Capture Public Pay Page Payment
POST/api/public/paypal/pay/:token/capture
Captures the PayPal order the buyer just approved (from Create Public Pay Page Checkout) and records the payment on the sales order or invoice. The pay page calls this from its onApprove callback. No request body.
This endpoint currently requires session authentication; Personal Access Token scope support is in progress.
Called by the public pay page, not by an integrator. No bearer token: the pay link token in the URL is the only credential. The request must be sent to the seller's own workspace host (e.g. https://acme.sku.io), because the workspace is identified from the host; on any other host the response is 404 Payment page not found. (plain text). Limited to 60 requests per minute (20 per minute for checkout and capture). Returns 503 while the workspace is briefly under maintenance.
Response: status is the capture status (COMPLETED, or PENDING when PayPal holds the payment for review; a pending payment is finished later from PayPal's webhook) and capture_id is PayPal's capture id.
Errors (422): the checkout didn't finish, the link is no longer payable, the order no longer owes the amount, or PayPal declined the payment. When the buyer's card or bank was declined, retry_funding_source is true and the buyer can choose another way to pay in the same PayPal window (call capture again after they do). A declined capture is never reported as a success.
Authentication: none (pay link token in the URL).
Request
Responses
- 200
- 401
- 403
- 404
- 422
- 429
OK
Response Headers
Unauthenticated — the bearer token is missing, revoked, expired, or malformed. Never retry automatically; fix the credential. See the Errors guide.
Forbidden — the token lacks a required scope, the endpoint is not available to API tokens, or the user behind the token lacks the permission. A human must adjust the token scopes or user permissions; do not retry.
Not Found
Response Headers
Unprocessable Entity
Response Headers
Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.