Developers

Mobile Money payments, from your code

A REST API, signed webhooks, SDKs and a test mode with test Mobile Money numbers. Here is a payment, from the request to the webhook.

Read the quickstart API reference

curl https://api.notchpay.co/payments \
  -H "Authorization: $NOTCHPAY_PUBLIC_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 25000,
    "currency": "XAF",
    "customer": { "email": "client@example.com" },
    "reference": "order_1042",
    "callback": "https://example.com/orders/1042"
  }'

Designed to be boring in production.

Clear conventions, explicit errors and test tools that behave like the real thing, so launch day is uneventful.

REST and JSON: Resource-oriented endpoints for payments, transfers, customers, beneficiaries and webhooks, with consistent JSON responses.
Test mode: Test keys and test Mobile Money numbers let you simulate successful, failed, expired and cancelled payments.
Scoped API keys: A public key to create payments, a private key to move money and a separate hash key for webhooks.
Operator pre-selection: Use locked_channel to send customers straight to MTN MoMo or Orange Money when you already know how they pay.

Check that each webhook really comes from us.

Notch Pay signs each webhook with your endpoint’s hash key using HMAC SHA-256. Compare it with the x-notch-signature header and you know the event really came from us.

Webhook security guide

import crypto from 'node:crypto'
import express from 'express'

const app = express()

app.post('/webhooks/notchpay', express.raw({ type: 'application/json' }), (req, res) => {
  const expected = crypto
    .createHmac('sha256', process.env.NOTCHPAY_HASH_KEY)
    .update(req.body)
    .digest('hex')
  const received = req.get('x-notch-signature') ?? ''

  const valid = received.length === expected.length
    && crypto.timingSafeEqual(Buffer.from(received), Buffer.from(expected))
  if (!valid) return res.sendStatus(403)

  const event = JSON.parse(req.body)
  // Handle the event, then acknowledge it
  res.sendStatus(200)
})