Your own payment layer. Built in, not bolted on.
Calmony Pay is a Cardstream-powered payment processing API that handles one-off charges, recurring subscriptions, and invoice generation — settling funds directly to your Griffin-backed UK bank account.
47 features shipped. Every one of them real.
Card Tokenisation via Cardstream
Tokenise cards through Cardstream's hosted or direct API. Stored tokens are attached to customers and used for subscriptions and one-off charges — raw card data never touches your server.
Hosted Checkout Sessions
Create a Cardstream-hosted payment page with a single API call. On completion, the card is tokenised, a payment intent is recorded, and the customer is redirected to your success URL.
Subscription Billing Cron
An Inngest-powered hourly job finds subscriptions due for renewal, charges the default payment method, and extends the billing period. Failed charges retry three times over three days before moving to past_due.
Invoice Generation with PDF Downloads
Every successful payment produces a structured invoice with line items, tax support, and a downloadable PDF — complete with Calmony Pay branding and a unique invoice number.
Webhook Event Delivery
Register endpoints and receive HMAC-SHA256-signed event payloads for payment_intent.succeeded, invoice.paid, subscription.updated, and more. Failed deliveries retry with exponential backoff.
Customer Portal
A hosted, token-authenticated page where your end-users view their invoice history, download PDFs, manage active subscriptions, and update their saved card — no login required.
API Key Authentication
sk_live and sk_test keys authenticate every request. Each key resolves its project context, enforces per-key rate limiting, and supports idempotency keys for safe retries.
Admin Dashboard
A protected dashboard showing total revenue, payment counts, a 30-day revenue chart, and per-customer views with full payment history, active subscriptions, and invoice downloads.
API Documentation
A /docs page with every endpoint documented — curl examples, JSON request/response shapes, authentication guide, webhook setup, and SDK installation instructions.
The Suite
One suite. Every part of your business.
Each product below is live and shipping on the platform.
Developer Tools / AI Infrastructure
[Security] SEC-27: Dependabot or Equivalent — No automated dependency update configuration
Control: SEC-27 Instances: 1 Category: dependency_security No .github/dependabot.yml or renovate.json configuration exists. Security patches in dependencies will not be automatically proposed as PRs.
[Template] TPL-E04: Structured Data — no JSON-LD Organization or WebSite schema
Control: TPL-E04 Instances: 2 Category: tpl_seo No <script type="application/ld+json"> anywhere in src/app. Google's rich-result eligibility relies on these markers. File: N/A Recommendation: Add Or
[Mission Gap] AI-Powered Deal Pipeline & Lead Scoring
Category: core_functionality Severity: critical The mission explicitly promises 'deal pipeline management' and 'AI-powered lead scoring' under Sales & Revenue. No deal pipeline schema, UI, or agent e
[ERR] ERR-06: API Route Try/Catch — 4 route handlers missing error wrapping
Control: ERR-06 Instances: 4 Category: err_api Several API route handlers execute database queries and other async operations without a top-level try/catch block. Unhandled promise rejections in Next
[Performance] PERF-23: Preloading Critical Resources — No preconnect hints for external origins
Control: PERF-23 Instances: 1 Category: perf_resource_loading The root layout contains no preconnect or dns-prefetch hints. While most API calls are server-side and don't benefit from browser-level p
[Security] SEC-02: XSS Prevention — dangerouslySetInnerHTML with server-fetched unsanitized HTML
Control: SEC-02 Instances: 1 Category: owasp src/app/page.tsx renders HTML fetched from shell.growth.marketing.renderHTML() directly via dangerouslySetInnerHTML without DOMPurify or equivalent saniti
From API key to settled payment in four steps
Create a project and grab your API key
Sign in, complete onboarding, and generate a sk_live or sk_test key from the dashboard. Every API call is scoped to your project — test keys stay off the live Cardstream environment.
Tokenise a card or launch a hosted checkout
POST to /v1/checkout/sessions to redirect customers through Cardstream's hosted payment page, or tokenise a card directly via /v1/payment_methods. The resulting token is stored and ready for reuse.
Charge once or subscribe
Confirm a payment intent for a one-off charge, or create a subscription and let the billing cron handle every renewal — invoices generated automatically on each successful payment.
Monitor, download, and respond to events
Watch revenue in the dashboard, let customers self-serve through their portal, and receive real-time webhook events so your own systems stay in sync with every payment outcome.
Serious infrastructure for payment-critical software
Calmony Pay is designed to give SaaS Factory full ownership of the payment transaction layer — with the controls that role demands.
HMAC-signed webhook delivery
Every outbound webhook carries an HMAC-SHA256 signature so your endpoints can verify the event came from Calmony Pay — not an impersonator.
Hashed API key storage
API keys are hashed before storage. The raw key is shown once at creation and never retrievable again — even from the database.
Griffin-backed UK bank settlement
Funds settle to a Griffin-powered UK bank account, giving you direct ownership of the settlement layer without a third-party holding your float.
Project-scoped data isolation
Every record — customers, payment intents, invoices, subscriptions — is scoped to a project resolved from the authenticating API key. Cross-project data leakage is structurally prevented at the application layer.