Authorize Payment (Auth Only)
Authorize a PayDirect payment without capturing funds — hold funds with captureTxn false, then capture or reverse later.
Documentation Index
Fetch the complete documentation index at: https://payglocal.mintlify.app/llms.txt
Use this file to discover all available pages before exploring further.
Authorize payment (auth only)
Authorize a PayDirect payment without capturing funds immediately. This flow places a hold on the customer’s funds so you can capture or reverse the authorization later. The same PayDirect initiate API as GPI is used for authorization. SetcaptureTxn to false in Request body.
When to Use
Use this flow when you need to verify and reserve funds before completing the transaction, such as:- Hotel and hospitality bookings
- Vehicle rentals
- Delayed order fulfillment
- Inventory confirmation workflows
- Any scenario requiring payment approval before final settlement
- Capture the authorized amount to complete the payment — standalone capture
- Reverse the authorization to release the held funds — auth reversal
Supported payment methods
Authorize (auth only) supports cards and international Apple Pay only. UPI and net banking are not available on PayDirect.| Method | Domestic | International |
|---|---|---|
| Cards | ✓ | ✓ |
| Apple Pay | — | ✓ |
API
| Method | POST |
| Path | /gl/v1/payments/initiate |
| Production | https://api.payglocal.in/gl/v1/payments/initiate |
| Sandbox | https://api.uat.payglocal.in/gl/v1/payments/initiate |
Headers
| Header | Mandatory | Description |
|---|---|---|
Content-Type | Yes | application/json |
x-gl-token-external | Yes | RSA-signed JWS of the request body (see Key Management) |
x-gl-merchantid | Yes | Your PayGlocal merchant ID (MID) |
x-gl-kid | Yes | Key ID of the private key used to sign the JWS |
captureTxn to false in Request body below, with cardData or tokenData as for GPI.
Next steps
| Action | API |
|---|---|
| Capture | POST /payments//capture |
| Reverse hold | POST /payments//auth-reversal |
| Status | Get transaction status — expect AUTHORIZED until capture |
| Refund | After SENT_FOR_CAPTURE — Refund |
Authorizations
RSA-signed JWS (JSON Web Signature) token carrying the request payload.
- Header:
{ "alg": "RS256", "kid": "<merchant-key-id>", "iss": "<merchant-id>", "x-gl-enc": "false", "is-digested": "true" } - Payload: the exact JSON body sent in the request (or its SHA-256 digest when
is-digested=true). - Signed with the merchant's RSA private key; PayGlocal verifies with the matching public key.
Body
Auth-only initiate (captureTxn must be false). Cards and international Apple Pay only — UPI and net banking are not supported for auth.
Merchant's unique transaction identifier. Alphanumeric only.
4 - 50"23AEE8CB6B62EE2AF07"
Customers are redirected here post payment completion.
"https://api.prod.payglocal.in/gl/v1/payments/merchantCallback"
Payment instrument and amount for PayDirect initiate. Either option 1 (cardData) or option 2 (tokenData) — not both.
- Card data
- Token data
Must be false for authorise-only.
false Optional stable merchant-side ID for idempotency and reconciliation. Alphanumeric only.
15 - 40"IFNN939494NJFJ"
Recommended for fraud checks and processor compliance.
Response
Returned immediately from initiate. Redirect the customer to data.redirectUrl, then poll data.statusUrl or Get Transaction Status. Expect AUTHORIZED until you capture. No mandateId in data.
Response envelope for PayDirect initiate (200). GPI and auth-only — data does not include mandateId.
No fields in this envelope are marked required.
PayGlocal transaction ID. Use for status, capture, and refund APIs.
"gl_o-a057c4d6b6c620741apzp0ZX2"
High-level status. Typically INPROGRESS immediately after initiate.
"INPROGRESS"
Human-readable status message.
"Transaction Created Successfully"
Response timestamp (DD/MM/YYYY HH:MM:SS).
"02/06/2026 21:47:33"
Success code on initiate (e.g. 200). See 4xx responses for error codes.
"200"
data on a successful PayDirect initiate (200). GPI and auth-only responses use this shape (no mandateId).
No response fields are marked required — typical GPI payloads include redirectUrl, statusUrl, and merchantTxnId.
null on success.

