# Pay for a cart (/api/carts/create-cart-payment)

`POST https://api.comecero.com/api/v1/carts/{cart_id}/payments`

Charges the cart total with the payment method you send, or the customer's default one. The amount and currency come from the cart, so do not send `total` or `currency` (`400`). Any token type may call it; a limited token only for a bound cart, and a limited test token only when its user may make test payments. A payment that succeeds at once closes the cart and makes the order: `status` is `completed`, or `pending` when it is only authorized. Events fire and the receipt email goes out. A payment that needs the shopper to act comes back `201` with `status` `initiated` and the next step in `response_data` (expand it): a `redirect_url` for PayPal or a 3-D Secure check, a `next_action` for a Comecero Express Payments 3-D Secure check you run on your own page, or the Stripe.js values for a `stripe` payment. When the shopper is done, get the payment and call `POST /payments/{payment_id}/commit` only while it is still `initiated` (the Comecero 3-D Secure page commits it itself). Until then the cart stays open. A declined payment is `402` with the payment in `error.meta.payment`. The same payment sent again soon after a success is `409` (code `duplicate`). A closed cart, an empty cart or a payment still being processed is `400`.

## Parameters

- `cart_id` (path, required): The id of the cart.
- `expand` (query): Comma-separated child objects to return in full instead of as a URL, for example `customer,payments`. Use dot notation for nested objects (`items.product`), up to four levels deep. A single object takes up to 12 paths; a list takes up to 2, applied to every item. Extra paths are dropped without an error. See [Expanding objects](https://docs.comecero.com/docs/basic-concepts/expanding-objects).
- `formatted` (query): When `true`, the object also has a `formatted` child with amounts and dates as display text in the shopper's language and currency (for example `$19.99` or `November 7, 2026`). The default is `false`. See [Localized formatting](https://docs.comecero.com/docs/basic-concepts/localized-formatting).
- `user_ip_address` (query): The shopper's IP address, when your server calls with a secret token on the shopper's behalf. Comecero uses it for fraud checks and to find the shopper's country. Only read for a secret token: for every other token the address the request comes from is used. A value that is not a valid IPv4 or IPv6 address is ignored.
- `user_agent` (query): The shopper's browser user agent, when your server calls with a secret token on the shopper's behalf. Comecero uses it for fraud checks. Only read for a secret token: for every other token the request's own `User-Agent` header is used.

Responses: 201, 400, 401, 402, 403, 404, 409, 422, 500, 502, 504.

Full schemas: operation `create_cart_payment` in /openapi.json.