Payment Page

When the buyer opens the link, they see the payment page Lunixi hosts on pay.lunixi.com. You do not host the page and you write no front-end code: the link's fields decide its content and your organization's brand settings decide its look. The payment step is the same Lunixi payment form as in the Checkout Form integration.

Address

https://pay.lunixi.com/7KQ2M9XAPT

• The code is 10 characters: digits and upper-case letters except I, L, O and U.
• Case, dashes and spaces do not matter; the letters I and L are read as 1 and O as 0. That is why reading the code aloud on the phone or typing it by hand does not change the result: 7kq2-m9xa-pt opens the same link.
• After the payment, the buyer returns to the result page at https://pay.lunixi.com/<CODE>/sonuc/<attempt-id>.

Page states

Two further conditions are shown on an open link: sold out when a multi-use link has reached its capacity, and another payment in progress when another buyer is paying a single-use link right now.

The buyer's steps

Payment form

• The form settings in your dashboard (payment methods, installments tab, identity and fraud checks) apply to link payments too. A link can only narrow them: checkout.paymentMethods limits the methods shown to a subset of your form settings, and checkout.requireThreeDs makes 3D Secure required.
• On OPEN-amount and MULTI_USE links, 3D Secure is always required.
• Link payments go through the same payment-time fraud checks as your other payments.
• SplitPay (multi-card) is not available on link payments, and saved cards are not offered to the buyer.
• Once opened, the payment form is valid for about 15 minutes. If it expires or the card is declined, the buyer starts a new attempt from the page; every attempt is recorded separately (see Payment attempts).

Branding and look

The page's look comes from your organization-level brand settings. You edit them in the dashboard, in the Brand and Payment Page section of your payment form settings; they cannot be changed with an API key.

Rules:

• The logo and cover must be PNG, JPEG or WebP; SVG is not accepted. Logo up to 1 MiB, cover up to 2 MiB, both up to 4096×4096 pixels.
• Colors must have at least 3:1 contrast against the theme background; a color that does not is not saved. The button text color (black or white) is chosen automatically for the color you pick.
• At the top of the page, in the share preview, and in emails and SMS messages Lunixi sends, the primary identity is your organization's legal name; your display name is shown as secondary.
• In the dashboard you see a preview of the page before saving a change; no payment can be made in the preview.

Share preview

When the link is shared in apps such as WhatsApp, iMessage or Telegram, the preview card shows your organization's legal name, your logo and the link title. The amount and buyer details never appear in the preview.

TEST banner

A link in the TEST environment carries a fixed TEST banner at the top of the page stating that no payment is taken; the same marking is added to the page title and the share preview. The TEST page does not show the "secure payment with Lunixi" statement.

Report this link

Every page has a Report this link option that lets the buyer report a suspicious link to Lunixi. A report does not change the link's state by itself; Lunixi reviews it and takes the link down (TAKEN_DOWN) if needed.

Details collected from the buyer

• Standard fields — with buyerFields you choose hidden, optional or required for each: full name, email, phone, billing address, national ID number. Default: full name and email required, phone optional, address and national ID number hidden.
• Custom fields — up to 20 fields: text, number, email, phone, date, select list, checkbox, TCKN, VKN. TCKN and VKN are validated algorithmically.
• Legal acceptance — with requireTermsAcceptance: true, the buyer cannot pay without accepting the legal documents in your footer links.
• Prefilled details — the details you pass in prefill are written to the payment record on the server and take precedence; values the buyer types only fill fields that are still empty.

Details the buyer enters are stored encrypted and returned to you in the clear through payment attempts and the dashboard. The data sent to the payment page contains no reference, tags, metadata, merchantNotifyEmails, attribution fields or prefill.

Personal links and access verification

On a link with recipient set, the page shows the buyer's name and contact details masked only (A*** Y***, a***@example.com). The details you pass in prefill are not sent to the browser.

If you want the buyer to see these details in the form, add access verification to the link: "verification": { "required": true, "channel": "EMAIL" } (recipient.email is required).

• On a link that requires verification, a payment cannot be started before verification is complete.
• Up to 5 codes are sent per link; a new code can be requested after 60 seconds.
• After 5 wrong codes in total (requesting a new code does not reset this counter), or once the 5-code sending allowance is used up, verification locks and the link shows verificationLocked: true. You unlock it by sending the link again with POST /:id/send, which resets both counters.
• This version supports the email channel only. In the TEST environment, the code goes only to the email addresses of your organization's verified members.

Result page and receipt

• The result page reads the payment's status (pending, succeeded, failed, expired) from the Lunixi server and refreshes itself at regular intervals. It opens only in the browser that started the payment; knowing the address alone does not reveal the result.
• On success, your successMessage is shown; if you set successRedirectUrl, the buyer is redirected there.
• The buyer can download the receipt as a PDF. The receipt number is PL-<YYYYMMDD>-<CODE> on a single-use link and PL-<YYYYMMDD>-<CODE>-<sequence> on a multi-use link (date in Istanbul time). The download link in the receipt email is valid for 30 days. This receipt is not an e-invoice.
• When a payment is taken, a notification email is sent to the merchantNotifyEmails addresses; in the TEST environment, only to your organization's verified members.

Buyer-flow endpoints

You do not need to call these endpoints; the payment page calls them. They carry no credentials; browsers may make cookie-carrying (CORS) calls to them only from the pay.lunixi.com origin, and starting a payment, requesting a code and reporting require the bot check (Turnstile). An attempt is tied to a short-lived (2 hours) session cookie in the buyer's browser that only the server can read.

Next steps

• Creating Links — the buyerFields, customFields, recipient, prefill and verification fields
• Webhooks — closing orders on payment.captured
• Checkout Form — the form used at the payment step