SDK Overview

The DEEPayment SDK is the supported way to call the Merchant API. It exists in five languages that share one wire protocol and one set of conformance test vectors, so the same request produces the same bytes on the wire whichever language you use.

The SDK signs every request with your Ed25519 key (RFC 9421), seals every POST body to the platform X25519 key, verifies platform webhook signatures, and checks the request shape locally before it leaves your process. You never build Signature-Input, Content-Digest or the sealed box envelope by hand. See Authentication for the protocol it implements.

Languages

Language	Package	Package page	Source	Requirements	Runtime dependency
Go	github.com/deepayment/sdk-go	pkg.go.dev	sdk-go	Go 1.24+	golang.org/x/crypto
JavaScript	@support-deepayment/sdk	npm	sdk-js	Node.js 18+	libsodium-wrappers
Python	deepayment	PyPI	sdk-python	Python 3.10+	pynacl
PHP	deepayment/sdk	Packagist	sdk-php	PHP 8.2+ with sodium, json, curl	none
Java	com.deepayment:sdk	Maven Central	sdk-java	JDK 17+	BouncyCastle, Jackson

Every package is open source, one GitHub repository per language under the same organization. The repositories are generated from a single source tree on each release; do not send pull requests to them, report issues to DEEPayment support instead.

Install

Go

go get github.com/deepayment/[email protected]

import deepayment "github.com/deepayment/sdk-go"

Pin a release tag; the package page lists them.

JavaScript

npm install @support-deepayment/sdk

import { Client } from '@support-deepayment/sdk';

ES module.

Python

pip install deepayment

from deepayment import Client

PHP

composer require deepayment/sdk

use Deepayment\Sdk\Client;

Namespace Deepayment\Sdk.

Java

<dependency>
  <groupId>com.deepayment</groupId>
  <artifactId>sdk</artifactId>
  <version>0.1.0</version>
</dependency>

import com.deepayment.sdk.Client;

Package com.deepayment.sdk. Use the latest version listed on the package page.

AI coding assistant skill

An agent skill packages the signing scheme, the per-currency method codes with their required fields, the endpoint list and the money-safety rules for Claude Code, Cursor, Codex and other agents that read the skills format. Install it and ask the agent to write the integration for you:

npx skills add deepayment/skill

Source and manual install instructions: github.com/deepayment/skill. The skill is generated from the same source tree as the SDKs and is updated with them.

What the SDK does

• Signs and seals. Ed25519 request signature over a fixed RFC 9421 profile, RFC 9530 Content-Digest, X25519 sealed box for every signed POST body. Signed GET requests carry no body and sign the query string.
• Verifies webhooks. Digest, event id, freshness window, key selection by keyid, Ed25519 signature. See Webhooks.
• Validates before sending. Required top-level fields, amount format, webhookUrl scheme, method code and the extra fields the gateway requires for that currency. A request that fails these checks never leaves your process. See Orders.
• Classifies failures. Every error tells you whether the request was sent, so you can decide between "safe to mark failed" and "outcome unknown, query first". See Errors.

What the SDK does not do

• No automatic retry. A create call that times out is not resent. Query by merchantOrderNo or resend the identical request yourself; see Orders.
• No format validation. Phone lengths, e-mail syntax, document numbers and bank codes are validated by the gateway. The SDK checks presence, not format, so it cannot drift from the gateway.
• No enum enforcement. Currency, country and method constants are hints. An unknown value passes through and the gateway decides.
• No logging, no environment reads, no panics. The SDK never prints a request body and never reads configuration from the environment.

Versioning

The five packages are versioned independently and released only when their content changes. A protocol change that touches every language produces five releases; a fix in one language produces one. Each repository carries a CHANGELOG.md with the changes per version. The Go and Java install commands above already name a release; for JavaScript, Python and PHP, install the latest release and then lock it in your own dependency manifest (package-lock.json, requirements.txt or poetry.lock, composer.lock). Read the changelog before upgrading.

Amounts are strings

Every money value in requests, responses, webhooks, balances, rates and receipts is a decimal string such as "100.00". The SDK rejects a JSON number in amount before sending. Keep amounts as strings end to end; do not parse them into floating point.

Next

1. Configuration: the six credentials and the optional client settings.
2. Orders: create payments and payouts.
3. Queries: orders, balances, rates, receipts.
4. Webhooks: verify and parse platform callbacks.
5. Hosted checkout: the unsigned endpoints for your own checkout page.
6. Errors: what each error means and what to do.