{"registry_version":"2026.1025.387","generated_at":"2026-10-25T06:27:00Z","content_sha256":"089d16f627d9365e3d0663cc8069203706d7cb23a76c332226e29686968811a5","signed":true,"signature":{"key_id":"ed25519:74ca19268e364242","algorithm":"ed25519","expires_at":"2026-11-24T06:27:09Z","expired":false,"manifest":"/registry/manifest.json"},"entry_sha256":"6a5ee3ae660ababb3da9c3d4a76c78fa5ca7d206777126c46f90b9d668394463","entry":{"id":"paddle/billing-api","name":"Paddle Billing API","vendor":"Paddle","summary":"Merchant-of-record billing for software and SaaS. Build in a separate sandbox account, then verify the live account (domain review, business and identity checks) before taking live payments. Server-side API keys, client-side tokens for Paddle.js, and per-destination webhook secrets.","aliases":["paddle"],"category":"payments","group":"C","homepage":"https://www.paddle.com","docs":["https://developer.paddle.com","https://developer.paddle.com/build/set-up-checklist/","https://developer.paddle.com/build/go-live-checklist/"],"status":"researched","last_verified":null,"last_researched":"2026-10-25","sources":[{"id":"auth","url":"https://developer.paddle.com/api-reference/about/authentication","title":"Paddle API authentication","accessed":"2026-10-25","supports":"API keys created under Paddle > My account > Settings > Authentication > API keys with name, permissions and expiry; shown once; default expiry 90 days, maximum one year; key format pdl_live_apikey_ / pdl_sdbx_apikey_; Bearer auth; backend only.","kind":"official"},{"id":"setup","url":"https://developer.paddle.com/build/set-up-checklist/","title":"Setup checklist","accessed":"2026-10-25","supports":"Separate sandbox and live signup URLs; sandbox needs no verification and domains are auto-approved; live account setup asks for personal details (date of birth, home address), business legal name and address, website and offering; business review typically about 10 minutes; website must have terms, privacy and refund policies, prices matching the catalog and a reachable contact.","kind":"official"},{"id":"golive","url":"https://developer.paddle.com/build/go-live-checklist/","title":"Go-live checklist","accessed":"2026-10-25","supports":"Live payments require verification; recreate catalog, credentials and notification destinations in live; client-side tokens test_/live_; never use an API key in the frontend; per-destination webhook secret verifies Paddle-Signature; default payment link must be on an approved domain; base URLs sandbox-api.paddle.com and api.paddle.com; rotate keys regularly.","kind":"official"},{"id":"domain_review","url":"https://www.paddle.com/help/start/account-verification/what-is-domain-verification","title":"Domain Review (Paddle Help Center)","accessed":"2026-10-25","supports":"Most domain submissions approved automatically; manual review typically 5-7 business days (estimate); website content requirements; each checkout subdomain needs approval.","kind":"official"},{"id":"verification","url":"https://www.paddle.com/help/start/account-verification","title":"Account Verification (Paddle Help Center)","accessed":"2026-10-25","supports":"Paddle verifies you and your business before acting as your merchant of record; sections Domain Review, Business Identification, Identity Verification.","kind":"official"},{"id":"aup","url":"https://www.paddle.com/help/start/intro-to-paddle/what-am-i-not-allowed-to-sell-on-paddle","title":"Understanding Paddle's Acceptable Use Policy (AUP): What Am I Not Allowed To Sell?","accessed":"2026-10-25","supports":"Prohibited and restricted categories (last updated 13 April 2026); list not exhaustive.","kind":"official"},{"id":"pricing","url":"https://www.paddle.com/pricing","title":"Paddle pricing","accessed":"2026-10-25","supports":"5% + 50 cents per checkout transaction on pay-as-you-go; products under $10 need bespoke pricing.","kind":"official"}],"allowed_domains":["vendors.paddle.com","sandbox-vendors.paddle.com"],"account_model":{"summary":"Sandbox and live are separate Paddle accounts with separate logins, catalogs, API keys, client-side tokens and webhook destinations.","accounts":[{"name":"Paddle sandbox account","kind":"developer","owned_by":"the person or business","required":true,"note":"No verification needed; domains auto-approved."},{"name":"Paddle live account","kind":"organisation","owned_by":"the business (or sole proprietor)","required":true,"note":"Must be verified before live payments."}],"notes":["Paddle recommends starting live verification early because it can take days and cannot be skipped [to verify exact wording]."]},"prerequisites":[{"need":"A software or SaaS product that fits Paddle's Acceptable Use Policy","note":"Physical goods and human services unrelated to software are prohibited."},{"need":"A live HTTPS website on the checkout domain with product description, pricing, terms (with the legal brand name), privacy policy and refund policy reachable from navigation, and a contact method"}],"have_ready":[{"kind":"live_website","description":"Live HTTPS website with description, pricing, terms and conditions, refund policy, privacy policy and contact details.","why":"Domain review checks these; only approved domains can host live checkout.","needed_for":["domain_review"],"auto_check":"website_live","source":"domain_review"},{"kind":"other","description":"Personal details (date of birth, home address) and the business legal name and address.","why":"Live account setup asks for them.","needed_for":["live_account_setup"],"auto_check":"none","source":"setup"},{"kind":"government_id","description":"Government-issued ID, if Paddle's identity verification asks for it.","why":"Identity verification is a phase of account verification; the document requirement was not confirmed on an official page [to verify].","needed_for":["live_account_setup"],"auto_check":"none","source":"verification"},{"kind":"bank_account","description":"Bank account for payouts [to verify where in the flow this is asked].","auto_check":"none"}],"steps":[{"id":"sandbox_signup","title":"Sign up for a sandbox account","summary":"The person creates a Paddle sandbox account (separate from live) to build and test.","route":"guided","depends_on":[],"gate":"human_submit","url":"https://sandbox-vendors.paddle.com/signup","sources":["setup"]},{"id":"sandbox_api_key","title":"Create a sandbox API key","summary":"In Settings > Authentication > API keys, create a key with a name, minimal permissions and an expiry. It is shown once.","route":"copilot","depends_on":["sandbox_signup"],"gate":"human_submit","url":"https://sandbox-vendors.paddle.com","recovery":[{"hiccup":"Requests return 403 forbidden.","fix":"The key lacks the permission for that endpoint; create a key with the required permission.","source":"auth"},{"hiccup":"Key stopped working after some weeks.","fix":"Keys expire (default 90 days, maximum one year) and cannot be revalidated; create a new key.","source":"auth"}],"capture":{"env":"PADDLE_API_KEY_SANDBOX","kind":"api_key","mask_pattern":"^pdl_sdbx_apikey_"},"sources":["auth"]},{"id":"sandbox_client_token","title":"Create a sandbox client-side token","summary":"Create a client-side token for Paddle.js (starts test_). Safe for the frontend; never put an API key in the frontend.","route":"copilot","depends_on":["sandbox_signup"],"gate":"human_submit","url":"https://sandbox-vendors.paddle.com","capture":{"env":"NEXT_PUBLIC_PADDLE_CLIENT_TOKEN_SANDBOX","kind":"token"},"sources":["golive"]},{"id":"live_signup","title":"Sign up for the live account","summary":"The person creates the live Paddle account. Start this early, because verification takes time.","route":"guided","depends_on":[],"gate":"human_submit","url":"https://vendors.paddle.com/signup","sources":["setup"]},{"id":"domain_review","title":"Submit the website domain for approval","summary":"Under Settings > Website approval, submit each domain or subdomain that will host checkout.","route":"copilot","depends_on":["live_signup"],"gate":"third_party_review","url":"https://vendors.paddle.com","lead_time":{"official":{"text":"Most submissions are approved automatically; manual reviews are typically completed within an estimated 5-7 business days.","source":"domain_review"}},"preflight":["website_live","website_not_form_only","privacy_policy_reachable"],"recovery":[{"hiccup":"Domain not approved or checkout fails on a subdomain.","fix":"Each subdomain used for checkout needs its own approval; make sure terms (with your brand name), refund and privacy policies and pricing are reachable from navigation.","source":"domain_review"}],"sources":["domain_review"]},{"id":"live_account_setup","title":"Complete account setup and business verification","summary":"Enter personal details, business legal name and address, website and offering, then finish anything else Paddle asks for (such as documents or identity checks). Paddle then reviews the business.","route":"guided","depends_on":["live_signup"],"gate":"human_identity","lead_time":{"official":{"text":"Business review typically takes about 10 minutes but may take longer for more complex businesses.","source":"setup"}},"sources":["setup","verification"]},{"id":"live_credentials","title":"Recreate catalog and credentials in live","summary":"Recreate products and prices, a live API key, a live client-side token, and webhook destinations in the live account. Switch base URL from sandbox-api.paddle.com to api.paddle.com.","route":"copilot","depends_on":["live_account_setup","domain_review"],"gate":"human_submit","url":"https://vendors.paddle.com","capture":{"env":"PADDLE_API_KEY","kind":"api_key","mask_pattern":"^pdl_live_apikey_"},"sources":["golive","auth"]},{"id":"live_client_token","title":"Create a live client-side token","summary":"Create the live client-side token (starts live_) for Paddle.js.","route":"copilot","depends_on":["live_account_setup"],"gate":"human_submit","url":"https://vendors.paddle.com","capture":{"env":"NEXT_PUBLIC_PADDLE_CLIENT_TOKEN","kind":"token"},"sources":["golive"]},{"id":"webhook_destination","title":"Create a notification destination","summary":"Add a webhook destination; copy its endpoint secret key and verify the Paddle-Signature header against the raw body. Sandbox and live destinations have separate secrets.","route":"copilot","depends_on":["live_account_setup"],"gate":"human_submit","url":"https://vendors.paddle.com","recovery":[{"hiccup":"Signature checks fail after recreating a destination.","fix":"Recreating a destination generates a new secret key; update the stored value.","source":"golive"}],"capture":{"env":"PADDLE_WEBHOOK_SECRET","kind":"webhook_secret"},"sources":["golive"]},{"id":"default_payment_link","title":"Set the default payment link","summary":"Set the default payment link (Checkout > Checkout configuration) to a page with Paddle.js on an approved domain, not localhost; otherwise checkout fails with \"Something went wrong\".","route":"guided","depends_on":["domain_review"],"gate":"none","sources":["golive"]}],"outputs":[{"name":"PADDLE_API_KEY_SANDBOX","description":"Sandbox server-side API key.","secret":true,"example_format":"pdl_sdbx_apikey_…","environments":["development","test"],"from_step":"sandbox_api_key"},{"name":"PADDLE_API_KEY","description":"Live server-side API key (backend only).","secret":true,"example_format":"pdl_live_apikey_…","environments":["production"],"from_step":"live_credentials"},{"name":"NEXT_PUBLIC_PADDLE_CLIENT_TOKEN_SANDBOX","description":"Sandbox client-side token for Paddle.js (not secret).","secret":false,"example_format":"test_…","environments":["development","test"],"from_step":"sandbox_client_token"},{"name":"NEXT_PUBLIC_PADDLE_CLIENT_TOKEN","description":"Live client-side token for Paddle.js (not secret).","secret":false,"example_format":"live_…","environments":["production"],"from_step":"live_client_token"},{"name":"PADDLE_WEBHOOK_SECRET","description":"Endpoint secret key of a notification destination, used to verify Paddle-Signature.","secret":true,"example_format":"opaque secret string (shape only)","from_step":"webhook_destination"}],"terms_notes":[{"kind":"rules_say","severity":"red","title":"Prohibited products","text":"Prohibited include physical products, human services unrelated to software (consulting, coaching, IT services), donations/crowdfunding/advertising, IP infringement and IPTV, spyware, marketplaces for non-Paddle sellers, MLM and mass SMS marketing, adult content, gambling, financial and payment services and virtual currency, travel, pseudo-science, medical advice, deepfakes/face swaps/voice impersonation, device tech support, system cleaners and antivirus, VPNs and proxies, CAPTCHA solving, and reseller licences. The list is not exhaustive.","source":"aup"},{"kind":"rules_say","severity":"amber","title":"Restricted categories need enhanced due diligence","text":"Human-like face generation, device technical support and VPNs/proxies are flagged as needing enhanced due diligence; Paddle contacts sellers for more information.","source":"aup"},{"kind":"rules_say","severity":"amber","title":"Merchant of record","text":"Paddle verifies you and your business before acting as your merchant of record; Paddle is the seller to the end customer and therefore reviews what you sell and where checkout runs.","source":"verification"},{"kind":"rules_say","severity":"yellow","title":"API keys expire","text":"API keys expire (default 90 days, maximum one year) and cannot be revalidated.","source":"auth"}],"renewals":[{"what":"Paddle API keys","every":"90 days by default (up to 1 year, chosen at creation)","every_days":90,"source":"auth"}],"pricing_notes":{"costs":"5% + 50 cents per checkout transaction (pay-as-you-go).","notes":"No monthly fees stated; products under $10 need bespoke pricing.","source":"pricing"},"stripe_projects":false,"api_provisioning":{"available":"partial","notes":"Some account settings (e.g. default checkout URL via PATCH /settings/checkout-url) and onboarding verification status can be read or set via API, but signup, verification and creating the first API key are dashboard-only.","docs":["https://developer.paddle.com/build/go-live-checklist/"],"source":"golive"},"notes":["The exact location of payout/bank details and the identity document requirement were not confirmed on an official page [to verify].","Webhook secret prefix not confirmed [to verify]."]}}