vonpay-checkout

Python SDK for the Von Payments Checkout API. Create hosted checkout sessions, verify webhook signatures, and validate signed return redirects.

Install

pip install vonpay-checkout

Requires: Python 3.9+, httpx 0.27+

Quick start

from vonpay.checkout import VonPayCheckout, VonPayError

client = VonPayCheckout("vp_sk_test_...")

session = client.sessions.create(
    amount=1499,
    currency="USD",
    country="US",
    success_url="https://example.com/order/123/confirm",
)

print(session.checkout_url)
# https://checkout.vonpay.com/checkout?session=vp_cs_test_...

Discrete-lifecycle API

The payment_intents, refunds, tokens, and capabilities namespaces give server-side control over payment intents, alongside the existing hosted-checkout sessions flow.

# Create a payment intent (auth + capture)
intent = client.payment_intents.create(
    amount=1499,
    currency="usd",
    capture_method="automatic",
    metadata={"order_id": "ord_42"},
    idempotency_key="ord_42-charge-1",
)
print(intent.id, intent.status)  # "vpi_live_…", "succeeded"

# Auth-only + later capture (fulfillment-on-ship)
auth = client.payment_intents.create(amount=1499, currency="usd", capture_method="manual")
client.payment_intents.capture(auth.id, amount_to_capture=1499)

# Refund a captured intent (partial or full)
refund = client.refunds.create(payment_intent=intent.id, amount=500)

# Create a reusable token for save-card / MIT flows
token = client.tokens.create(buyer_id="buyer_42", setup_for_future_use="off_session")

# Read the merchant's processor capability matrix before invoking optional ops
caps = client.capabilities.get()
if caps.supported_operations.partial_refund:
    # partial refunds supported — safe to offer partial-refund UI
    ...

Features

Typed session / webhook / error objects — full CheckoutSession, SessionStatus, WebhookEvent, VonPayError types.
Webhook verification — webhooks.construct_event(raw_body, signature_header, signing_secret) parses the x-vonpay-signature: t=<unix>,v1=<hex> header, verifies HMAC-SHA256 over f"{t}.{raw_body}" keyed by your per-endpoint signing secret (whsec_…), and enforces the freshness window (≤5 min old / ≤30 sec future). Accepts multiple v1= entries for zero-downtime secret rotation.
Return confirmation — client.sessions.confirm_return(params, session_secret) verifies the signature and confirms server-side that the payment succeeded, returning ReturnOutcome(paid, signature_valid, status, reason). Use this, and branch on paid. ⛔ verify_return_signature() is DEPRECATED and STOPS WORKING on or after 2026-10-13 — the redirect stops carrying sig / status / amount / currency / transaction_id at all, so there will be nothing to verify and it will refuse every return. Migrate before that date. (It was also never usable as merchant-side proof: the signature uses a platform-wide secret no merchant was ever issued.) It proves a message is AUTHENTIC, and a declined payment is signed just as validly, so a true from it was never proof of payment either. ⚠️ reason == "still_pending" means the charge is in flight (the ordinary 3-D Secure case) — show a neutral "confirming your payment", never a failure. ⚠️ paid: true still does not mean safe to fulfil: record which session IDs you have already fulfilled, and prefer fulfilling from the charge.succeeded webhook. ⚠️ Not session.succeeded — that event is emitted internally but is not subscribable: it is absent from the merchant subscription catalog, which accepts an unknown event key, stores nothing and returns success. An endpoint subscribed to it receives nothing, forever, with no error raised at any layer. charge.succeeded is the fulfilment event.
Auto-retry — exponential backoff on 429 / 5xx with Retry-After header support.
Request ID tracing — every response includes X-Request-Id for support tickets.

Documentation

License

MIT

Metadata

Release files for vonpay-checkout 2.5.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for vonpay-checkout 2.5.0
File	Size	Uploaded
vonpay_checkout-2.5.0.tar.gz	106.1 kB	Sep 16, 2026	Details

Built distribution (wheel)

Table of built distributions (wheels) for vonpay-checkout 2.5.0
File	Interpreter	ABI	Platform	Reset
vonpay_checkout-2.5.0-py3-none-any.whl 86.2 kB Sep 16, 2026	Python 3	none	any	Details

Total release size: 192.3 kB

Release files / vonpay_checkout-2.5.0.tar.gz

Download URL	vonpay_checkout-2.5.0.tar.gz
Size	106.1 kB
Tags	Source
SHA-256 checksum How to use checksums	`05be10068d40e84c630becd1f2681a21775f1c529bac052ffba874e8cfcba17a`
BLAKE2b-256 checksum How to use checksums	`c3c48cb56ca8e8c00a34fabd507f4a19638b6f8cc5a2e97cb2174d57b0e4acac`
Upload date	Sep 16, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Identity

Publishing platform: GitHub Actions
Publishing repository: github.com/Von-Payments/vonpay
Publishing commit: github.com/Von-Payments/vonpay/tree/155c8a26fcf032e390ba0a8d9b15f406253f64c3

Workflow

Publishing configuration: github.com/Von-Payments/vonpay/blob/155c8a26fcf032e390ba0a8d9b15f406253f64c3/.github/workflows/publish-pypi.yml
Publishing logs: github.com/Von-Payments/vonpay/actions/runs/35080823975/attempts/1

Artifact

Subject: vonpay_checkout-2.5.0.tar.gz
SHA-256 checksum: 05be10068d40e84c630becd1f2681a21775f1c529bac052ffba874e8cfcba17a Verifying attestations

Release files / vonpay_checkout-2.5.0-py3-none-any.whl

Download URL	vonpay_checkout-2.5.0-py3-none-any.whl
Size	86.2 kB
Tags	Python 3
SHA-256 checksum How to use checksums	`cbd11157b92d82e0d84bf6ea087b542f7ecf92ed5e15b8e88c2db7e950f97a55`
BLAKE2b-256 checksum How to use checksums	`c25a3bcb0e50a195ad19389a31a9272827336e22703af6a7e746e87d59301282`
Upload date	Sep 16, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Provenance

Identity

Publishing platform: GitHub Actions
Publishing repository: github.com/Von-Payments/vonpay
Publishing commit: github.com/Von-Payments/vonpay/tree/155c8a26fcf032e390ba0a8d9b15f406253f64c3

Workflow

Publishing configuration: github.com/Von-Payments/vonpay/blob/155c8a26fcf032e390ba0a8d9b15f406253f64c3/.github/workflows/publish-pypi.yml
Publishing logs: github.com/Von-Payments/vonpay/actions/runs/35080823975/attempts/1

Artifact

Subject: vonpay_checkout-2.5.0-py3-none-any.whl
SHA-256 checksum: cbd11157b92d82e0d84bf6ea087b542f7ecf92ed5e15b8e88c2db7e950f97a55 Verifying attestations