verapli
Sign inJoin free
Menu

Guides · payments · Popular APIs

Paddle Billing API

Merchant-of-record billing for software and SaaS. Build in a separate sandbox account, then verify the live account (domain review, business and identity checks) before taking live payments. Server-side API keys, client-side tokens for Paddle.js, and per-destination webhook secrets.

Researched · not yet run liveLast researched 25 October 2026 · Paddle · provider site

Researched, not yet run live. Built from the provider’s official pages (linked below). A person hasn’t walked this flow end to end yet, so check each step against the source.
Do this with verapliJSON for agents

Who owns what

Sandbox and live are separate Paddle accounts with separate logins, catalogs, API keys, client-side tokens and webhook destinations.

  • Paddle sandbox account developer owned by the person or businessNo verification needed; domains auto-approved.
  • Paddle live account organisation owned by the business (or sole proprietor)Must be verified before live payments.

Paddle recommends starting live verification early because it can take days and cannot be skipped [to verify exact wording].

Have ready

  • A software or SaaS product that fits Paddle's Acceptable Use Policy: Physical goods and human services unrelated to software are prohibited.
  • A live HTTPS website on the checkout domain with product description, pricing, terms (with the legal brand name), privacy policy and refund policy reachable from navigation, and a contact method
  • Live HTTPS website with description, pricing, terms and conditions, refund policy, privacy policy and contact details. · Domain review checks these; only approved domains can host live checkout. [4]Needed for: Submit the website domain for approval
  • Personal details (date of birth, home address) and the business legal name and address. · Live account setup asks for them. [2]Needed for: Complete account setup and business verification
  • Government-issued ID, if Paddle's identity verification asks for it. · Identity verification is a phase of account verification; the document requirement was not confirmed on an official page [to verify]. [5]Needed for: Complete account setup and business verification
  • Bank account for payouts [to verify where in the flow this is asked].

Steps

Steps marked “human step” are ones only you can do: verapli never signs in, submits, pays or accepts terms for you.

  1. Sign up for a sandbox account

    The person creates a Paddle sandbox account (separate from live) to build and test.

    • Guided by hand
    • Human step: You press submit

    Where: https://sandbox-vendors.paddle.com/signup

  2. Create a sandbox API key

    In Settings > Authentication > API keys, create a key with a name, minimal permissions and an expiry. It is shown once.

    • verapli co-pilot
    • Human step: You press submit
    • After: Sign up for a sandbox account

    verapli captures PADDLE_API_KEY_SANDBOX here by plain code: encrypted in your browser, never shown to AI.

    If something goes wrong (2)
    • Requests return 403 forbidden.: The key lacks the permission for that endpoint; create a key with the required permission. [1]
    • Key stopped working after some weeks.: Keys expire (default 90 days, maximum one year) and cannot be revalidated; create a new key. [1]

    Where: https://sandbox-vendors.paddle.com

  3. Create a sandbox client-side token

    Create a client-side token for Paddle.js (starts test_). Safe for the frontend; never put an API key in the frontend.

    • verapli co-pilot
    • Human step: You press submit
    • After: Sign up for a sandbox account

    verapli captures NEXT_PUBLIC_PADDLE_CLIENT_TOKEN_SANDBOX here by plain code: encrypted in your browser, never shown to AI.

    Where: https://sandbox-vendors.paddle.com

  4. Sign up for the live account

    The person creates the live Paddle account. Start this early, because verification takes time.

    • Guided by hand
    • Human step: You press submit

    Where: https://vendors.paddle.com/signup

  5. Submit the website domain for approval

    Under Settings > Website approval, submit each domain or subdomain that will host checkout.

    • verapli co-pilot
    • Human step: The provider reviews it
    • After: Sign up for the live account
    The provider says
    Most submissions are approved automatically; manual reviews are typically completed within an estimated 5-7 business days. [4]
    If something goes wrong (1)
    • Domain not approved or checkout fails on a subdomain.: Each subdomain used for checkout needs its own approval; make sure terms (with your brand name), refund and privacy policies and pricing are reachable from navigation. [4]

    Where: https://vendors.paddle.com

  6. Complete account setup and business verification

    Enter personal details, business legal name and address, website and offering, then finish anything else Paddle asks for (such as documents or identity checks). Paddle then reviews the business.

    • Guided by hand
    • Human step: You prove your identity
    • After: Sign up for the live account
    The provider says
    Business review typically takes about 10 minutes but may take longer for more complex businesses. [2]

  7. Recreate catalog and credentials in live

    Recreate products and prices, a live API key, a live client-side token, and webhook destinations in the live account. Switch base URL from sandbox-api.paddle.com to api.paddle.com.

    • verapli co-pilot
    • Human step: You press submit
    • After: Complete account setup and business verification, Submit the website domain for approval

    verapli captures PADDLE_API_KEY here by plain code: encrypted in your browser, never shown to AI.

    Where: https://vendors.paddle.com

  8. Create a live client-side token

    Create the live client-side token (starts live_) for Paddle.js.

    • verapli co-pilot
    • Human step: You press submit
    • After: Complete account setup and business verification

    verapli captures NEXT_PUBLIC_PADDLE_CLIENT_TOKEN here by plain code: encrypted in your browser, never shown to AI.

    Where: https://vendors.paddle.com

  9. Create a notification destination

    Add a webhook destination; copy its endpoint secret key and verify the Paddle-Signature header against the raw body. Sandbox and live destinations have separate secrets.

    • verapli co-pilot
    • Human step: You press submit
    • After: Complete account setup and business verification

    verapli captures PADDLE_WEBHOOK_SECRET here by plain code: encrypted in your browser, never shown to AI.

    If something goes wrong (1)
    • Signature checks fail after recreating a destination.: Recreating a destination generates a new secret key; update the stored value. [3]

    Where: https://vendors.paddle.com

  10. Set the default payment link

    Set the default payment link (Checkout > Checkout configuration) to a page with Paddle.js on an approved domain, not localhost; otherwise checkout fails with "Something went wrong".

    • Guided by hand
    • After: Submit the website domain for approval

Terms and gotchas

Plain-English summary, not legal advice. Each card links its source.

Can get you bannedThe rules say

Prohibited products

Prohibited include physical products, human services unrelated to software (consulting, coaching, IT services), donations/crowdfunding/advertising, IP infringement and IPTV, spyware, marketplaces for non-Paddle sellers, MLM and mass SMS marketing, adult content, gambling, financial and payment services and virtual currency, travel, pseudo-science, medical advice, deepfakes/face swaps/voice impersonation, device tech support, system cleaners and antivirus, VPNs and proxies, CAPTCHA solving, and reseller licences. The list is not exhaustive. [6]

Can cost moneyThe rules say

Restricted categories need enhanced due diligence

Human-like face generation, device technical support and VPNs/proxies are flagged as needing enhanced due diligence; Paddle contacts sellers for more information. [6]

Can cost moneyThe rules say

Merchant of record

Paddle verifies you and your business before acting as your merchant of record; Paddle is the seller to the end customer and therefore reviews what you sell and where checkout runs. [5]

Worth knowingThe rules say

API keys expire

API keys expire (default 90 days, maximum one year) and cannot be revalidated. [1]

What you end up with

Env varSecretFormatWhat it is
PADDLE_API_KEY_SANDBOXsecretpdl_sdbx_apikey_…Sandbox server-side API key.
PADDLE_API_KEYsecretpdl_live_apikey_…Live server-side API key (backend only).
NEXT_PUBLIC_PADDLE_CLIENT_TOKEN_SANDBOXnot secrettest_…Sandbox client-side token for Paddle.js (not secret).
NEXT_PUBLIC_PADDLE_CLIENT_TOKENnot secretlive_…Live client-side token for Paddle.js (not secret).
PADDLE_WEBHOOK_SECRETsecretopaque secret string (shape only)Endpoint secret key of a notification destination, used to verify Paddle-Signature.

Renewals

  • Paddle API keys: every 90 days by default (up to 1 year, chosen at creation) [1]

Pricing

  • Costs: 5% + 50 cents per checkout transaction (pay-as-you-go).
  • No monthly fees stated; products under $10 need bespoke pricing.

Source [7]

For agents

The same entry as JSON: /api/v1/entries/paddle/billing-api · requirements /api/v1/requirements/paddle/billing-api · terms /api/v1/terms/paddle/billing-api.

Remote MCP (read-only, no auth)
claude mcp add --transport http verapli https://verapli.com/mcp

> "What do I need for Paddle Billing API, and how long will it take?"
  → tools/call requirements { "provider_id": "paddle/billing-api" }

Sources

  1. Paddle API authentication API keys created under Paddle > My account > Settings > Authentication > API keys with name, permissions and expiry; shown once; default expiry 90 days, maximum one year; key format pdl_live_apikey_ / pdl_sdbx_apikey_; Bearer auth; backend only. · accessed 25 October 2026 · official
  2. Setup checklist Separate sandbox and live signup URLs; sandbox needs no verification and domains are auto-approved; live account setup asks for personal details (date of birth, home address), business legal name and address, website and offering; business review typically about 10 minutes; website must have terms, privacy and refund policies, prices matching the catalog and a reachable contact. · accessed 25 October 2026 · official
  3. Go-live checklist Live payments require verification; recreate catalog, credentials and notification destinations in live; client-side tokens test_/live_; never use an API key in the frontend; per-destination webhook secret verifies Paddle-Signature; default payment link must be on an approved domain; base URLs sandbox-api.paddle.com and api.paddle.com; rotate keys regularly. · accessed 25 October 2026 · official
  4. Domain Review (Paddle Help Center) Most domain submissions approved automatically; manual review typically 5-7 business days (estimate); website content requirements; each checkout subdomain needs approval. · accessed 25 October 2026 · official
  5. Account Verification (Paddle Help Center) Paddle verifies you and your business before acting as your merchant of record; sections Domain Review, Business Identification, Identity Verification. · accessed 25 October 2026 · official
  6. Understanding Paddle's Acceptable Use Policy (AUP): What Am I Not Allowed To Sell? Prohibited and restricted categories (last updated 13 April 2026); list not exhaustive. · accessed 25 October 2026 · official
  7. Paddle pricing 5% + 50 cents per checkout transaction on pay-as-you-go; products under $10 need bespoke pricing. · accessed 25 October 2026 · official

Provider rules change. This page is generated from verapli registry version 2026.1025.316; spotted something out of date? Tell us. Paddle is not affiliated with verapli.