Changelog

What's new in the Tonder platform. The most recent entries appear first.

September 23, 2026

Account Validation — know who owns the CLABE before the money moves

A new standalone API confirms that a CLABE is real and that it belongs to your user — holder name and RFC, straight from the bank — before a single peso is at risk. Tonder sends a 0.01 MXN test deposit (on us) and reads the owner from the official interbank receipt. Two calls: POST /api/v1/account-verifications/ to start, GET /api/v1/account-verifications/{account_number} to read holder_name, holder_id, institution and the name_match / rfc_match flags. One validation per CLABE, cached for 24 hours; use it for deposits, payouts, or both. Same Authorization: Token header as the rest of the API. Guide on Account Validation; endpoints in the API Reference.

External 3DS on the Direct API

If you authenticate the cardholder with your own 3-D Secure provider, you can now pass the result to Tonder in the same POST /process/ request — a top-level threeDomainSecure object with the ECI, the cryptogram (cavv for Visa, ucaf + directoryServerTransactionID for Mastercard) and, when the ECI says not authenticated, acceptRisk: true. Tonder charges with it: approved in one call, no challenge. Send payment_method.card_brand too, so mismatches are a clear 400 instead of an acquirer decline.

Direct API only, and the account must be enabled first. The one thing to get right: the object goes at the top level — nested inside payment_method it is silently ignored and you get a regular 3DS challenge. Fields, ECI rules and errors on External 3DS.

"threeDomainSecure": {
  "eci": "02",
  "ucaf": "kCO52e75N318oAB3MPZU6EhB2Td6",
  "directoryServerTransactionID": "9e8c…"
}

September 21, 2026

Refund endpoint in the API Reference

A processor-agnostic refund is now documented: POST /business/{business_id}/payments/{transaction_reference}/refunds. Send only the amount; Tonder resolves the processor from the transaction reference. Cards only, and only for Direct API and Web SDK integrations — every other integration keeps refunding from the dashboard. Read the not-found note before you integrate: a missing transaction answers HTTP 200 with a plain string, not a 404.

Withdrawals — the Returned status

Withdrawals can end in a seventh status, Returned: the transfer was sent and processed, but the receiving bank returned the funds afterwards. It is terminal, and it comes after Success — so a handler that only reconciles on Success never sees the reversal. Treat Success, Failed, Declined, Cancelled and Returned as final. It also has its own webhook, withdrawal_Returned, the third one on that withdrawal. Full table on Withdrawals → Step 3 and the payload under Webhooks.

Correction to the July 9 entry: it listed REFUNDED as retired. It was not — it maps to Returned.

September 17, 2026

Apple Pay — sandbox test cards

The Apple Pay guide now includes Apple's sandbox test cards for the networks Tonder processes — Visa, Mastercard and American Express — with the expiry and CVV/CVC/CID for each, plus the three-step Sandbox Tester setup (App Store Connect tester account → sign in on a real device → add the card manually in Wallet). These are Apple's latest FPANs (August 2025); Tonder's regular test cards cannot be added to Wallet, and Apple's cards work only in sandbox.

September 15, 2026

Chile — per-method limits, and a correction

Minimum and maximum amounts for every Chilean method are now published on Limits & Business Rules:

Correction to the September 11 entry: it said the online-transfer bank IDs (Banco BCI 8296, Machpay 8416, Khipu 8488/8490/8494/8491) were retired. They were not — they remain available and are back on Cash vouchers and Coverage. Only the Walmart Chile network (8198) was retired. If you removed those IDs on the strength of that entry, they still work.

September 11, 2026

Cash vouchers in Chile — Caja Vecina and BancoEstado Express

Cash vouchers accepts cash in Chile again, through two new collection networks:

Send channel: "WP" with one or both bank IDs. The Walmart Chile network (8198) is retired — if you had it hardcoded, update to the two above. Online transfer (Banco BCI, Machpay, Khipu) is unchanged. See Cash vouchers and Coverage.

August 17, 2026

Settlements — cycles, rolling reserve, and the report

When your money arrives was undocumented: T+1 and T+2 appeared nowhere in the docs, and the rolling reserve was a single line. Two new pages under Payments Management:

• Settlements — the T+1, T+2 and batch cycles and where each is available, the twice-weekly batch schedule, and how the rolling reserve is withheld and released after 90 days.
• Settlement report — every section and column of the report, plus a worked reconciliation from processed volume down to the amount deposited.

August 17, 2026

Payments Management — Handling Disputes

A new top-level section for the operational side of running payments. It opens with a chargeback reference per market:

• Handling Disputes — Mexico
• Handling Disputes — Chile

Each covers the response windows published by Visa, Mastercard and American Express, what changes between domestic and cross-border cases, and what's expected of you at each stage. Brand deadlines, pre-arbitration and arbitration were previously undocumented.

The dispute response window is now stated as 15 days to submit evidence, corrected on Transactions so the site holds one figure.

August 17, 2026

Saved cards and Card-on-File in Hosted Checkout

Both already worked; neither was documented outside the SDK path. Create a Payment Session now covers them:

• Saved cards — add saved_cards to payment_method_types and the checkout lists the customer's stored cards beside the new-card form. payment_method_config.saved_cards.show_save_card_checkbox adds the opt-in checkbox.
• Card-on-File — with an active Tonder connection, cards are saved automatically (3DS on save, a subscription per card) and repeat payments skip the CVV. Nothing to configure, and it takes precedence over the checkbox.

saved_cards and payment_method_config are in the OpenAPI spec too, so the request schema on that page lists them.

August 7, 2026

Web SDK migration guides + Apple Pay

Two new guides to reach @tonder.io/web-sdk from wherever you are today:

• Migrating from the legacy SDK — from tonder-web-sdk v2 (InlineCheckout / LiteInlineCheckout), with the method-by-method mapping and the webhook change to the Short format — the part to budget for.
• Migrating from Direct API — move your checkout to the browser without changing your backend: same /process/, same webhooks, same reconciliation.

And Apple Pay gets its own payment-method page: the Web SDK button, domain registration, availability, and events.

Checkout

Business licence$250.00 MXN

August 6, 2026

Check your withdrawal balance by API

You can now check the available balance of your Mexican withdrawals account with the Get Balance API (GET /withdrawals/balance): see how much you can disperse before creating withdrawals via POST /process/. The Withdrawals guide includes the balance section with per-environment examples.

Nu México's SPEI code changes to 40638

By order of Banco de México, Nu México now operates as NUBANK, S.A., Institución de Banca Múltiple, and its SPEI code changed with it. This affects you if you send withdrawals to Nu accounts or receive transfers from them.

What to update:

• Payouts — send 40638 in institucionContraparte.
• Deposits — your system and your H2H connection must recognise 40638 in institucionOrdenante.

Code 90638 stopped working on 5 August 2026 at 18:00 Mexico City time. Anything sent with it is rejected.

• Banking reference — the institution code table.

July 28, 2026

New Analytics module in the Dashboard

We launched Analytics, a new Dashboard section that goes deeper into payment performance than the Home KPIs. It's organised into two views:

• Acceptance & Conversion — Overall, FTD and Trusted acceptance rate, APM conversion rate, acceptance rate over time, acceptance by method, card network performance, best and worst issuing banks, and the FTD vs. Trusted comparison.
• Deposit Analytics — total deposits, FTDs, active depositors and average deposit, plus deposit volume and count, the first-time deposit funnel and the deposit amount distribution.

Both views filter by period (Today, 7D, 30D, 90D or a custom range).

• Analytics — every KPI, chart and section explained.

July 9, 2026

New withdrawal statuses

Withdrawals now use the same status vocabulary as payments. If your integration expected the previous names, update it with this mapping:

See the full flow in Withdrawals.

July 8, 2026

New Web SDK (@tonder.io/web-sdk)

We launched the new Tonder Web SDK on npm: @tonder.io/web-sdk — a browser TypeScript SDK that replaces the Full/Lite variants for web with a single package:

• Secure card fields mounted in your own UI (createTonder → init → create('card_fields') → mount → pay).

• Saved cards and Card-on-File: enrollCard(), getCustomerCards(), removeCustomerCard() with a secure_token.

• Alternative methods: SPEI, OXXO Pay, and SafetyPay banks (getPaymentMethodBanks()).

• Hosted/3DS presentation via redirect or embedded (SDK modal).

• TypeScript types included, structured errors (AppError), and webhook-aligned responses. Also available via CDN (window.Tonder).

• Web SDK (guide) — quick start and payment flows.

• Web SDK Reference — every method, type, and error.

Tonder Web SDK plugin for AI agents

We launched tonder-ai-integrations: plugins that help AI agents integrate Tonder SDKs correctly. The first plugin is Tonder Web SDK (v0.1.7), for Claude Code, Claude Desktop, Codex CLI, and Codex Desktop. It packages a framework-aware integration skill (HTML, React, Next.js, Angular) and a local MCP server (tonder-docs) with versioned Web SDK documentation — recipes, API reference, errors, and payment statuses.

Supported flows: card payment, enrollment, saved cards, payment methods, and SafetyPay banks. It installs today from the GitHub repository marketplace.

• MCP Integration — what it is and how it works.
• Installation — step by step per host.
• Usage — example prompts and the MCP tools.

June 10, 2026

Documentation redesign

This documentation shipped a full redesign:

• Two-row header with centered search and tabs (Docs · API Reference · SDK Reference · Resources · Changelog).
• Sidebar with icon chips, breadcrumbs above every title, and a refreshed table of contents.
• Inset-style code blocks, minimal tables, and Tonder-branded share (OG) cards.
• Native diagrams (flows and sequences) in the Hosted Checkout guides.

June 8, 2026

New Tonder dashboard

We launched a redesigned dashboard — faster, clearer, and with native analytics: Home, Analytics, Fraud & Risk, Transactions, Withdrawals, Finances, Payment Links, Developers, Webhooks, and Team Members.

Also in this release

• Cash vouchers — the cash payment method formerly called SafetyPay is now Cash vouchers. The integration is unchanged (same API type). See Cash vouchers.