Ledgerline is the dark-fiber payments core for fintechs — one API that scores risk, picks the cheapest rail, and posts a double-entry ledger that balances to the cent, with a 48ms P95 and idempotency on every write.
Authorization, routing, risk, settlement, reconciliation and webhooks share one ledger and one idempotency model — so a retry can never double-charge and a balance can never drift.
Every movement posts two opposing entries inside one serialisable transaction. Query any account's balance at any millisecond — no nightly batch, no "pending vs available" guesswork.
# one transfer = two ledger entries { "amount": 8420, # minor units "currency": "EUR", "source": "acct_user_8f3c", "destination": "acct_merch_a21", "rail": "auto", "idempotency_key": "ord_7741_v2" } → debit acct_user_8f3c −€84.20 → credit acct_merch_a21 +€84.20
Set rail: "auto" and Ledgerline scores cost, speed and approval odds across every connected network — then fails over if the first attempt declines.
A network-trained model scores every auth in under 9ms, in-region. Tune thresholds per merchant — allow, step up to 3DS, or block.
// typed, idempotent const c = new Ledgerline(key); await c.transfers.create(body);
Acquirer files match against ledger entries automatically. Exceptions land in a queue — not a spreadsheet at month-end.
Every state change emits an HMAC-signed event with a monotonic sequence number. Replay any window; we de-dupe so your handler never double-counts a payout.
// charge a card, auto-route, settle to a payout — one call import { Ledgerline } from "@ledgerline/core"; const c = new Ledgerline(process.env.CANTOR_KEY); const charge = await c.charges.create({ amount: 8420, currency: "EUR", source: "tok_visa_4291", rail: "auto", capture: true, }, { idempotencyKey: "ord_7741" }); // charge.status → "settled" · charge.fee → 158 // ledger auto-posts both entries · book stays balanced
Every write takes an idempotency key. Retry a timed-out request and Ledgerline returns the original result — never a double charge, never a duplicate payout. The same primitive guards webhooks, refunds and reversals.
Funds held at tier-1 banking partners under our EMI licence, never commingled. Cardholder data is tokenized at the edge and never touches your servers. Continuous controls monitoring, evidence exported on demand.
PANs are swapped for network tokens before they reach your backend. AES-256 at rest, TLS 1.3 in flight, keys rotated in an FIPS-140-2 HSM.
Customer balances sit in segregated accounts at tier-1 partners. Reconcile your ledger against the safeguarding statement at any time via the API.
Every API call and admin action is written to a signed, append-only log. Stream it to your SIEM or export a regulator-ready bundle in one request.
You pay on volume that actually moves. No minimums on Sandbox, no per-seat tax on your finance team, and the rate drops as you scale.
For prototypes and your first $50K of real volume.
For products processing real money at real scale.
For regulated platforms moving $100M+ across borders.
"We collapsed four payment providers onto one Ledgerline book in six weeks. Smart routing alone lifted our auth rate by 1.4 points — that's real revenue we were leaving on the table."
"Idempotency keys are the whole reason we sleep at night. We retry aggressively at the network edge and have never double-charged a customer — 14 million transactions in."
"Adding SEPA Instant and USDC payouts was a one-line rail change. Our European settlement dropped from two days to under ten seconds — no new integration."
Can't find it? Our solutions team answers integration questions in a shared Slack within an hour on business days.
Every transfer writes two opposing entries inside a single serialisable transaction — if either fails, both roll back. A continuous invariant check sums all debits and credits per currency; any non-zero delta pages on-call immediately. In 409 days of production we've had zero settlement breaks.
For a card auth including risk scoring: P50 29ms, P95 48ms, P99 96ms, measured at 4,000 auths/sec sustained. Risk scoring adds under 9ms because the model runs in-region, not as a remote call.
With rail: "auto" we score each eligible network on landed cost, expected approval probability and settlement speed, weighted by the policy you set. If the chosen network declines for a retriable reason, we fail over to the next-best automatically — all under one idempotency key.
Yes. Funds sit in safeguarded accounts at our tier-1 banking partners under our EMI licence, never commingled with operating capital. You can reconcile your ledger balance against the safeguarding statement at any time via the API.
Your full ledger — every entry, balance and signed event — is exportable as newline-delimited JSON at any time, and stored card tokens are portable under PCI network rules. There's no exit fee and no data-egress charge.
Test-mode keys are instant, the docs ship copy-paste snippets in four languages, and you only pay when real money moves.