# How Paydude works

URL: https://www.paydude.io/resources/how-paydude-works
Type: Guide
Published: 2026-09-05 · Updated: 2026-09-05
Summary: The Paydude flow from drop-in card fields through tokenization, authorization, settlement and payout — and what you build versus what is handled for you.

**A Paydude payment moves through five stages: capture, tokenize, authorize, settle, pay out.** You build two of them — the checkout and the webhook handler — and the rest happens on the platform side.

## Summary

Drop-in card fields keep card numbers off your servers entirely. You store a token, and charge that token whenever you need to. Signed webhooks and idempotent writes make retries safe. Payout speed is chosen per payout, not fixed on the account.

## The flow

1. **The customer enters their card** — Into drop-in card fields served by Paydude, so the raw card number never reaches your server.
2. **The card is tokenized** — You receive a token — a reference with no relationship to the card number. Store it; it is safe in your database.
3. **The payment is authorized** — Risk scoring runs, 3D Secure steps up when the signals warrant it, and the issuing bank approves or declines.
4. **The transaction settles** — Funds move from the issuing bank to the acquirer, net of interchange, over one to two business days.
5. **You are paid out** — Standard, next-day or instant — chosen per payout. Instant costs 1%; the others do not.

Stages two through four are the platform's responsibility. For the mechanics of what happens between banks, see [what is settlement](https://www.paydude.io/resources/what-is-settlement).

## What you build

**Division of labour**

| You build | Handled for you |
| --- | --- |
| Checkout page with drop-in fields | Card capture and tokenization |
| Webhook endpoint | Risk scoring and 3D Secure |
| Product logic on success or failure | Retries and idempotency |
| Storing tokens against customers | PCI-scoped card storage |
|  | Settlement and payouts |

## Webhooks are the part worth getting right

Payments are asynchronous. A charge can succeed after the customer has closed the tab, a subscription renews without anyone present, and a dispute arrives weeks later. Webhooks are how you find out.

Paydude signs every webhook and makes writes idempotent, which addresses the two classic failure modes — a forged event, and the same event processed twice because your endpoint timed out and the platform retried.

> **Verify the signature, always:** An unverified webhook endpoint is a URL anyone can post to. Verifying the signature is a few lines and it is the difference between an event you can trust and one you cannot.

## Building it with an AI agent

Paydude publishes an official MCP server, which gives a coding agent typed payment tools rather than scraped documentation. Install it with `npx -y @paydude/mcp`, or in Claude Code with `claude mcp add paydude -- npx -y @paydude/mcp`, and set `PAYDUDE_API_KEY` to a sandbox key — sandbox keys need no signup.

The server can create and refund sandbox payments, search transactions, scaffold checkout and explain fees for a given volume. See the [API overview](https://www.paydude.io/resources/paydude-api-overview) for the surface it wraps.

**Start in the sandbox** Sandbox keys work immediately, with no signup gate. — [See the quickstart](https://www.paydude.io/#developers)

## Frequently asked questions

### How long does a Paydude integration take?

Sandbox keys need no signup, so you can make a test payment immediately. A basic checkout using drop-in card fields and the typed SDK is a short piece of work; subscriptions and webhook handling add more. The MCP server can scaffold checkout and test it against the sandbox for you.

### Does card data touch my servers?

No. Drop-in card fields capture the card inside Paydude's environment and return a token. Your database stores the token, never the card number — which is what keeps your PCI scope at the smallest self-assessment level.

### When do I get paid?

Payouts are standard, next-day or instant, chosen per payout rather than fixed on the account. Instant payouts cost 1%; the others carry no fee.

### What do I need to build myself?

The checkout page using drop-in fields, a webhook endpoint to receive events, and whatever your product does when a payment succeeds or fails. Tokenization, 3D Secure, risk scoring, retries and reconciliation are handled by the platform.