# Documentation - [Documentation](/docs): Guides, concepts and reference for integrating payments with Tonder across Mexico, Colombia and Chile. - Get Started - [What is Tonder](/docs/get-started/what-is-tonder): What Tonder is, how a payment flows end to end, and which of the four integration models fits you. - [Choose your integration](/docs/get-started/choose-integration): Pick the integration model that fits your stack, timeline, and PCI appetite. - [Quickstart](/docs/get-started/quickstart): Take your first test payment with Hosted Checkout in four steps, without building a card form. - [Authentication](/docs/get-started/authentication): Your API keys, the headers every request needs, and the idempotency key for each integration type. - [Environments](/docs/get-started/environments): Sandbox and production base URLs, and what changes between the two environments. - [Security & PCI Scope](/docs/get-started/security): How Tonder protects card data and which PCI scope falls on you for each integration model. - [Go-live Checklist](/docs/get-started/go-live-checklist): Everything to have ready before you move real money: keys, webhooks, testing and monitoring. - Core Concepts - [Payment Lifecycle](/docs/core-concepts/payment-lifecycle): The states a payment moves through, which ones are terminal, and when you can fulfill the order. - [3DS Payment Lifecycle](/docs/core-concepts/3ds-lifecycle): How 3D Secure authentication works, when a challenge is triggered, and how to resume the flow after it. - [Webhooks Model](/docs/core-concepts/webhooks-model): Tonder's two webhook formats, which integration receives each, and how to read them. - [Idempotency](/docs/core-concepts/idempotency): How to retry a request without double-charging, using each integration's idempotency key. - [Correlation Keys & Metadata](/docs/core-concepts/correlation-keys): The key that ties a Tonder payment to your order across the API, webhooks and reports. - [Money, Currencies & Amounts](/docs/core-concepts/money): Amount format, supported currencies, and why a mistyped `150.00` charges 15,000. - [Decline codes](/docs/core-concepts/decline-codes): The processor's decline-code catalog, with the soft-versus-hard distinction that decides whether to retry. - Hosted Checkout - [Overview](/docs/hosted-checkout/overview): When to let Tonder host the payment page, and what you get without building a card form. - [Quickstart](/docs/hosted-checkout/quickstart): From zero to a test payment: create the session, redirect the customer, confirm the result. - [Create a Payment Session](/docs/hosted-checkout/create-session): The request body that creates a payment session, field by field, and the URL it returns. - [Customize the Checkout](/docs/hosted-checkout/customize-ui): Put your logo and colors on the checkout with `ui_config`, once or per session. - [Listen for Webhooks](/docs/hosted-checkout/listen-webhooks): Register your endpoint and process session events idempotently, with a worked handler. - [Check Status Manually](/docs/hosted-checkout/check-status): Check a payment's outcome when you can't wait for the webhook, and which status to trust. - [Reference](/docs/hosted-checkout/reference): Session and transaction statuses, webhook payloads, and the fields each event returns. - SDKs - [Overview — Full vs Lite](/docs/sdks/overview): Which SDK to use per platform, and how PCI scope shifts when the card is tokenized on the client. - [Web](/docs/sdks/web): Integrate the Web SDK: secure card fields, saved cards and alternative payment methods. - [Migrating from the legacy SDK](/docs/sdks/migrate-legacy-sdk): From tonder-web-sdk v2 (InlineCheckout / LiteInlineCheckout) to @tonder.io/web-sdk, including the webhook change. - [Migrating from Direct API](/docs/sdks/migrate-direct-api): Move some or all of your checkout to the Web SDK without changing your backend: same /process/, same webhooks, same reconciliation. - [Mobile (Flutter · Ionic · React Native)](/docs/sdks/mobile): The iOS, Android, React Native, Flutter and Ionic SDKs, and which flow each one covers. - Direct API (S2S) - [Overview](/docs/direct-api/overview): The unified `/process/` endpoint: one contract for payments, APMs and withdrawals. - [Quickstart](/docs/direct-api/quickstart): Your first server-to-server payment in the sandbox, with the full headers and body. - [Authentication & Tokenization](/docs/direct-api/authentication): Authenticate with your API key, and exchange it for an access token to tokenize cards. - [Card Payments](/docs/direct-api/card-payments): The two card flows — tokenized and raw data — and the PCI scope each one carries. - [Non-Card Payments (APMs)](/docs/direct-api/apm-payments): Charge with SPEI, OXXO Pay, MercadoPago and cash vouchers from the same endpoint. - [Multi-Method Payments](/docs/direct-api/multi-method): Offer several payment methods in one session and let the customer choose. - [Refunds](/docs/direct-api/refunds): How to refund a card payment, and the rules that limit it: full, once, within 29 days. - [Withdrawals](/docs/direct-api/withdrawals): Send money to a beneficiary via SPEI or debit card, and track the status through to settlement. - Hybrid - [Overview & When to Use It](/docs/hybrid/overview): Combine SDK or Hosted for cards with API Direct for APMs and payouts, without PCI scope. - [Dual Webhooks](/docs/hybrid/dual-webhooks): Why a hybrid integration receives two webhook formats, and how to handle both on one endpoint. - [Reference](/docs/hybrid/reference): Which leg covers each capability in a hybrid integration, plus the refund and payout rules. - Payment Methods - [Overview & Matrix](/docs/payment-methods/overview): Every method you can accept, and what changes in the request when you switch between them. - [Cards](/docs/payment-methods/cards): Accepted brands, 3D Secure, saved cards, and what to expect from an authorization. - [Apple Pay](/docs/payment-methods/apple-pay): Accept Apple Pay on the web with the Web SDK button: domain enablement, availability, events, and reconciliation. - [SPEI](/docs/payment-methods/spei): Charge via SPEI transfer: generate the reference, show it to the customer, and wait for confirmation. - [Frictionless SPEI](/docs/payment-methods/frictionless-spei): SPEI without leaving your checkout: the customer pays to a dedicated CLABE and you reconcile it automatically. - [OXXO Pay](/docs/payment-methods/oxxo): Generate an OXXO Pay voucher, how long it lasts, and how you learn it was paid. - [Cash vouchers](/docs/payment-methods/cash-vouchers): Cash at 25+ chains across Mexico and Chile, with the bank IDs for each network. - [MercadoPago](/docs/payment-methods/mercadopago): Accept MercadoPago, including its sandbox testing rules. - [Limits & Business Rules](/docs/payment-methods/limits): Minimum and maximum amounts, expiries and business rules for each payment method. - Webhooks - [How Webhooks Work](/docs/webhooks/how-it-works): How Tonder delivers webhooks, what the payload contains, and why you confirm server-side. - [Setup & Management](/docs/webhooks/setup): Register, test and manage your webhook endpoints from the API or the Dashboard. - [Events Catalog (Short + Long)](/docs/webhooks/events-catalog): Every event Tonder can send you, with the format and trigger for each. - [Delivery & Retry](/docs/webhooks/delivery-retry): What counts as a successful delivery, when Tonder retries, and how to avoid duplicates. - [Best Practices & Deduplication](/docs/webhooks/best-practices): How to make your endpoint idempotent, fast and safe before it goes to production. - Testing & Certification - [Environment & Test Data](/docs/testing/environment): What you can test in the sandbox, what you can't, and how it differs from production. - [Test Cases — Cards](/docs/testing/card-test-cases): Test cards for every outcome: approved, declined, 3DS and insufficient funds. - [Test Cases — APMs](/docs/testing/apm-test-cases): How to simulate SPEI, OXXO and MercadoPago payments in sandbox, including the ones that expire. - [Test Cases — Withdrawals](/docs/testing/withdrawals-test-cases): How to test withdrawals in sandbox and force each terminal state. - [Certification Checklist](/docs/testing/certification-checklist): The scenarios you must run and evidence before production is enabled. - MCP Integration - [MCP Integration](/docs/mcp/overview): The plugin that teaches AI agents to integrate Tonder's SDKs using versioned documentation. - [Installation](/docs/mcp/setup): Install the plugin in Claude Code, Claude Desktop, Codex CLI or Codex Desktop, step by step. - [Usage](/docs/mcp/usage): How to ask the agent for an integration, and what it will ask you before writing code. - Dashboard - [Overview](/docs/dashboard/overview): A tour of the Dashboard's sections and what each one solves. - [Home](/docs/dashboard/home): The home screen's KPIs: volume, acceptance, methods and recent transactions. - [Analytics](/docs/dashboard/analytics): Acceptance, conversion and deposit analytics, broken down by method, brand and issuing bank. - [Fraud & Risk](/docs/dashboard/fraud-risk): Guardian: what it blocked, what it let through, and which risk signals it is seeing. - [Transactions](/docs/dashboard/transactions): Search, filter and inspect any transaction, including its disputes. - [Withdrawals](/docs/dashboard/withdrawals): Review and approve withdrawals, and track the balance they are paid from. - [Finances](/docs/dashboard/finances): Balances, settlements and reconciliation: where the money you receive comes from. - [Payment Links](/docs/dashboard/payment-links): Charge with no integration: create a payment link, brand it, and share it. - [Developers](/docs/dashboard/developers): Where your API keys live, and how sandbox and production keys stay separate. - [Webhooks](/docs/dashboard/webhooks): Manage webhook endpoints from the Dashboard and review their deliveries. - [Team Members](/docs/dashboard/team-members): Invite your team and control what each role can see and do.