---
title: "Create ACH Authorization"
method: POST
path: "/checkout/ach-authorization"
tags: ["checkout"]
---

# Create ACH Authorization

`POST /checkout/ach-authorization`

Creates an ACH authorization record *before* the payment it will back.
Callable either as the authenticated customer (SDK/iframe flow — the
customer is resolved from the session, `customerId` in the body is
ignored) or as merchant-admin/admin (direct-API integrators — the
body's `customerId` is required and reconciled server-side). Pass the
returned record's `_id` as `achAuthorizationId` on the ACH checkout
call this authorization backs.

## Headers

- `x-coinflow-auth-session-key` string, required

## Request body

- CreateAchAuthorizationRequest — Creates an ACH authorization record *before* the payment it will back — `achCheckout` requires a valid authorization id when the merchant's `achSettings.allowedOrderTypes` is configured. See `AchAuthorizationService.createAuthorization`.
  - `renderedAuthorizationText` string, required — Exact disclosure text shown to the end user at consent time.
  - `consentTimestamp` string, date-time, required
  - `sessionAuthRef` string, required — Reference/ID for the customer's authenticated session at consent time.
  - `idempotencyKey` string, required — A key unique to this intended checkout (a UUID you generate is fine). Passing the same key on a retried call returns the original authorization instead of creating a duplicate.
  - `customerId` string — Required when authenticating as merchant-admin/admin (no customer session to resolve one from); ignored for customer session-key calls, where the customer is resolved from the session instead.
  - `token` string, required — Purse token for the bank account being authorized.

## Response `200`

Ok

- IAchAuthorizationString — Discriminated union keyed by `orderType`, matching the payload shape Tradepost sends on authorization submission (GitHub issue #17898).
  - `createdAt` string, date-time, required
  - `revokedAt` string, date-time
  - `revoked` boolean, required — Once true, no further payments may use this authorization.
  - `statusHistory` AuthorizationStatusEvent[], required
    - `eventType` 'archived' | 'reopened' | 'deadline_passed_no_shipment' | 'fully_filled', required
    - `occurredAt` string, date-time, required — When the status actually changed, as reported by the merchant.
    - `recordedAt` string, date-time, required — When Coinflow recorded this event.
  - `status` 'archived' | 'reopened' | 'deadline_passed_no_shipment' | 'fully_filled'
  - `accountLastFour` string, required
  - `routingNumber` string, required
  - `renderedAuthorizationText` string, required
  - `consentTimestamp` string, date-time, required
  - `sessionAuthRef` string, required
  - `merchant` string, required
  - `customerId` string, required
  - `idempotencyKey` string, required — Guarantees at most one authorization per intended checkout even if the create call is retried.
  - `paymentId` string — The founding ACH payment's external `paymentId`, linked in once that payment is created. Unset until then — the authorization itself must exist before its founding payment does. `achAuthorizationId` on checkout/subsequent-debit calls always refers to this record's own `_id`, not this field.
  - `_id` string, required

## Changes

> 22 revisions in range; 6 could not be searched.

- **2026-08-19** `f3178e82abab` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/coinflow/apis/api-reference/changes/checkout/ach-authorization/post.md)

---

[API](https://skmtc.dev/coinflow/apis/api-reference.md) · [All operations](https://skmtc.dev/coinflow/apis/api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/coinflow/api-reference/revisions/430f04d8d2a9/schema)