# Changelog Changes to the API and these docs, newest first. ## 3 Nov 2026 ### API - **New: a saved card's expiry.** Saved cards now carry `card.exp_month` and `card.exp_year`, and [GET /v1/payment-methods](https://docs.weavpayments.com/reference/payment-methods/list-payment-methods) takes `expires_by` (`YYYY-MM`) to find cards that expire soon. - **New: a saved card's charges.** [GET /v1/payments](https://docs.weavpayments.com/reference/payments/list-payments) takes `payment_method_id`. - **New: save the card while paying.** Add `save_payment_method: true` and `customer.id` to a `CARD` payment on [POST /v1/payments](https://docs.weavpayments.com/reference/payments/create-payment). Your customer pays and agrees to future charges in one step, with one check from their bank. You get `PAYMENT_COMPLETED`, then `PAYMENT_METHOD_SAVED`. See [Saved cards](https://docs.weavpayments.com/saved-cards). - **New: save the card from a checkout.** [POST /v1/checkouts](https://docs.weavpayments.com/reference/checkouts/create-checkout) takes the same `save_payment_method` and `customer.id`. The card is saved if your customer pays by card. ### Docs - **New: test saved cards.** Test mode's save page now has a card whose charges are declined and one that expires this month. See [Test mode](https://docs.weavpayments.com/test-mode#test-saved-cards). - **New: [Subscriptions](https://docs.weavpayments.com/subscriptions).** How to charge a saved card on your own schedule, with retries, expiring cards and canceling. ## 2 Nov 2026 ### API - **New: saved cards.** Save your customer's card once on Weav's save page ([POST /v1/payment-methods](https://docs.weavpayments.com/reference/payment-methods/create-payment-method)), then charge it with no customer present: `payment_method_id` on [POST /v1/payments](https://docs.weavpayments.com/reference/payments/create-payment). Also list, retrieve and remove, and the `PAYMENT_METHOD_SAVED`, `PAYMENT_METHOD_FAILED` and `PAYMENT_METHOD_REMOVED` webhooks. Off until Weav turns it on for your account. See [Saved cards](https://docs.weavpayments.com/saved-cards). Simpler payments and checkouts. Weav isn't live yet, so these changes don't keep the old names. - **Changed: retries need nothing extra.** The `Idempotency-Key` header is now optional. Without it, your `external_reference_id` is the key: the same reference and body returns the stored response. See [Idempotency](https://docs.weavpayments.com/idempotency). - **Changed: one shape for return URLs.** Payments take `success_url` and `cancel_url`, the same as checkouts (was `redirect_urls.success_url` and `redirect_urls.failure_url`). Both are optional for every channel: without them, your customer stays on Weav's result page. - **Changed: `callback_url` is now `webhook_url`** on payments and checkouts. Without it, webhooks go to your webhook URL. - **Changed: `customer` is optional with `HOSTED`.** Without a name, Weav's payment page asks your customer before the payment starts. With `DIRECT`, `customer.name` is still required. ## 1 Nov 2026 ### API - **New: live keys are refused from a browser.** A `wv_live_` key sent from a web page (with an `Origin` header) gets `403` with code `4030001`. Calls from your server are unchanged. See [Errors](https://docs.weavpayments.com/errors). ### Docs - **Webhook IP addresses:** Weav sends webhooks from `18.136.62.102` and `18.139.176.153`. See [IP addresses](https://docs.weavpayments.com/webhooks/ip-addresses). And a full guide to your key's [IP allowlist](https://docs.weavpayments.com/authentication#ip-allowlist). - A new home for the docs, with an API reference made from Weav's OpenAPI file: every endpoint with its fields, responses, and samples in cURL, Node.js, JavaScript, PHP, Python, Go, Rust and Java. - **Try it:** send a request from any reference page with a test key. See [the API reference](https://docs.weavpayments.com/reference#try-it). - **For AI assistants:** every page as Markdown (add `.md`), **Copy for LLM** and **More actions** (open in ChatGPT, Claude or Grok; connect Cursor, VS Code or Claude Code) on every page, full `llms.txt` files, and a public MCP server at `/mcp`. See [Build with AI](https://docs.weavpayments.com/build-with-ai). ## 29 Oct 2026 ### API - **New: checkouts.** [POST /v1/checkouts](https://docs.weavpayments.com/reference/checkouts/create-checkout) makes one link for an order or an amount; your customer chooses how to pay on Weav's page. Also [list](https://docs.weavpayments.com/reference/checkouts/list-checkouts), [retrieve](https://docs.weavpayments.com/reference/checkouts/retrieve-checkout) and [cancel](https://docs.weavpayments.com/reference/checkouts/cancel-checkout), the `CHECKOUT_COMPLETED` and `CHECKOUT_EXPIRED` webhooks, and `checkout_reference_id` on payments. - **Changed: `next_action_format`** is now `HOSTED` (was `PAYMENT_LINK`) or `DIRECT`. ## 28 Oct 2026 ### API - **New: `references`** on the payment object: the provider’s other numbers for a payment, the ones your customer may have from their app or receipt (`invoice_number`, `receipt_number`, `transaction_id`). See [The payment object](https://docs.weavpayments.com/reference/payments/retrieve-payment#response-200). - **Changed: `reference`** on [List payments](https://docs.weavpayments.com/reference/payments/list-payments) also matches a number in `references`, which can match more than one payment. - **Changed: `channel_reference_id`** now holds only a reference that is unique to the payment. Maya’s receipt numbers and GCash’s transaction IDs can repeat, so they moved to `references`; for those channels `channel_reference_id` is null. - **New: repost limits.** [Repost a webhook](https://docs.weavpayments.com/reference/webhooks/repost-payment-webhook) works once every 30 seconds per payment and up to 20 times a minute per account in each mode (codes `4290201` and `4290202`). To check a status, retrieve the payment. ### Docs - New guides: [How payments work](https://docs.weavpayments.com/how-payments-work), with a sequence diagram for each kind of channel, and [Retries](https://docs.weavpayments.com/retries). - Search across every page, with ⌘K or Ctrl K. Light and dark mode. Method badges in the API reference. - Clearer [signing key rotation](https://docs.weavpayments.com/webhooks/verifying-signatures#rotating-your-signing-key): one key signs at a time.