--- title: "Create a delegated payment token" method: POST path: "/agentic_commerce/delegate_payment" tags: ["Agentic Commerce Protocol"] --- # Create a delegated payment token `POST /agentic_commerce/delegate_payment` ## Request - Base URL: `https://{prefix}.api.sandbox.checkout.com` - URL: `https://{prefix}.api.sandbox.checkout.com/agentic_commerce/delegate_payment` - Auth: API key in header `Authorization` - TypeScript: (a function with typed inputs; its response is checked against the schema) Creates a delegated payment token to securely enable Checkout.com merchants to process agentic payments. The token secures cardholder credentials for use in agentic commerce transactions. You must provide: - The card details - The spending constraints (allowance) - The Billing address - The risk signals The request must include a valid HMAC-SHA256 signature in the `Signature` header and a timestamp in the `Timestamp` header to verify the request integrity. ## Headers - `Signature` string, required - `Timestamp` string, date-time, required - `Cko-Idempotency-Key` string - `API-Version` string ## Request body - DelegatedPaymentRequest: Beta

The request body for creating a delegated payment token. - `payment_method` DelegatedPaymentMethodCard, required: The card details for a delegated payment. - `type` 'card', required: The payment method type. - `card_number_type` 'fpan' | 'network_token', required: The type of card number provided. - `fpan` – a Funding Primary Account Number. The card number printed on the card. - `network_token` – a provisioned network token that represents the underlying card. - `number` string, required: The full card number. - `exp_month` string: The card expiry month, in two-digit format (MM). - `exp_year` string: The card expiry year, in four-digit format (YYYY). - `name` string: The name of the cardholder as it appears on the card. - `cvc` string: The card verification code (CVC/CVV). - `cryptogram` string: The cryptogram associated with a network token transaction. Required when `card_number_type` is `network_token`. - `eci_value` string: The Electronic Commerce Indicator (ECI) or Security Level Indicator (SLI) value for network token transactions. - `checks_performed` string[]: A list of verification checks that have been performed on the card. - `iin` string: The Issuer Identification Number (IIN), also known as the Bank Identification Number (BIN). This is typically the first 6 digits of the card number. - `display_card_funding_type` 'credit' | 'debit' | 'prepaid': The funding type of the card, used for display purposes. - `display_wallet_type` string: The wallet type associated with the card, used for display purposes (for example, Apple Pay or Google Pay). - `display_brand` string: The card brand, used for display purposes (for example, Visa, Mastercard). - `display_last4` string: The last four digits of the card number, used for display purposes. - `metadata` object, required: A set of key-value pairs containing additional payment method metadata. - `allowance` DelegatedPaymentAllowance, required: The spending constraints that define what the delegated payment token is authorized for. - `reason` 'one_time', required: The reason for the allowance. - `max_amount` integer, required: The maximum amount that can be charged using the delegated payment token. Provide the amount in the minor currency unit. - `currency` string, required: The three-letter ISO 4217 currency code. - `merchant_id` string, required: The unique identifier of the merchant that will process the payment. - `checkout_session_id` string, required: The identifier of the checkout session associated with this delegated payment. - `expires_at` string, date-time, required: The expiry time of the delegated payment token, in RFC 3339 format. Must be a time in the future. - `billing_address` DelegatedPaymentBillingAddress: The customer billing address associated with the delegated payment. - `name` string, required: The full name of the customer. - `line_one` string, required: The first line of the street address. - `line_two` string: The second line of the street address. - `city` string, required: The city of the billing address. - `state` string: The state, county, province, or region of the billing address. - `postal_code` string, required: The postal code or ZIP code of the billing address. - `country` string, required: The two-letter ISO 3166-1 alpha-2 country code. - `risk_signals` DelegatedPaymentRiskSignal[], required: An array of risk assessment signals provided by the platform. - `type` string, required: The type of risk signal. - `score` integer, required: The risk score associated with this signal. - `action` string, required: The action taken based on the risk assessment. - `metadata` object, required: A set of key-value pairs to attach to the delegated payment request. The `metadata` object only supports string values. ## Response `201` Delegated payment token created successfully - DelegatedPaymentResponse: The response returned when a delegated payment token is successfully created. - `id` string, required: The unique identifier of the provisioned payment token. - `created` string, date-time, required: The date and time the token was created, in RFC 3339 format. - `metadata` object, required: A set of key-value pairs containing response metadata. ## Other responses - `400`: Malformed JSON or unreadable request body - `401`: Missing or invalid API key, or signature validation failure - `403`: Merchant not enabled for the authenticated platform - `409`: Idempotency key reused with a different request body - `422`: Unprocessable entity. One or more fields failed validation - `500`: An unexpected error occurred while processing the request --- [API](https://skmtc.dev/checkout/apis/checkout-com-api-reference.md) - [All operations](https://skmtc.dev/checkout/apis/checkout-com-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/checkout/apis/checkout-com-api-reference/revisions/0f1abdb1c3e9?raw)