Overview

The UC Card Open Platform lets your website or app work with UC Card accounts and UC Card wallets:

Product	What it does	You call
Sign in with UC Card	Users log in with their UC Card account (OpenID Connect + PKCE). You receive a stable user ID, the sub.	https://auth.htp.example
Payments	You create a payment; the user confirms it in the UC Card App with their payment PIN; USDT moves from their wallet to yours.	POST /open/v1/payments
Refunds	Return all or part of a payment, instantly.	POST /open/v1/payments/{id}/refunds
Payouts	Send USDT from your wallet to a UC Card user (needs approval).	POST /open/v1/payouts

You can use Sign in with UC Card on its own: any UC Card Partner can let UC Card users sign in with their existing UC Card account, without creating a new password. See Sign in with UC Card.

All money is USDT. Amounts are strings with at most two decimals, for example "12.50".

How it fits together

1. Your server creates a payment with a signed request and gets a checkout_url.
2. The user opens checkout_url inside the UC Card App (the UC Card cashier), checks the amount and confirms with their payment PIN.
3. UC Card sends a signed callback (payment.paid) to your server. You verify it, mark the order paid and answer 2xx.

Users are identified only by the OIDC sub your app receives from Sign in with UC Card. You never see phone numbers or wallet IDs unless the user grants the phone scope.

Environments

	Sandbox	Production
API key prefix	ok_test_…	ok_live_…
Who can pay / be paid	Your app's test users (up to 20)	Any UC Card user who signed in to your app
App must be published	No	Yes
Fees	Calculated, then rebated to your wallet	Charged
Limits	Your approved limits, capped at 100 / 500 / 2000 USDT (single / day / month)	Your approved limits

One base URL serves both: https://htp-open-api.vai247.pro. The API key you sign with decides the environment, and each environment only sees its own orders.

What you need

• A verified (KYC) UC Card account with an active wallet and a payment PIN.
• A server that can keep secrets — the API secret must never reach a browser or mobile app.
• An HTTPS endpoint to receive callbacks.