curl -X PUT https://api.liddie.io/api/v1/widgets/<widgetId> \
--cookie "<dashboard session>" \
-H 'Content-Type: application/json' \
-d '{
"type": "donation",
"name": "Homepage donate button",
"amountMode": "variable",
"allowedOrigins": ["example.com"]
}'
// Dashboard-session endpoint: send your dashboard JWT as a Bearer token
const res = await fetch(`https://api.liddie.io/api/v1/widgets/${widgetId}`, {
method: 'PUT',
headers: {
Authorization: `Bearer ${dashboardJwt}`,
'Content-Type': 'application/json',
},
body: JSON.stringify({
type: 'donation',
name: 'Homepage donate button',
amountMode: 'variable',
allowedOrigins: ['example.com'],
}),
})
Widgets
Update a widget
Fully replace a Liddie payment or donation widget configuration with PUT. Same request body as create widget, and it is a replace, not a JSON patch.
PUT
/
api
/
v1
/
widgets
/
{id}
curl -X PUT https://api.liddie.io/api/v1/widgets/<widgetId> \
--cookie "<dashboard session>" \
-H 'Content-Type: application/json' \
-d '{
"type": "donation",
"name": "Homepage donate button",
"amountMode": "variable",
"allowedOrigins": ["example.com"]
}'
// Dashboard-session endpoint: send your dashboard JWT as a Bearer token
const res = await fetch(`https://api.liddie.io/api/v1/widgets/${widgetId}`, {
method: 'PUT',
headers: {
Authorization: `Bearer ${dashboardJwt}`,
'Content-Type': 'application/json',
},
body: JSON.stringify({
type: 'donation',
name: 'Homepage donate button',
amountMode: 'variable',
allowedOrigins: ['example.com'],
}),
})
Replaces a widget’s configuration in full. PUT is a full update, not a patch — the body is identical to Create a widget, so send every field, not just the ones you’re changing.
Who can call this
Send your dashboard JWT (browser session) as a Bearer token, with team rolemerchant_admin or merchant_member plus the widgets:manage permission. Widget management is not accessible with an API key. Mutations are rate-limited to 20 requests per minute. See the Authentication guide.
Path parameters
string
required
The widget id.
Body
Identical to Create a widget, and every field below is documented there in more depth.string
required
payment or donation. Donation widgets can collect donor fields.string
required
Internal label (1–80 characters).
string
required
fixed or variable. fixed needs fixedAmount; variable lets the visitor type an amount.Optional fields
Optional fields
string | number
Required with
amountMode: fixed. Fiat amount (same semantics as payment create).string[]
Restrict which cryptos the payer may choose (max 50 entries). Empty = all of yours.
string[]
Donation forms: subset of
name, email, phone, address, comment.string[]
Donation forms: subset of
name, email, phone, address, comment that the donor must fill in.string[]
Only pages on these origins can start a checkout through this widget (max 20 entries, each max 253 characters, normalized to hostnames). Empty = any origin.
string
redirect (hosted invoice redirect, the default) or inline (embedded flow). inline requires a non-empty allowedOrigins.string
Where the payer lands after a successful payment (max 2048 characters; host must pass your
callbackDomains allowlist). PUT is a full replace: omitting it — or sending "" — clears the stored value.string
Same rules as
successUrl, for terminal non-success outcomes (expired, failed, cancelled). Omit to reuse successUrl for every outcome — but note the full-replace semantics above.object
The button designer options — same
branding.* fields as on Create a widget.boolean
Set to
false to disable the widget without deleting it. Full-replace caveat: omitting isActive re-activates a disabled widget — send false explicitly to keep one switched off.Send the complete widget body, and re-check
allowedOrigins on every update — it’s the security boundary for the public checkout (see the warning on Create a widget). Reading the current state with Get a widget first is a safe habit.Cookie-authenticated writes also need an
Origin header. Any non-GET request that carries the liddie_access session cookie is checked against the allowed dashboard origins; a bare cURL that sends only the cookie is rejected with 403 {"ok":false,"error":{"code":"CSRF_ORIGIN_MISMATCH","message":"Forbidden"}} before the handler runs. The snippet below is shown for shape — from a browser the dashboard sends the origin for you; from a script, prefer an API key where the endpoint accepts one.curl -X PUT https://api.liddie.io/api/v1/widgets/<widgetId> \
--cookie "<dashboard session>" \
-H 'Content-Type: application/json' \
-d '{
"type": "donation",
"name": "Homepage donate button",
"amountMode": "variable",
"allowedOrigins": ["example.com"]
}'
// Dashboard-session endpoint: send your dashboard JWT as a Bearer token
const res = await fetch(`https://api.liddie.io/api/v1/widgets/${widgetId}`, {
method: 'PUT',
headers: {
Authorization: `Bearer ${dashboardJwt}`,
'Content-Type': 'application/json',
},
body: JSON.stringify({
type: 'donation',
name: 'Homepage donate button',
amountMode: 'variable',
allowedOrigins: ['example.com'],
}),
})
See also
- Create a widget — the full field documentation this body follows.
- Get a widget — read the current state before a full update.
- Delete a widget — remove a widget instead of updating it.