<hex>, X-OrionPay-Event, X-OrionPay-Delivery.
Verify with HMAC-SHA256 of raw body using the webhook secret from the dashboard.

## Optional

- [Status](https://pay.orion.moe/status)
- [Compliance](https://pay.orion.moe/compliance)
- [Pricing](https://pay.orion.moe/planos)
- [Terms](https://pay.orion.moe/termos)
- [Privacy](https://pay.orion.moe/privacidade)