Applications
An application is a Cartino product allowed to use Cartino Pay — for example Cartino Cloud. Applications are created by Cartino Pay administrators; there is no self-service sign-up.
What an application has
| Field | Purpose |
|---|---|
name, slug |
Identification. The slug appears in API responses and webhooks ("application": "cartino-cloud"). |
status |
active or disabled. Disabled applications cannot call the API. |
| API tokens | One or more bearer tokens (cp_live_… / cp_test_…). Only hashes are stored. |
| Callback URLs | Allow-list of URLs the payer may be redirected back to. callback_url in a payment request must match one of them. |
| Webhook URL | Where Cartino Pay POSTs payment outcomes. |
| Webhook secret | whsec_… used to sign webhooks. Shown once at creation or rotation. |
| Default gateway | The external gateway used for this application's payments. Changing it does not affect your integration. |
rate_limit_per_minute |
Optional override of the default request budget. |
Callback URL matching
The requested callback_url must match a registered URL on scheme, host, port and path. Query strings are ignored for matching, so you can register https://cartino.cloud/payment/callback and request https://cartino.cloud/payment/callback?cart=42.
https://cartino.cloud/payment/callback✅https://cartino.cloud/payment/callback?cart=42✅https://cartino.cloud/payment/callback/extra❌http://cartino.cloud/payment/callback❌ (https required)https://evil.example/callback❌
Requesting changes
Ask a Cartino Pay administrator to:
- issue or revoke tokens
- add or remove callback URLs
- change the webhook URL or rotate the webhook secret
- change the default gateway (for example move from a sandbox to a live gateway)
- adjust the rate limit
- enable or disable the application
All of these are recorded in the audit log.