---
title: "Begin a buyer-approval vault flow"
description: "PayPal/RazorPay off-session mandate."
canonical_url: "https://twominutebilling.com/help/developers/api-reference/payment-methods/begin-a-buyer-approval-vault-flow"
---
# Begin a buyer-approval vault flow

> PayPal/RazorPay off-session mandate.

<api-operation method="POST" path="/v1/businesses/{biz}/customers/{cus}/payment_methods/setup">
<template v-slot:docs="">

Returns an approval_url the buyer visits; the approved setup_token is then completed via POST …/payment_methods.

## Path parameters

<table>
<thead>
  <tr>
    <th>
      Parameter
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Required
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        biz
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      <strong>
        yes
      </strong>
    </td>
    
    <td>
      Business id (biz_…)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        cus
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      <strong>
        yes
      </strong>
    </td>
    
    <td>
      Customer id (cus_…)
    </td>
  </tr>
</tbody>
</table>

## Headers

<table>
<thead>
  <tr>
    <th>
      Parameter
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Required
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        Idempotency-Key
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      no
    </td>
    
    <td>
      Safely retry writes — repeats return the original response. If a write FAILED after it had already taken effect, that failure is what repeats: the key is spent, and a new attempt needs a new key.
    </td>
  </tr>
</tbody>
</table>

## Body

The request body is **required**.

<table>
<thead>
  <tr>
    <th>
      Field
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Required
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        provider
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      <strong>
        yes
      </strong>
    </td>
    
    <td>
      The payment provider to set up. One of <code>
        stripe
      </code>
      
      , <code>
        paypal
      </code>
      
      , <code>
        razorpay
      </code>
      
      , <code>
        gocardless
      </code>
      
      , <code>
        braintree
      </code>
      
      , <code>
        cashfree
      </code>
      
      , <code>
        adyen
      </code>
      
      , <code>
        checkoutcom
      </code>
      
      , <code>
        authorizenet
      </code>
      
      , <code>
        square
      </code>
      
      , <code>
        mollie
      </code>
      
      , <code>
        payu
      </code>
      
      , <code>
        cybersource
      </code>
      
      .
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        return_url
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      <strong>
        yes
      </strong>
    </td>
    
    <td>
      Where to send the customer after they finish.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        cancel_url
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      <strong>
        yes
      </strong>
    </td>
    
    <td>
      Where to send the customer if they cancel.
    </td>
  </tr>
</tbody>
</table>

## Response

<table>
<thead>
  <tr>
    <th>
      Field
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        object
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      The object type.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        provider
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      The payment provider.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        setup_token
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      The token the client uses to complete the setup.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        mode
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      How the customer completes the setup: <code>
        redirect
      </code>
      
      , <code>
        checkout
      </code>
      
      , <code>
        client_secret
      </code>
      
      , <code>
        sdk
      </code>
      
       or <code>
        form_post
      </code>
      
      . One of <code>
        redirect
      </code>
      
      , <code>
        checkout
      </code>
      
      , <code>
        client_secret
      </code>
      
      , <code>
        sdk
      </code>
      
      , <code>
        form_post
      </code>
      
      .
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        approval_url
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      redirect mode (PayPal): buyer visits this to approve.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        checkout
      </code>
    </td>
    
    <td>
      <code>
        object
      </code>
    </td>
    
    <td>
      checkout mode (RazorPay): params for the embedded checkout.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        client_secret
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      client_secret mode (Stripe): the secret the browser confirms with.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        publishable_key
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      The gateway's publishable key.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        sdk
      </code>
    </td>
    
    <td>
      <code>
        object
      </code>
    </td>
    
    <td>
      For <code>
        mode: sdk
      </code>
      
      : run this gateway's browser SDK with <code>
        params
      </code>
      
      . Post what the SDK returns as <code>
        client_result
      </code>
      
       with the completion request.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        form_post
      </code>
    </td>
    
    <td>
      <code>
        object
      </code>
    </td>
    
    <td>
      For <code>
        mode: form_post
      </code>
      
      : submit <code>
        fields
      </code>
      
       as a top-level HTML form POST to <code>
        action
      </code>
      
      . The gateway sends the buyer back to the return URL with a POST.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        payment_intent
      </code>
    </td>
    
    <td>
      <code>
        string
      </code>
    </td>
    
    <td>
      The setup intent (<code>
        pi_…
      </code>
      
      ) this add-card is recorded as.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        next_action
      </code>
    </td>
    
    <td>
      <code>
        object
      </code>
    </td>
    
    <td>
      How the buyer completes the challenge, when one is outstanding.
    </td>
  </tr>
</tbody>
</table>

## Status codes

<table>
<thead>
  <tr>
    <th>
      Status
    </th>
    
    <th>
      Meaning
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        201
      </code>
    </td>
    
    <td>
      Created
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        400
      </code>
    </td>
    
    <td>
      Unsupported provider / invalid body
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        404
      </code>
    </td>
    
    <td>
      No such customer
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        409
      </code>
    </td>
    
    <td>
      Idempotency-Key conflict — the key is already in flight, or was reused with a different request payload.
    </td>
  </tr>
</tbody>
</table>
</template>

<template v-slot:request="">

```bash [Request]
curl -X POST "$TMBILLING_URL/v1/businesses/biz_XXXXXXXXXXXX01/customers/cus_XXXXXXXXXXXX01/payment_methods/setup" \
  -H "Authorization: Bearer $TMBILLING_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "provider": "stripe",
    "return_url": "https://example.com/webhooks/billing",
    "cancel_url": "https://example.com/webhooks/billing"
  }'
```

</template>

<template v-slot:response="">
<code-group>

```json [201 Created]
{
  "object": "vault_setup",
  "provider": "stripe",
  "setup_token": "tok_XXXXXXXXXXXX01",
  "mode": "redirect",
  "approval_url": "https://example.com/webhooks/billing",
  "checkout": {},
  "client_secret": "whsec_XXXXXXXXXXXX01",
  "publishable_key": "Publishable key",
  "sdk": {
    "provider": "stripe",
    "params": {}
  },
  "form_post": {
    "action": "https://example.com/webhooks/billing",
    "fields": {}
  },
  "payment_intent": "pi_XXXXXXXXXXXX01",
  "next_action": {
    "mode": "redirect",
    "approvalUrl": "ApprovalUrl",
    "clientSecret": "ClientSecret",
    "publishableKey": "PublishableKey",
    "checkout": {},
    "sdk": {
      "provider": "stripe",
      "params": {}
    },
    "formPost": {
      "action": "https://example.com/webhooks/billing",
      "fields": {}
    }
  }
}
```

```json [400 Bad Request]
{
  "error": {
    "type": "invalid_request_error",
    "message": "Unsupported provider / invalid body"
  }
}
```

```json [404 Not Found]
{
  "error": {
    "type": "invalid_request_error",
    "message": "No such customer"
  }
}
```

```json [409 Conflict]
{
  "error": {
    "type": "idempotency_error",
    "message": "Idempotency-Key conflict — the key is already in flight, or was reused with a different request payload."
  }
}
```

</code-group>
</template>
</api-operation>


## Sitemap

See the full [sitemap](https://twominutebilling.com/sitemap.md) for all pages.