Everything our tills do is available to your platform. Brands check and redeem PINs at their own checkout; resellers issue, top up and reissue them from their own apps. This post walks through how an integration comes together.
Start in test mode
Every account has separate test and live modes, each with its own API keys and data. The key you use decides the mode, against the same base URL. Test mode comes with fixed test PINs, so you can exercise every case, including errors, without real money moving. Live access is switched on once your business verification is approved.
Sign every request
Requests are signed with HMAC-SHA256 using your API secret. Each one carries your key ID, a timestamp, a random nonce and the signature in the X-Key-Id, X-Timestamp, X-Nonce and X-Signature headers. Requests more than five minutes old are rejected, so a captured request can't be replayed. You can also restrict keys to your servers' IP addresses.
Make retries safe
Networks fail, so design for retries from the start. Send an Idempotency-Key with each request and an external_reference that identifies the order on your side. If you resend after a timeout, you get the original result back instead of a second redemption.
A typical brand flow
- The customer enters their PIN at your checkout.
- You check it: the response tells you the product, the balance available and whether it can be used.
- You redeem the amount, passing your order reference and, for in-store sales, the
terminal_idof the till, so the redemption appears against that store in your reports. - You store the receipt reference with the order.
Listen for webhooks
Add a webhook URL in your dashboard and we notify your server when PINs are issued, topped up, redeemed or reissued. Each webhook is signed with your signing secret; verify the signature on the raw request body before trusting it. If your endpoint doesn't respond, we retry, and you can resend any webhook from its log.
For products that issue a new code after each use, the webhook is the only place your systems will see the new code. Save it before you respond, and treat it like a password.
Check off the UAT list, then go live
The developer section of your dashboard has guides for brand and reseller integrations, a full API reference, error codes, a UAT checklist and a Postman collection built for your account. Work through the checklist in test mode, then swap in your live keys.
