Skip to content
neo-pays

Developers

First payment in one call.

Test keys that traverse the same code as production, built-in idempotency, signed webhooks, and a public OpenAPI specification.

Test mode

Test keys that traverse the same code as production.

sk_test_ keys take the same path as sk_live_ for your mobile money and bank-transfer collections, with no money moving.

An API key is shown once, at creation. Illustrative data.

Contract

Four rules, valid in every language.

  • Idempotency

    Send Idempotency-Key on every creation: 201 the first time, 200 when the key returns the existing operation, 409 on conflict. The key names the intended operation, not the attempt.

  • Versions

    v1 is a frozen compatibility surface; every new capability lands in v2. Each path carries its own version prefix.

  • Errors

    An error is read by its code, which is stable and made to be tested; the message is meant for a human and may change.

  • Amounts

    Amounts are strings, never floating-point numbers.

  • Corridors

    GET /v1/corridors: routing is inspectable — what you can use, what the platform will pick, what you can pin.

  • API keys

    A key is shown once, at creation. You can restrict it to a list of IP addresses.

Examples

Create a collection.

The amount is a string, the idempotency key names the intended operation — not the attempt. Your dashboard generates these snippets for every endpoint, with your account's base URL.

GET https://api.neo-pays.com/v1/corridors
Authorization: Bearer $NEOPAYS_SECRET_KEY
curl https://api.neo-pays.com/v1/payments \
  -H "Authorization: Bearer $NEOPAYS_SECRET_KEY" \
  -H "Idempotency-Key: commande-1042" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": "10000",
    "currency": "XOF",
    "platform_id": "<platform_id>",
    "merchant_reference": "commande-1042"
  }'

HTTP/1.1 201 Created

Webhooks

Signed, timestamped, redelivered.

Each delivery carries X-NeoPays-Signature: a timestamp and an HMAC-SHA256 of the raw body. Reject beyond 300 s.

  • 20 event types, up to 10 endpoints per account.
  • A test endpoint to verify your implementation.
  • A fixed egress IP address for your allow-lists; anti-SSRF guard on the platform side.
POST /webhooks/neo-pays
X-NeoPays-Signature: t=1723651200,v1=9f2c…d41a
Content-Type: application/json

v1 == HMAC-SHA256(secret, t + "." + body)
|now − t| ≤ 300 s
A webhook delivery and its attempt ladder: 60 s, 5 min, 30 min, 2 h. Illustrative data.

Reference clients

More than ten languages, no published package.

One reference client per language — about a hundred lines, no dependency, to copy into your project. A hosted embed script opens the payment in a modal on your web pages.

From your dashboard, every endpoint shows its cURL, PHP, Node.js, Python and Go snippet, generated from the endpoint's own definition.

OpenAPI

A public specification, checked against the routes.

GET /v1/openapi.json: 42 operations, checked against the route table on every build.

GET https://api.neo-pays.com/v1/openapi.json

First payment in one call.

Documentation first: guides, generated reference, webhooks. Test keys traverse the same code as production.

Read the API documentationCreate an account