How it works
Provide merchant API Key, Secret, and PIN using HTTP request headers, or use your registered app Bearer token.
Submit amount, purpose, customer name and mobile. The server returns your 10-character transaction ID.
Poll the transaction status endpoint. A redirect or submitted TxnID is never payment confirmation.
Always use HTTPS. Store API credentials on your own backend, never inside Flutter/Android source. Never trust customer-submitted “success” states.
Authentication & API endpoints
| Method | Endpoint | Purpose |
|---|---|---|
| POST | /api/v1/payments | Create gateway payment (API-only) |
| GET | /api/v1/payments/{transaction_id} | Check verified status |
| GET | /api/v1/payments | Merchant payment history |
| POST | /api/v1/payment-links | Create payment link (API/App) |
| GET | /api/v1/payment-links | List payment links |
| GET | /api/v1/payment-links/{transaction_id} | Payment link status |
Merchant authentication headers
Accept: application/json
Content-Type: application/json
X-API-Key: YOUR_MERCHANT_API_KEY
X-API-Secret: YOUR_MERCHANT_API_SECRET
X-Merchant-Pin: YOUR_5_DIGIT_PINFor the app Bearer option, send Authorization: Bearer APP_ACCESS_TOKEN. The server determines the source (api or app) from authentication. API credentials are never sent as checkout query parameters.
POST /api/v1/payments
All four fields are required. Payment method must NOT be supplied; the customer chooses a provider on the hosted checkout page.
{
"amount": 1000,
"description": "Invoice 2508 - Website hosting",
"customer_name": "Example Customer",
"customer_mobile": "01700000000"
}Response includes transaction_id, hosted payment_url and status. The final charge and merchant net are calculated after the customer chooses a payment method. Successful settlement is only recorded after provider verification, verified sender/SMS matching, or independent manual review (depending on method mode).
POST /api/v1/payment-links
{
"amount": 1000,
"description": "Monthly service invoice",
"customer_name": "Example Customer",
"customer_mobile": "01700000000"
}Returns a secure payment_url that can be opened from web or mobile. Logged-in merchants can also create links from their Merchant Panel.
Processing & charges
Official bKash or Nagad checkout. The server verifies provider responses.
Customer sends money to the configured recipient, submits the payer mobile and provider TrxID, then an admin independently checks provider evidence before approval. The verification screen stays pending until then.
Customer submits payer mobile and TrxID. Trusted device, SIM, exact sender, success SMS, amount and TxnID must match before automated settlement.
Charge calculation follows your admin settings: percentage or fixed amount. Merchant net = Customer amount − charge. Checkout success does not automatically increase the spendable recharge wallet.