---
title: "Buy a credit pack with a card (hosted checkout)."
method: POST
path: "/v1/checkout"
---

# Buy a credit pack with a card (hosted checkout).

`POST /v1/checkout`

## Request

- Base URL: `https://lazaretto.dev`
- URL: `https://lazaretto.dev/v1/checkout`
- Auth: none declared

For a person without a crypto wallet; agents pay over x402 instead. Body {"bundle":"starter"|"pro"|"scale"}, plus an optional `api_key` to top up an existing key (only its id reaches the payment provider). A JSON caller gets {url, session_id}: open `url` to pay on the hosted page. A form post is redirected there. Card details never reach Lazaretto. The API key is shown once on the confirmation page. The page for people is /buy.

## Response `200`

The hosted checkout URL and its session id.

## Other responses

- `303`: Form post: redirect to the hosted checkout.
- `400`: Unknown bundle, or an api_key that does not exist.
- `429`: Rate limited.
- `502`: The checkout could not be started. x402 and the free trial are unaffected.
- `503`: The key to top up could not be verified. Try again shortly.

---

[API](https://skmtc.dev/lazaretto/apis/lazaretto-skill-tool-verification-api.md) · [All operations](https://skmtc.dev/lazaretto/apis/lazaretto-skill-tool-verification-api/llms.txt) · [OpenAPI document](https://skmtc.dev/lazaretto/apis/lazaretto-skill-tool-verification-api/revisions/2bd4e34d0067?raw)