Server SDKs

Paymos maintains official server-side SDKs for eight language ecosystems. Every SDK covers the same invoices, withdrawals, payment channels, channel deposits, balances, server-time, cursor pagination, error, retry, request-signing, and webhook-verification contract.

All eight are published to their ecosystem's package registry. Install from there; the repository stays the place to read the source.

Language	Registry	Install	Official source
JavaScript / TypeScript	npm	npm i @paymos/sdk	Paymos-labs/typescript-sdk
Python	PyPI	pip install paymos-sdk	Paymos-labs/python-sdk
PHP	Packagist	composer require paymos/php-sdk	Paymos-labs/php-sdk
Go	Go modules	go get github.com/Paymos-labs/go-sdk/v2	Paymos-labs/go-sdk
.NET	NuGet	dotnet add package Paymos	Paymos-labs/dotnet-sdk
Java	Maven Central	io.paymos:paymos-java	Paymos-labs/java-sdk
Ruby	RubyGems	gem install paymos	Paymos-labs/ruby-sdk
Rust	crates.io	cargo add paymos	Paymos-labs/rust-sdk

Java resolves by coordinates rather than a one-line command: add the io.paymos:paymos-java dependency to your pom.xml or your Gradle build.

Use an immutable vMAJOR.MINOR.PATCH release tag. Each repository's release page contains the supported runtime, the changelog, and the source commit from which the release was produced.

Shared API surface

All clients expose six resources:

• —system — fetch server time for request-clock alignment
• —invoices — create, get, list, cancel, confirm payment, and sandbox simulation
• —withdrawals — create, get, list, cancel, and sandbox completion simulation
• —paymentChannels — create, get, list, block, unblock, and sandbox deposit simulation
• —paymentChannelDeposits — get one deposit, and poll the confirmed-deposit feed
• —balances — list available balances grouped by currency

Each client spells the two channel resources in its own language's convention: paymentChannels in TypeScript, PHP and Java, payment_channels in Python, Ruby and Rust, PaymentChannels in Go and .NET.

List helpers use cursor pagination with a maximum-page bound and reject a cursor returned twice. Automatic retries honor Retry-After; mutating requests are not retried on transport errors or generic server errors. A rate-limited request may be retried because the API did not accept it for processing.

One contract, eight languages

The eight are held to a shared behavioural contract, not only to a shared endpoint list. A single language-neutral conformance suite fixes the bytes that go into a request signature, the retry rules above, the cursor iterators and the webhook verifier, and a release ships only once its own tests run against that suite.

The practical consequence: an integration ported from one of these languages to another keeps its signing, paging, retry and webhook semantics. Two SDKs building the same filtered list request sign identical bytes.

What PHP adds

The PHP SDK carries a plugin-integration layer that exists in no other client: reverse verification of a webhook against a fresh read of the API, an amount and currency guard before an order is released, replay deduplication behind a pluggable event store, a verifier that holds the Sandbox and Live secrets at once, a reconciler, a mapper from event to order action, and encrypted credential storage.

That layer is why the CMS plugins are thin — the order-state logic sits once in the SDK underneath them instead of eight times above it. None of it applies to the other seven: they are client, signing, resources, pagination and webhook verification, and building on more than that will find nothing there.

Security rules

Request authentication and webhook authentication use different signatures. API requests use base64 HMAC-SHA256 over the canonical request. Webhooks use a hex HMAC-SHA256 over {timestamp}.{exact raw body}. Pass the unparsed request bytes to the SDK verifier before decoding JSON. The verifier refuses a timestamp more than five minutes away from now by default, and accepts a header carrying two v1 values, so a secret rotation costs you no code change.

For endpoint schemas and examples, continue with Authentication, Invoices, Withdrawals, Balances, and Webhooks.