> Chytapay is a bank-transfer payments platform in Argentina. This page is part of the Integration API docs: https://chytapay.com.ar/api/ > Recommended reconciliation: by CUIL. Environments: test (https://integration-api.test.chytapay.com.ar) and production (https://integration-api.chytapay.com.ar). > Page: "How it works" (https://chytapay.com.ar/api/en/concepts/), updated on 2026-10-09. > Full index for AI assistants: https://chytapay.com.ar/llms.txt # How it works Who does what in an integration, how merchant accounts are linked, and which integration model to choose. 1. [Actors](https://chytapay.com.ar/api/en/concepts/#actores): who uses which credential 2. [Environments](https://chytapay.com.ar/api/en/concepts/#ambientes): Sandbox and Production 3. [Linking](https://chytapay.com.ar/api/en/concepts/#vinculacion): OAuth, once 4. [One integration](https://chytapay.com.ar/api/en/concepts/#modelos-integracion): and locations to separate events ## Actors and accounts Each actor authenticates with a different credential, against a different API. Which credential each actor uses and against which API. 1. Your backend uses the `clientId` and `clientSecret` only on the Auth API, to exchange and renew tokens. 2. To the Integration API it sends the merchant account's `idToken`. 3. The merchant account uses its email and password once, on the OAuth authorization screen. 4. The integration admin signs in to the Portal with their email and password. 5. The payer uses no credential: it transfers to the charge's CVU or pays in the checkout widget. | Actor | Who it is | Credential | Where it's used | | ----------------- | ----------------------------------------------- | ----------------------------------------------- | --------------------------------------------------------------------------- | | Integrator | Your company: the backend that creates charges | The integration's `clientId` and `clientSecret` | Only on the Auth API: `/integration/oauth2/token`, `/refresh` and `/revoke` | | Integration admin | Whoever configures the integration | Portal email and password | In the Portal | | Merchant account | The Chytapay account that receives the payments | Its Chytapay email and password | Once, on the OAuth authorization screen | | Payer | Whoever pays the charge | None | Transfers to the charge's CVU or pays in the checkout widget | To the Integration API your backend sends the merchant account's `idToken` as `Authorization: Bearer`, never the `clientSecret`. The token carries the integration (`aud`, the `clientId`) and the merchant account (`sub`). Without a link, the response is 403. The checkout widget uses the integration's publishable key (`pk_test` or `pk_live`) in the browser: see the [widget keys](https://chytapay.com.ar/api/en/widget/#claves). > **Warning:** **The merchant account performs the OAuth authorization, not the integration admin.** The admin's token doesn't work on the Integration API: it returns 401. ## Sandbox and Production Your integration is one, with two environments. **Sandbox** is for testing, with its own credentials and a test merchant account. **Production** has real merchant accounts and real money. You always enter through the same portal and switch with the environment selector. You start in Sandbox. To move to Production you request it under [**Credenciales**](https://chytapay.com.ar/portal/credentials) (Credentials): if the automatic check approves it, you generate the production credentials with the environment selector on Production, and if not, the request goes to review. The steps are in [Getting started](https://chytapay.com.ar/api/en/getting-started/#produccion). The path from Sandbox to Production. 1. You test in Sandbox. 2. You request Production under Credentials. 3. An automatic check decides: if it approves, you generate the production credentials. 4. If the check fails, the request goes to review. If they approve it, you generate the credentials. The daily WhatsApp message cap is per integration: 20 in Sandbox and 200 initial in Production. See the [limits](https://chytapay.com.ar/api/en/operacion/#limites). ## Linking vs. recurring use Linking happens once and needs a browser. Recurring use happens on every charge, server to server. ### Linking: once, with OAuth The merchant account authorizes your integration at `GET /integration/oauth2/authorize`, and your backend exchanges the `code` at `POST /integration/oauth2/token` for an `idToken` and a `refreshToken`, which you store. See the flow in [Connect merchant accounts](https://chytapay.com.ar/api/en/conectar-comercios/). ### Recurring use: every charge, server to server The `idToken` lasts 1 hour. Renew it with the stored `refreshToken`, as explained in [Connect merchant accounts](https://chytapay.com.ar/api/en/conectar-comercios/#usar-token), and call the Integration API with `Authorization: Bearer ` to [create charges](https://chytapay.com.ar/api/en/crear-cobros/). If the admin unlinks the merchant account, you can no longer charge on its behalf, but its pending charges are not canceled. ## One integration and its locations Everything you configure lives in the integration: `clientId` and `clientSecret`, `redirect_uri`, webhook URLs, signing secret and widget keys. **Have a single integration**, no matter how many customers or merchant accounts you have: don't create one per customer. If each customer, branch or franchise has its own backend and needs to receive its own events, use **locations**. A location is a unit of your integration with its own webhook URL. Credentials and the signing secret stay the integration's: a location only changes where events go. > **Note:** Each integration has one webhook URL, and locations add one per location. An event with no destination isn't delivered. See [Locations](https://chytapay.com.ar/api/en/sedes/). ## Portal map In the Portal, the integration admin configures and operates only their own integration. The environment selector switches between Sandbox and Production. | Section | What you do there | | ------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [**Dashboard**](https://chytapay.com.ar/portal/dashboard) | Your integration's summary, the status of your production request and your daily caps, with **Pedir más límite** (Request more limit). | | [**Credenciales**](https://chytapay.com.ar/portal/credentials) (Credentials) | Copy the `clientId` and the widget's `pk`, and configure its authorized domains. The `clientSecret` is shown only once, when created or rotated. You also request Production here. | | [**Configuración**](https://chytapay.com.ar/portal/settings) (Settings) | The webhook URL, its validation-token and the signing secret, the OAuth `redirect_uri` and the logo. | | [**Webhooks**](https://chytapay.com.ar/portal/notifications) | Which webhook events you receive (this is where you turn on `payment.unmatched`, which is off by default), the test webhook and the delivery history. | | [**Cuentas de comercio**](https://chytapay.com.ar/portal/users) (Merchant accounts) | The linked ones, the button to unlink and, in Sandbox, the test tokens. | | [**Tenants**](https://chytapay.com.ar/portal/tenants) | Locations. Appears only if you have locations enabled: ask support to enable them. | | [**Distribución**](https://chytapay.com.ar/portal/distribution) (Distribution) | Your commission on each payment. | | [**Transacciones**](https://chytapay.com.ar/portal/transactions) and [**Reportes**](https://chytapay.com.ar/portal/reports) (Transactions and Reports) | Your integration's charges and payments. | | [**Simulador de pagos**](https://chytapay.com.ar/portal/simulate) (Payment simulator) | A simulated incoming payment. Sandbox only. | [**Webhooks**](https://chytapay.com.ar/portal/notifications) configures events, not payer notifications (WhatsApp and email), which are set on each charge. See [event subscriptions](https://chytapay.com.ar/api/en/webhooks/#suscripcion). ### Access Sign in at [chytapay.com.ar/portal/login](https://chytapay.com.ar/portal/login) with your email and password. If you don't have an account yet, choose **Crear cuenta** (Create account). ## Glossary | Term | What it is | | ------------------ | ---------------------------------------------------------------------------------------------------- | | Integration | Your product registered in Chytapay, with its `clientId`, `clientSecret`, URLs and keys. | | Merchant account | The Chytapay account charges are created for. Linked through OAuth. The payer goes in `customer`. | | `referenceId` | Your charge ID, unique per integration and merchant account, canceled charges included. | | Location | A unit of your integration with its own webhook URL. In the API and the Portal, tenant. | | Payer notification | The message to the payer by WhatsApp or email. Not the same as a webhook event. | | `idToken` | The merchant account's token for the Integration API. Lasts 1 hour. Renewed with the `refreshToken`. | ## Next steps - [Getting started](https://chytapay.com.ar/api/en/getting-started/): From sign-up to your first event, in Sandbox. - [Connect merchant accounts](https://chytapay.com.ar/api/en/conectar-comercios/): OAuth and tokens. - [Create charges](https://chytapay.com.ar/api/en/crear-cobros/): Fields, states and batches. - [Locations](https://chytapay.com.ar/api/en/sedes/): One webhook URL per location. - [Commissions](https://chytapay.com.ar/api/en/cobrar-comision/): Charge a commission on every payment.