> ## Documentation Index > Fetch the complete documentation index at: https://docs.hg.cash/llms.txt > Use this file to discover all available pages before exploring further. # Create checkout session > Creates a hosted checkout for AR (transfer + DNI match), BR (PIX QR), CL (provider iframe), or BO (QR payment). Returns `checkoutUrl` for the payer and optional provider fields (QR, iframe URL). ## OpenAPI ````yaml /api-reference/openapi.yaml post /checkouts openapi: 3.1.0 info: title: HG.Cash API description: > # ๐Ÿš€ HG.Cash Transaction API Modern REST API for users to create outbound transactions from their accounts. ## ๐Ÿงพ How it works - We assign accounts to your user in HG.Cash - When these accounts have transactions (inbound or outbound), HG.Cash will notify your backend using the webhook URL you configure in the HG.Cash dashboard - **Webhook signature (HMAC)**: In account settings you can generate a signing secret. When configured, each webhook POST includes the header `X-HG-Webhook-Signature: sha256=` where the value is HMAC-SHA256 of the raw JSON body using your secret. Verify this in your endpoint to ensure the request is authentic. - To create cash-outs (money leaving your accounts), you must call the **Cash Out** endpoint: **Create Transaction Request (Cash Out)** (`POST /transactions`) ## ๐Ÿ“Š Getting Started 1. **Generate your API token** in the account settings page 2. **Test endpoints** using the interactive documentation below 3. **Implement** in your backend services (never expose tokens in frontend) 4. **Monitor** your integration and handle errors appropriately ## ๐Ÿ” Authentication This API uses **Bearer Token** authentication. Include your user API token in the Authorization header, for example `Authorization: Bearer cash_your_token_here`. ## โš ๏ธ Important Security Notes - Never share or expose your user API authentication token - Store tokens securely on your backend servers only - All API calls must be made from secure backend services - Contact administrators immediately if your token is compromised version: 1.0.0 contact: name: HG.Cash API Support email: api-support@hg.cash license: name: MIT url: https://opensource.org/licenses/MIT servers: - url: https://hg.cash/api/v1 description: Production server - url: http://dev.hg.cash/api/v1 description: Development server security: - bearerAuth: [] tags: - name: Transactions description: >- Transaction Management - Create and manage transactions in the HG.Cash system. All transaction endpoints require authentication. - name: Accounts description: >- Accounts - Retrieve account information and balances for the authenticated user. All account endpoints require authentication. - name: Reference Data description: >- Reference Data - Get reference data like transaction statuses and types. These endpoints require authentication. - name: Webhooks description: Webhooks - Event notifications sent to your HTTP endpoint. - name: Brazil description: >- Transaction management - Create and manage transactions in Pix system for Brazil operations - name: Chile description: Hosted checkout and bank payouts for Chile (CLP) - name: Bolivia description: QR cash-in and ACH payouts for Bolivia (BOB) - name: Checkouts description: Hosted checkout sessions for AR, BR, CL, and BO paths: /checkouts: post: tags: - Checkouts summary: Create checkout session description: > Creates a hosted checkout for AR (transfer + DNI match), BR (PIX QR), CL (provider iframe), or BO (QR payment). Returns `checkoutUrl` for the payer and optional provider fields (QR, iframe URL). operationId: createCheckout requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/CreateCheckoutRequest' responses: '201': description: Created content: application/json: schema: $ref: '#/components/schemas/CreateCheckoutResponse' '400': description: Validation error '401': description: Unauthorized '403': $ref: '#/components/responses/AccountNotOperative' '500': description: Internal Server Error components: schemas: CreateCheckoutRequest: type: object required: - country - amount - successUrl properties: country: type: string enum: - AR - BR - CL - BO amount: type: string description: Decimal amount as string accountId: type: string format: uuid successUrl: type: string format: uri cancelUrl: type: string format: uri webhookUrl: type: string format: uri expiresInSeconds: type: integer idempotencyKey: type: string locale: type: string enum: - es - en metadata: type: object payer: type: object properties: name: type: string description: Payer full name (required for BR and BO) document: type: string description: AR 8-digit DNI; BR payer CPF/CNPJ; BO payer CI/document email: type: string format: email description: >- BR requires name, document, and email; BO requires name, document, and email paymentMethodId: type: string format: uuid description: Required for CL customer: type: object description: Required for CL (see ClInboundTransactionRequest customer fields) CreateCheckoutResponse: type: object properties: id: type: string format: uuid publicToken: type: string checkoutUrl: type: string format: uri status: type: string expiresAt: type: string format: date-time accountDisplay: type: object description: Present for AR (CVU, alias, holder) qrCode: type: string pixCopiaECola: type: string checkoutUrlProvider: type: string format: uri ErrorResponse: type: object description: Error payload returned by the API. additionalProperties: true required: - error properties: error: type: string example: Invalid request code: type: string description: Machine-readable error code (when available) example: INSUFFICIENT_NET_BALANCE message: type: string example: The provided data is invalid details: type: object description: Additional error details example: field: amount code: INVALID_VALUE responses: AccountNotOperative: description: >- Forbidden โ€” account is not operative (`Bloqueada` or `Cerrada`) or caller lacks access content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: account_not_operative: summary: Account is not operative value: error: Account is not operative code: ACCOUNT_NOT_OPERATIVE securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: > User API authentication token with format `cash_<64-char-hex>`. Sample value `cash_16cdc3b6f83c72d9d2680adca4f430962981f6bf32613a129dded0aa060387d2`. ````