POS

EXZIX POS is a terminal-and-cashier flow for creating Live Payment Intents. Terminal credentials and cashier sessions are separate from merchant API keys.

Register and authenticate a terminal

A merchant registers a terminal under an active branch from the merchant dashboard. The one-time credential is returned only on creation or rotation. Authenticate it over HTTPS with POST /api/v1/terminal/session using terminal_id, credential, and environment=live. The response returns a short-lived terminal session.

Cashier session

A signed-in cashier creates POST /api/v1/terminal/cashier-session over HTTPS with merchant_id, terminal_session, and environment. The response returns the cashier session used by the POS payment route.

Create a POS payment

POST /api/v1/terminal/pos/payment requires Content-Type: application/json, X-Cashier-Session, Idempotency-Key, and HTTPS. The JSON payment fields are validated by the POS service; the response contains the normal Payment Intent and hosted payment_url. Use a new idempotency key for every new checkout attempt.

text

curl -X POST https://api.exzix.com/api/v1/terminal/pos/payment \
  -H 'X-Cashier-Session: YOUR_CASHIER_SESSION' \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: pos-order-001' \
  --data '{"amount":"12.00","currency_kind":"fiat","currency_value":"TRY"}'

Lifecycle and security

Rotating a terminal credential revokes its active terminal sessions. Revoking a terminal also revokes its sessions. POS clients cannot set Payment Intent status or bypass observer confirmation. Never expose terminal credentials or cashier sessions in browser URLs, logs, QR payloads, or support screenshots.

Status authority

The POS display may show the hosted checkout URL and poll server status, but only the Payment Intent observer and signed webhook lifecycle can confirm payment.