Business API Reference

TemboPay Business API

Accept wallet, gateway, and hosted checkout payments with environment-aware credentials, merchant-level currency control, and dashboard-managed payment gateway rules.

Production ready
POST /api/v1/initiate-payment
GET /api/v1/verify-payment/{trxId}
Sandbox Multi-currency Signed API Gateway lock
Latest Business Flow Gateways are now configured after API generation from the merchant API Config page. Checkout only shows gateways that match the merchant currency and the active receiver wallet.

Fast Hosted Checkout

Create a payment session, redirect the customer, then verify or receive IPN updates when the transaction completes.

Wallet-aware Currency

The requested currency must be enabled for the merchant and backed by an active merchant wallet.

Configurable Gateways

Merchants can choose eligible payment gateways from API Config without regenerating API credentials.

Authentication

TemboPay API uses business-generated credentials to authenticate requests. Complete KYB and receive approval before generating credentials from your business dashboard.

Environment-Aware API Integration

TemboPay API supports both sandbox (testing) and production environments. Always test in sandbox first before going live.

Environment Configuration
Sandbox Mode

Use for: Development, testing, integration

X-Environment: sandbox

Credentials: Use tp_test_* credentials generated after approval

Production Mode

Use for: Live payments, real money

X-Environment: production

Credentials: Use tp_live_* credentials generated after approval

Gateway Configuration Payment gateway selection is dashboard-managed. After generating API credentials, open Business -> Config -> Payment Gateway Controls to choose eligible gateways without changing your integration keys.
Signed requests Every API call must include X-Timestamp and X-Signature unless merchant API signatures are disabled by admin configuration.
Replay protection The timestamp must be fresh. Default tolerance is 300 seconds, configurable by admin.
Rate limit Business API calls are rate limited per business and IP. Default limit is 120 requests per minute.

Required Credentials

Credential Header Description Location
Business ID X-Merchant-Key or X-Business-Key Your unique business identifier. X-Business-Key is an accepted alias. Dashboard → Business → Config
API Key X-API-Key API authentication key Dashboard → Business → Config
Request Timestamp X-Timestamp Unix timestamp in seconds used for replay protection Generated by your server for each API request
API Signature X-Signature HMAC-SHA256 signature for the request Generated using your Client Secret
Client Secret - Used for API request signing and webhook signature verification Dashboard → Business → CONFIG
Production API Key X-API-Key Production API key (no prefix) Business dashboard > API Config > Production Mode
Production Business ID X-Merchant-Key Production business identifier (no prefix) Business dashboard > API Config > Production Mode
Security Notice Never expose your Client Secret in client-side code. Store all credentials securely on your server.
Signature Payload

When API signatures are required, sign this exact payload with your Client Secret:

timestamp.HTTP_METHOD.path_with_query.raw_body

Quick Start

First payment in about five minutes (sandbox). TemboPay uses Selcom underneath; you only integrate TemboPay. Live collecting requires KYB approval and Selcom-whitelisted HTTPS URLs.

5-minute sandbox path Register → create business profile → Generate sandbox API → POST /api/v1/payments with X-Environment: sandbox → listen for signed webhooks. Complete KYB before switching to live keys.
01

Register

Create a business account and business profile. Sandbox API keys are available before KYB approval.

02

Generate sandbox API

Open Dashboard → Business → API Config and generate sandbox Business ID, API Key, and API Secret.

03

Create a payment

POST /api/v1/payments with HMAC headers and X-Environment: sandbox. Redirect the customer to the returned checkout URL or trigger USSD push.

04

Go live & payout

Complete KYB, generate live keys, whitelist your redirect/cancel/webhook domains with Selcom, then collect. After settlement, POST /api/v1/payouts to your MSISDN.

Register Sandbox keys POST /payments Webhook KYB → Live
Open Testing Console

Prefer payment links for events and no-code collecting — same Selcom rails, no HMAC required for guests.

Latest Business Update API Config controls checkout after keys are generated

Business setup & API config

The merchant API is no longer a single-currency, fixed-gateway flow. A merchant can now support multiple currency rails, keep separate sandbox and production credentials, and choose eligible gateways from the API Config page without regenerating API keys.

Business dashboard

One integration, dashboard-controlled checkout

Your code sends amount, currency, redirects, IPN URL, and optional gateway keywords. The dashboard decides which currency rails, wallets, and payment gateways are actually available for that merchant.

Sandbox keys Production keys Wallet rails Gateway controls
Default mode Sandbox
Live access Requires approval
Gateway source API Config

Business review status

Pending merchants can test in sandbox. Production API access and live checkout are available only after admin approval.

Currency Rails

Each request currency_code must exist in the merchant-supported currency list. Unsupported currencies are rejected before checkout opens.

Receiver Wallet Match

The merchant owner must have an active wallet for the requested currency, otherwise the API returns a wallet availability error.

Payment Gateway Controls

Only active automatic gateways that match the requested currency and merchant selection can appear on hosted checkout.

Runtime Decision Order

  1. 01
    Authenticate the environment

    X-Environment decides which merchant key, API key, and API secret are used.

  2. 02
    Check merchant availability

    Rejected or disabled merchants are blocked. Production also requires approved business status.

  3. 03
    Validate requested currency

    currency_code must match a merchant-supported rail such as USD, EUR, or BDT.

  4. 04
    Confirm receiver wallet

    The merchant owner needs an active wallet for that same currency.

  5. 05
    Resolve configured gateways

    Business API Config selections restrict checkout to the chosen eligible gateways. If none are selected, the safe fallback is all active automatic gateways for that currency.

  6. 06
    Apply optional API filter

    allow_payment_methods can narrow the available gateway list, but it cannot expose an unconfigured or wrong-currency gateway.

Real Cases & Results

Case API Result Fix
Merchant supports USD and EUR, but only USD wallet exists. 422 Receiver wallet for this currency is not available. Create/activate the EUR merchant wallet before accepting EUR checkout.
Stripe USD is selected, but the request sends currency_code EUR. Stripe USD will not appear on checkout. Select an active EUR gateway or send USD.
Merchant has not selected any gateway yet. Checkout falls back to all active automatic gateways that match the requested currency. Use API Config to lock checkout to preferred gateways.
allow_payment_methods=["paypal"] but PayPal is not configured for the merchant. PayPal remains hidden. Enable PayPal from Payment Gateway Controls if its currency matches.
Pending merchant calls production API. 403 Merchant Pending Approval Use sandbox until admin approval is complete.
No cross-currency gateways

A gateway configured for USD cannot process EUR checkout unless a separate EUR gateway exists.

Secrets stay server-side

API Secret is used only to sign server-to-server API requests and verify IPN signatures.

Signed checkout URL expires

The returned payment_url is time-limited. Create a new payment session for expired checkout links.

Verify is merchant scoped

A merchant can verify only its own transaction and only in the matching sandbox or production environment.

Currency & Gateway Rules

Merchant API checkout is controlled by three layers: merchant-supported currency, active receiver wallet, and configured payment gateways. This keeps checkout options accurate after API credentials are generated.

Gateway Match Matrix

A gateway appears on hosted checkout only when every rule below is true. If the merchant has selected gateways, those selected gateways become the allowed set for checkout.

Dashboard Source Merchant -> Config -> Payment Gateway Controls
Currency enabled for merchant The request currency_code must exist in the merchant-supported currency list.
Active merchant wallet exists The merchant owner must have an active wallet for the requested currency.
Gateway currency matches Only active automatic deposit methods for that exact currency are eligible.
Merchant gateway selection passes When gateways are selected in API Config, checkout is restricted to those selected methods.

How allow_payment_methods Works Now

Layer Who controls it Effect
currency_code API request Must match a merchant-supported currency with an active receiver wallet.
Payment Gateway Controls Merchant dashboard Defines the gateway set available to hosted checkout for each eligible currency.
allow_payment_methods API request Optional name/code keyword filter applied after merchant gateway rules. It cannot expose a gateway the merchant did not configure.
Safe Default If a merchant has not selected any gateways, checkout falls back to all active automatic gateways that match the requested currency. Once the merchant selects gateways, checkout uses only that configured list.

PSP API Overview

TemboPay is the business-facing payment provider. You integrate TemboPay APIs; Selcom runs underneath as the rail and is never exposed to your customers or credentials.

OpenAPI Machine-readable spec: https://tembopay.africa/api/v1/openapi.json
Method Path Purpose
POST /api/v1/payments Create payment (hosted checkout or USSD push)
GET /api/v1/payments List payments (paginated)
GET /api/v1/payments/{trx_id} Get payment status
POST /api/v1/payments/{trx_id}/push Trigger mobile money USSD push
GET /api/v1/balance Business wallet balance
POST /api/v1/billing/plans Create billing plan
POST /api/v1/billing/subscriptions Create subscription with consent
GET /api/v1/billing/invoices List billing invoices

All endpoints require HMAC headers (X-API-Key, X-Merchant-Key, X-Timestamp, X-Signature, X-Environment). Optional Idempotency-Key on create (max 64 chars, 24h).

POST

Create Payment

Create a payment intent. Returns trx_id plus checkout_url (hosted) or initiates USSD push when payment_mode=push.

https://tembopay.africa/api/v1/payments

Body highlights

FieldNotes
payment_amountRequired. Amount in currency units (e.g. TZS).
currency_codeRequired. Must be enabled for the merchant.
ref_trxRequired. Your order reference (merchant_ref).
webhook_url / ipn_urlOptional if default webhook URL is set on Business API Config. Production requires HTTPS.
payment_modehosted (default) or push
customer_phoneRequired when payment_mode=push (MSISDN, e.g. 2557…).
success_redirect / cancel_redirectOptional; defaults to site URL.

Success response

{
  "status": "success",
  "data": {
    "trx_id": "TXN…",
    "merchant_ref": "ORD-123",
    "amount": 5000,
    "currency": "TZS",
    "status": "pending",
    "checkout_url": "https://…",
    "expires_at": "…",
    "environment": "sandbox"
  },
  "payment_url": "https://…",
  "trx_id": "TXN…"
}
GET

List Payments

Paginated merchant payments for the authenticated environment.

https://tembopay.africa/api/v1/payments?limit=20&offset=0

Query: limit, offset, status, merchant_ref

GET

Get Payment

Fetch a single payment by TemboPay trx_id.

https://tembopay.africa/api/v1/payments/{trx_id}
POST

USSD Push

Trigger mobile money USSD for a pending payment. Sandbox simulates the push without calling Selcom.

https://tembopay.africa/api/v1/payments/{trx_id}/push

Body: {"customer_phone":"2557XXXXXXXX"} (optional if already set on create)

GET

Balance

Available wallet balances for merchant-supported currencies.

https://tembopay.africa/api/v1/balance
POST

Initiate Payment (legacy)

Alias of POST /api/v1/payments. Prefer /payments for new integrations. Returns trx_id and checkout_url in data, plus legacy payment_url.

https://tembopay.africa/api/v1/initiate-payment
API key required HMAC signature required Sandbox + production Currency wallet checked
Gateway Selection Hosted checkout first applies merchant currency and wallet rules, then the gateways selected on Business API Config. allow_payment_methods is only an optional extra filter.

Request Headers

Header Value Required Description
Content-Type application/json Yes Request content type
Accept application/json Yes Expected response type
X-Environment sandbox | production Yes Use sandbox for testing and production for live payments
X-Merchant-Key {merchant_key} Yes Merchant identifier from the API Config page
X-API-Key {api_key} Yes API key for the selected environment
X-Timestamp {unix_timestamp} Yes Current Unix timestamp in seconds. Requests outside the allowed tolerance are rejected.
X-Signature sha256={hmac} Yes HMAC-SHA256 of timestamp.METHOD.path_with_query.raw_body using the API Secret for the selected environment.

Request Parameters

Parameter Type Required Description
payment_amount number Yes Payment amount. Minimum value is 1.00.
currency_code string Yes 3-letter currency code. Must be enabled for the merchant and backed by an active merchant wallet.
ref_trx string Yes Your unique order or transaction reference. Max 60 characters.
success_redirect url Yes Customer is redirected here after a successful hosted checkout.
cancel_redirect url Yes Customer is redirected here when checkout is canceled or cannot continue.
ipn_url url Yes Server-to-server webhook URL for payment status updates.
description string No Payment description visible in merchant transaction context.
customer_name string No Customer name. Max 100 characters.
customer_email email No Customer email address. Max 100 characters.
allow_payment_methods string | array No Optional keyword filter applied after merchant gateway rules. Example: "stripe,paypal" or ["stripe","paypal"].

Gateway Availability Response Fields

Field Type Meaning
info.merchant_payment_methods_restricted boolean true when the merchant has selected specific gateways in API Config.
info.merchant_payment_method_ids array Eligible deposit method IDs for the requested currency.
info.merchant_payment_method_codes array Eligible method codes that can appear on hosted checkout.

Code Examples

curl -X POST "https://tembopay.africa/api/v1/initiate-payment" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -H "X-Environment: sandbox" \
  -H "X-Merchant-Key: test_merchant_key" \
  -H "X-API-Key: test_api_key" \
  -H "X-Timestamp: 1778650000" \
  -H "X-Signature: sha256=generated_hmac_signature" \
  -d '{
    "payment_amount": 250.00,
    "currency_code": "USD",
    "ref_trx": "ORDER_12345",
    "description": "Premium Subscription",
    "success_redirect": "https://merchant.example/payments/success",
    "cancel_redirect": "https://merchant.example/payments/cancel",
    "ipn_url": "https://merchant.example/webhooks/tembopay",
    "customer_name": "John Doe",
    "customer_email": "john@example.com",
    "allow_payment_methods": ["stripe", "paypal"]
  }'
<?php

use Illuminate\Support\Facades\Http;

$payload = [
    'payment_amount' => 250.00,
    'currency_code' => 'USD',
    'ref_trx' => 'ORDER_12345',
    'description' => 'Premium Subscription',
    'success_redirect' => route('payments.success'),
    'cancel_redirect' => route('payments.cancel'),
    'ipn_url' => route('webhooks.tembopay'),
    'customer_name' => 'John Doe',
    'customer_email' => 'john@example.com',
    'allow_payment_methods' => ['stripe', 'paypal'],
];

$body = json_encode($payload, JSON_THROW_ON_ERROR);
$timestamp = (string) time();
$path = '/api/v1/initiate-payment';
$signature = hash_hmac(
    'sha256',
    $timestamp.'.POST.'.$path.'.'.$body,
    config('services.tembopay.api_secret')
);

$response = Http::withHeaders([
    'Content-Type' => 'application/json',
    'Accept' => 'application/json',
    'X-Environment' => 'sandbox',
    'X-Merchant-Key' => config('services.tembopay.merchant_key'),
    'X-API-Key' => config('services.tembopay.api_key'),
    'X-Timestamp' => $timestamp,
    'X-Signature' => 'sha256='.$signature,
])->withBody($body, 'application/json')
    ->post('https://tembopay.africa/api/v1/initiate-payment')
    ->throw()
    ->json();

return redirect()->away($response['payment_url']);
const crypto = require('crypto');

const payload = {
  payment_amount: 250.00,
  currency_code: 'USD',
  ref_trx: 'ORDER_12345',
  description: 'Premium Subscription',
  success_redirect: 'https://merchant.example/payments/success',
  cancel_redirect: 'https://merchant.example/payments/cancel',
  ipn_url: 'https://merchant.example/webhooks/tembopay',
  customer_name: 'John Doe',
  customer_email: 'john@example.com',
  allow_payment_methods: ['stripe', 'paypal']
};

const body = JSON.stringify(payload);
const timestamp = Math.floor(Date.now() / 1000).toString();
const path = '/api/v1/initiate-payment';
const signature = crypto
  .createHmac('sha256', process.env.TEMBOPAY_API_SECRET)
  .update(`${timestamp}.POST.${path}.${body}`)
  .digest('hex');

const response = await fetch('https://tembopay.africa/api/v1/initiate-payment', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Accept': 'application/json',
    'X-Environment': 'sandbox',
    'X-Merchant-Key': process.env.TEMBOPAY_MERCHANT_KEY,
    'X-API-Key': process.env.TEMBOPAY_API_KEY,
    'X-Timestamp': timestamp,
    'X-Signature': `sha256=${signature}`
  },
  body
});

const data = await response.json();

if (!response.ok) {
  throw new Error(data.error || 'Payment initiation failed');
}

window.location.href = data.payment_url;

Success Response

200 OK Payment session created
{
  "payment_url": "https://TemboPay.test/payment/checkout?token=encrypted&signature=signed",
  "info": {
    "ref_trx": "ORDER_12345",
    "description": "Premium Subscription",
    "ipn_url": "https://merchant.example/webhooks/tembopay",
    "cancel_redirect": "https://merchant.example/payments/cancel",
    "success_redirect": "https://merchant.example/payments/success",
    "customer_name": "John Doe",
    "customer_email": "john@example.com",
    "merchant_id": 1,
    "merchant_name": "Demo Store",
    "amount": 250,
    "currency_code": "USD",
    "environment": "sandbox",
    "is_sandbox": true,
    "allow_payment_methods": ["stripe", "paypal"],
    "merchant_payment_methods_restricted": true,
    "merchant_payment_method_ids": [7],
    "merchant_payment_method_codes": ["stripe-usd"]
  }
}

Common Error Responses

422 Currency is not enabled for this merchant.

The requested currency_code is not in the merchant-supported currency list.

422 Receiver wallet for this currency is not available.

The merchant owner does not have an active wallet for the requested currency.

401 Invalid API credentials.

Check X-Environment, X-Merchant-Key, and X-API-Key for the same environment.

GET

Verify Payment

Fetch the latest status for a hosted checkout transaction. Always verify server-side before fulfilling an order.

https://tembopay.africa/api/v1/verify-payment/{trxId}
Use after redirect or IPN Business scoped

Request Headers

Header Value Required Description
Accept application/json Yes Expected response type
X-Environment sandbox | production Yes Must match the environment used to initiate the payment
X-Merchant-Key {merchant_key} Yes Merchant identifier from API Config
X-API-Key {api_key} Yes API key for the selected environment
X-Timestamp {unix_timestamp} Yes Use the same timestamp format as payment initiation.
X-Signature sha256={hmac} Yes Sign timestamp.GET./api/v1/verify-payment/{trxId}. using the matching API Secret. The raw body is empty for GET requests.

Path Parameter

Parameter Type Required Description
trxId string Yes TemboPay transaction ID returned by hosted checkout or IPN.

cURL Example

curl -X GET "https://tembopay.africa/api/v1/verify-payment/TXNQ5V8K2L9N3XM1" \
  -H "Accept: application/json" \
  -H "X-Environment: sandbox" \
  -H "X-Merchant-Key: test_merchant_key" \
  -H "X-API-Key: test_api_key" \
  -H "X-Timestamp: 1778650000" \
  -H "X-Signature: sha256=generated_hmac_signature"

Success Response

200 OK Completed payment
{
  "status": "success",
  "trx_id": "TXNQ5V8K2L9N3XM1",
  "amount": 237.5,
  "fee": 12.5,
  "currency": "USD",
  "net_amount": 237.5,
  "customer": {
    "name": "John Doe",
    "email": "john@example.com"
  },
  "description": "Premium Subscription",
  "created_at": "2026-05-13T10:30:00.000000Z",
  "updated_at": "2026-05-13T10:35:45.000000Z"
}

Payment Status Values

Status Description Recommended Action
pending Payment is still processing. Wait for IPN or verify again later.
success Payment completed successfully. Fulfill the order after idempotency checks.
failed Payment failed or was canceled. Do not fulfill; show retry or cancel state.
Idempotency Use your ref_trx and the returned trx_id to make fulfillment idempotent. A webhook and a verify request may arrive close together.
GET

Site Info

Fetch gateway branding, environment labels, and customer-facing checkout metadata for a merchant-authenticated integration.

https://tembopay.africa/api/v1/site-info
Merchant auth required Checkout branding Environment labels

cURL Example

curl -X GET "https://tembopay.africa/api/v1/site-info" \
  -H "Accept: application/json" \
  -H "X-Environment: sandbox" \
  -H "X-Merchant-Key: test_merchant_key" \
  -H "X-API-Key: test_api_key" \
  -H "X-Timestamp: 1778650000" \
  -H "X-Signature: sha256=generated_hmac_signature"

Success Response

200 OK Gateway metadata
{
  "site_name": "TemboPay",
  "site_logo": "https://tembopay.africa/general/static/logo/tembopay-mark.svg",
  "site_url": "https://tembopay.africa",
  "gateway_name": "TemboPay Payment Gateway",
  "gateway_description": "Secure payment powered by TemboPay",
  "features": {
    "ssl_secured": "SSL Secured",
    "instant_processing": "Instant",
    "global_support": "Global",
    "mobile_ready": "Mobile Ready"
  },
  "environments": {
    "production": "Production Mode - Live payment processing is active",
    "sandbox": "Test Mode - This is a test transaction. No real money will be charged"
  },
  "api_version": "1.0",
  "status": "active"
}

Payouts

Approved businesses can disburse settled balance to the KYB settlement MSISDN over Selcom. Use TemboPay Business API keys only — Selcom platform credentials stay on TemboPay servers.

Gates KYB approved + business approved + settlement MSISDN required. Idempotency-Key prevents double-send. INPROGRESS / AMBIGUOUS responses are never retried automatically.
Method Endpoint Description
POST /api/v1/payouts/preview Fee preview (amount, fee, payable_amount)
POST /api/v1/payouts Create payout. Optional Idempotency-Key header (max 64 chars).
GET /api/v1/payouts List payouts for the business
GET /api/v1/payouts/{id} Fetch a single payout by UUID

Create payout body

{
  "amount": 10000,
  "destination": "2557XXXXXXXX"
}

destination is optional and must match the approved settlement MSISDN when supplied.

Example

curl -X POST "https://tembopay.africa/api/v1/payouts" \
  -H "X-API-Key: tp_test_..." \
  -H "X-Business-Key: tp_test_merchant_..." \
  -H "X-Environment: sandbox" \
  -H "X-Timestamp: $(date +%s)" \
  -H "X-Signature: ..." \
  -H "Idempotency-Key: payout-order-42" \
  -H "Content-Type: application/json" \
  -d '{"amount":10000}'

Billing & Autopay (Consent-First)

Recurring mobile money charges require explicit customer consent. Each charge uses Selcom Request-to-Pay (USSD push) — the customer must approve with their PIN. Silent debit is not supported on Track A.

Method Path Purpose
POST /api/v1/billing/plans Create a recurring billing plan
POST /api/v1/billing/subscriptions Create subscription with recorded consent + first USSD push
GET /api/v1/billing/invoices List invoices (optional ?subscription=sub_… filter)

Subscription create body

FieldNotes
plan_codeRequired. Plan code from create plan.
customer_phoneRequired. Tanzania MSISDN for USSD push.
terms_shownRequired. Exact recurring billing terms shown to the customer.
webhook_urlOptional override for subscription/invoice events.

Billing Webhooks

In addition to payment.completed / payment.failed, TemboPay emits:

EventWhen
subscription.createdSubscription created after consent recorded
subscription.cancelledSubscription cancelled
subscription.suspendedMax dunning failures reached
invoice.createdNew billing invoice opened
invoice.paidInvoice settled via USSD push
invoice.payment_failedCharge attempt failed; dunning schedule applies

Webhooks

TemboPay sends signed HTTP POSTs to your webhook URL when a payment completes or fails. Configure a default URL and signing secret on Business API Config, or pass webhook_url / ipn_url per payment.

Verify every delivery Signature = hex(HMAC-SHA256(webhook_secret, "{timestamp}.{raw_body}")). Reject if timestamp is older than 5 minutes.

Events

Event When
payment.completed Payment settled successfully
payment.failed Payment failed or canceled
subscription.* / invoice.* Billing autopay lifecycle (see Billing Webhooks section)

Headers

Header Description
X-TemboPay-Event Event type, e.g. payment.completed
X-TemboPay-Timestamp Unix timestamp used in the signature
X-TemboPay-Signature HMAC-SHA256 hex digest
X-Environment sandbox | production

Payload

{
  "id": "evt_…",
  "type": "payment.completed",
  "api_version": "2026-07-18",
  "created_at": "2026-07-18T12:00:00+00:00",
  "data": {
    "trx_id": "TXN…",
    "merchant_ref": "ORD-123",
    "status": "completed",
    "amount": { "value": 5000, "currency": "TZS" },
    "settlement": {
      "gross": { "value": 5000, "currency": "TZS" },
      "fees": { "value": 50, "currency": "TZS" },
      "net": { "value": 4950, "currency": "TZS" }
    },
    "customer": { "name": "Jane", "email": "jane@example.com", "phone": "2557…" },
    "environment": "sandbox"
  }
}

PHP verification

$timestamp = $request->header('X-TemboPay-Timestamp');
$signature = $request->header('X-TemboPay-Signature');
$raw = $request->getContent();
$expected = hash_hmac('sha256', $timestamp.'.'.$raw, $webhookSecret);
if (!hash_equals($expected, $signature)) {
    abort(401);
}
// Return 2xx quickly; process asynchronously.

Retries

Failed deliveries retry with backoff (immediate, then 3 / 6 / 12 / 24 minutes) up to 5 attempts, then abandoned. Handle duplicates using the event id.

Integration Examples

Production-oriented integration examples for popular platforms and frameworks. Keep gateway selection in Business API Config, then sign each API request from your server.

Environment Configuration: Replace {environment} with sandbox or production, and use corresponding credentials - test_ prefix for sandbox, no prefix for production in your configuration files.
Latest Checkout Rules The requested currency must match the business setup and active wallet. Gateway visibility is controlled from Business API Config; allow_payment_methods only narrows the already eligible gateway list.
Signature Required Examples should include X-Timestamp and X-Signature generated with the API Secret for the selected sandbox or production environment. See Authentication for the exact signature payload.
<?php
// Laravel Integration Service
namespace App\Services;

use Illuminate\Support\Facades\Http;
use Exception;

class TemboPayService
{
    private string $baseUrl;
    private string $merchantKey;
    private string $apiKey;
    private string $environment;

    public function __construct()
    {
        $this->baseUrl = config('tembopay.base_url');
        $this->merchantKey = config('tembopay.merchant_key');
        $this->apiKey = config('tembopay.api_key');
        $this->environment = config('tembopay.environment'); // 'sandbox' or 'production'
    }

    public function initiatePayment(array $paymentData): array
    {
        try {
            $response = Http::withHeaders([
                'Content-Type' => 'application/json',
                'X-Environment' => $this->environment,
                'X-Merchant-Key' => $this->merchantKey,
                'X-API-Key' => $this->apiKey,
            ])->post("{$this->baseUrl}/api/v1/initiate-payment", $paymentData);

            if ($response->successful()) {
                return $response->json();
            }

            throw new Exception('TemboPay API Error: Payment initiation failed');
        } catch (Exception $e) {
            throw new Exception('TemboPay API Error: ' . $e->getMessage());
        }
    }

    public function verifyPayment(string $transactionId): array
    {
        try {
            $response = Http::withHeaders([
                'Accept' => 'application/json',
                'X-Environment' => $this->environment,
                'X-Merchant-Key' => $this->merchantKey,
                'X-API-Key' => $this->apiKey,
            ])->get("{$this->baseUrl}/api/v1/verify-payment/{$transactionId}");

            if ($response->successful()) {
                return $response->json();
            }

            throw new Exception('TemboPay API Error: Payment verification failed');
        } catch (Exception $e) {
            throw new Exception('TemboPay API Error: ' . $e->getMessage());
        }
    }
}

// Configuration (config/tembopay.php)
return [
    'base_url' => env('TEMBOPAY_BASE_URL', 'https://tembopay.africa'),
    'environment' => env('TEMBOPAY_ENVIRONMENT', 'sandbox'), // sandbox or production
    'merchant_key' => env('TEMBOPAY_MERCHANT_KEY'), // Use appropriate prefix
    'api_key' => env('TEMBOPAY_API_KEY'), // Use appropriate prefix
];

// Usage in Controller
class PaymentController extends Controller
{
    public function initiatePayment(Request $request, TemboPayService $tembopay)
    {
        $paymentData = [
            'payment_amount' => $request->amount,
            'currency_code' => 'USD',
            'ref_trx' => 'ORDER_' . time(),
            'description' => $request->description,
            'success_redirect' => route('payment.success'),
            'cancel_redirect' => route('payment.cancelled'),
            'ipn_url' => route('webhooks.tembopay'),
            'allow_payment_methods' => ['stripe', 'paypal'],
        ];

        try {
            $result = $tembopay->initiatePayment($paymentData);
            return redirect($result['payment_url']);
        } catch (Exception $e) {
            return back()->withErrors(['error' => $e->getMessage()]);
        }
    }
}
// Node.js Integration Service
const axios = require('axios');

class TemboPayService {
    constructor() {
        this.baseUrl = process.env.TEMBOPAY_BASE_URL || 'https://tembopay.africa';
        this.environment = process.env.TEMBOPAY_ENVIRONMENT || 'sandbox'; // sandbox or production
        this.merchantKey = process.env.TEMBOPAY_MERCHANT_KEY; // Use appropriate prefix
        this.apiKey = process.env.TEMBOPAY_API_KEY; // Use appropriate prefix
    }

    async initiatePayment(paymentData) {
        try {
            const response = await axios.post(`${this.baseUrl}/api/v1/initiate-payment`, paymentData, {
                headers: {
                    'Content-Type': 'application/json',
                    'X-Environment': this.environment,
                    'X-Merchant-Key': this.merchantKey,
                    'X-API-Key': this.apiKey
                }
            });

            return response.data;
        } catch (error) {
            throw new Error(`TemboPay API Error: ${error.message}`);
        }
    }

    async verifyPayment(transactionId) {
        try {
            const response = await axios.get(`${this.baseUrl}/api/v1/verify-payment/${transactionId}`, {
                headers: {
                    'Accept': 'application/json',
                    'X-Environment': this.environment,
                    'X-Merchant-Key': this.merchantKey,
                    'X-API-Key': this.apiKey
                }
            });

            return response.data;
        } catch (error) {
            throw new Error(`TemboPay API Error: ${error.message}`);
        }
    }
}

// Express.js Route Example
const express = require('express');
const app = express();
const tembopay = new TemboPayService();

app.post('/initiate-payment', async (req, res) => {
    const paymentData = {
        payment_amount: req.body.amount,
        currency_code: 'USD',
        ref_trx: `ORDER_${Date.now()}`,
        description: req.body.description,
        success_redirect: `${req.protocol}://${req.get('host')}/payment/success`,
        cancel_redirect: `${req.protocol}://${req.get('host')}/payment/cancelled`,
        ipn_url: `${req.protocol}://${req.get('host')}/webhooks/tembopay`,
        allow_payment_methods: ['stripe', 'paypal'],
    };

    try {
        const result = await tembopay.initiatePayment(paymentData);
        res.redirect(result.payment_url);
    } catch (error) {
        res.status(500).json({ error: error.message });
    }
});

module.exports = TemboPayService;
# Python/Django Integration Service
import os
import requests
from django.conf import settings

class TemboPayService:
    def __init__(self):
        self.base_url = getattr(settings, 'TEMBOPAY_BASE_URL', 'https://tembopay.africa')
        self.environment = getattr(settings, 'TEMBOPAY_ENVIRONMENT', 'sandbox')  # sandbox or production
        self.merchant_key = getattr(settings, 'TEMBOPAY_MERCHANT_KEY')  # Use appropriate prefix
        self.api_key = getattr(settings, 'TEMBOPAY_API_KEY')  # Use appropriate prefix

    def initiate_payment(self, payment_data):
        try:
            headers = {
                'Content-Type': 'application/json',
                'X-Environment': self.environment,
                'X-Merchant-Key': self.merchant_key,
                'X-API-Key': self.api_key
            }

            response = requests.post(
                f"{self.base_url}/api/v1/initiate-payment",
                headers=headers,
                json=payment_data,
                timeout=30
            )

            response.raise_for_status()
            return response.json()

        except requests.RequestException as e:
            raise Exception(f'TemboPay API Error: {str(e)}')

    def verify_payment(self, transaction_id):
        try:
            headers = {
                'Accept': 'application/json',
                'X-Environment': self.environment,
                'X-Merchant-Key': self.merchant_key,
                'X-API-Key': self.api_key
            }

            response = requests.get(
                f"{self.base_url}/api/v1/verify-payment/{transaction_id}",
                headers=headers,
                timeout=30
            )

            response.raise_for_status()
            return response.json()

        except requests.RequestException as e:
            raise Exception(f'TemboPay API Error: {str(e)}')

# Django Settings Configuration
TEMBOPAY_BASE_URL = 'https://tembopay.africa'
TEMBOPAY_ENVIRONMENT = 'sandbox'  # Change to 'production' for live
TEMBOPAY_MERCHANT_KEY = os.environ.get('TEMBOPAY_MERCHANT_KEY')  # Use appropriate prefix
TEMBOPAY_API_KEY = os.environ.get('TEMBOPAY_API_KEY')  # Use appropriate prefix

# Django View Example
from django.shortcuts import redirect
from django.http import JsonResponse
from django.views.decorators.csrf import csrf_exempt
import json

tembopay = TemboPayService()

@csrf_exempt
def initiate_payment(request):
    if request.method == 'POST':
        data = json.loads(request.body)
        
        payment_data = {
            'payment_amount': data['amount'],
            'currency_code': 'USD',
            'ref_trx': f'ORDER_{int(time.time())}',
            'description': data['description'],
            'success_redirect': request.build_absolute_uri('/payment/success/'),
            'cancel_redirect': request.build_absolute_uri('/payment/cancelled/'),
            'ipn_url': request.build_absolute_uri('/webhooks/tembopay/'),
            'allow_payment_methods': ['stripe', 'paypal'],
        }

        try:
            result = tembopay.initiate_payment(payment_data)
            return redirect(result['payment_url'])
        except Exception as e:
            return JsonResponse({'error': str(e)}, status=500)
# Environment Variables Setup
export TEMBOPAY_ENVIRONMENT="sandbox"  # or "production"
export TEMBOPAY_MERCHANT_KEY="test_merchant_your_key"  # or "merchant_your_key" for production
export TEMBOPAY_API_KEY="test_your_api_key"  # or "your_api_key" for production

# Initiate Payment
curl -X POST "https://tembopay.africa/api/v1/initiate-payment" \
  -H "Content-Type: application/json" \
  -H "X-Environment: $TEMBOPAY_ENVIRONMENT" \
  -H "X-Merchant-Key: $TEMBOPAY_MERCHANT_KEY" \
  -H "X-API-Key: $TEMBOPAY_API_KEY" \
  -d '{
    "payment_amount": 250.00,
    "currency_code": "USD",
    "ref_trx": "ORDER_12345",
    "description": "Premium Subscription",
    "success_redirect": "https://yoursite.com/payment/success",
    "cancel_redirect": "https://yoursite.com/payment/cancelled",
    "ipn_url": "https://yoursite.com/api/webhooks/tembopay",
    "allow_payment_methods": ["stripe", "paypal"]
  }'

# Verify Payment
curl -X GET "https://tembopay.africa/api/v1/verify-payment/TXNQ5V8K2L9N3XM1" \
  -H "Accept: application/json" \
  -H "X-Environment: $TEMBOPAY_ENVIRONMENT" \
  -H "X-Merchant-Key: $TEMBOPAY_MERCHANT_KEY" \
  -H "X-API-Key: $TEMBOPAY_API_KEY"

# Environment-specific credential examples:
# Sandbox: test_merchant_xxxxx, test_api_key_xxxxx
# Production: merchant_xxxxx, api_key_xxxxx

WooCommerce Integration

Advanced TemboPay payment gateway with modern WooCommerce Blocks support, dynamic branding, and enterprise-grade security features.

Advanced WooCommerce Integration

Production-ready payment gateway with WooCommerce Blocks (Gutenberg) support, dynamic branding, and secure webhook processing.

3 Minutes Setup
99.9% Uptime
24/7 Webhook Support
Latest Plugin Download

Enterprise-grade WooCommerce payment gateway with modern Blocks support and dynamic branding.

Plugin Size: 45.2 KB
Version: 2.8.0
Last Updated: Sep 10, 2026
System Requirements
  • WordPress 5.8+
  • WooCommerce 6.0+
  • PHP 8.1+ (8.2+ Recommended)
  • SSL Certificate (Required)
  • TemboPay Merchant Account
  • WooCommerce Blocks Support
Production Ready

Advanced Features

Enterprise-grade payment processing with modern architecture

WooCommerce Blocks

Full Gutenberg checkout compatibility with React-based UI

Dynamic Branding

Auto-fetch logo, colors, and branding from TemboPay API

Secure Webhooks

HMAC-SHA256 signature verification for payment callbacks

Compact Mobile UI

Space-efficient, responsive design for all devices

Advanced Security

Multi-header authentication with environment isolation

Test/Live Mode

Seamless sandbox testing with production deployment

Quick Installation Guide

Get started with TemboPay WooCommerce integration in minutes

1
Download Latest Plugin

Download TemboPay WooCommerce Gateway v2.8.0 from the download section above. This includes all latest features and security updates.

2
Install via WordPress Admin

Navigate to Plugins → Add New → Upload Plugin and select the downloaded ZIP file. The plugin will auto-extract and install.

3
Activate & Configure

Activate the plugin and go to WooCommerce → Settings → Payments → TemboPay. Enter your API credentials and webhook secret.

4
Test Integration

Enable Test Mode, process a sandbox transaction to verify Blocks checkout, webhook delivery, and order completion.

5
Go Live

Disable test mode, ensure production API keys are configured, and start accepting real payments with full webhook processing.

API Configuration

Essential API settings for secure payment processing

API Base URL

https://tembopay.africa

Auto-configured
Merchant ID & API Key

Your unique merchant credentials from TemboPay dashboard

Required
Webhook Secret

HMAC-SHA256 signature verification for secure callbacks

Recommended
Authentication Headers

Required headers for all TemboPay API requests:

X-Environment: sandbox|production
X-Merchant-Key: your_merchant_id
X-API-Key: your_api_key
Content-Type: application/json

Webhook Configuration

Real-time payment status updates and order processing

Webhook Endpoint
https://yoursite.com/wc-api/tembopay_webhook

Configure this URL in your TemboPay merchant dashboard for automatic order updates.

Supported Events
  • Payment Success
  • Payment Failed
  • Payment Cancelled
  • Payment Pending
  • Refund Processed
  • Payment Timeout

WooCommerce Blocks Integration

Modern Gutenberg checkout with React-based payment UI

Responsive Design

Compact, mobile-optimized payment interface that adapts to any screen size.

Dynamic Branding

Automatically fetches and displays your TemboPay branding and logos.

Security Indicators

Clear SSL and security badges to build customer trust during checkout.

Test Mode Support

Clear sandbox indicators for testing without affecting live transactions.

Production Deployment Checklist

Ensure everything is configured correctly before going live

Technical Requirements
API Configuration
Final Verification

Troubleshooting

Common issues and solutions for TemboPay WooCommerce integration

Payment method not showing in checkout

Solutions:

  • Verify plugin is activated and enabled in WooCommerce → Settings → Payments
  • Clear browser cache and WooCommerce cache
  • Check if API credentials are correctly configured
  • Ensure SSL certificate is properly installed
401 Unauthorized API errors

Solutions:

  • Verify Merchant ID and API Key are correct
  • Ensure environment (sandbox/production) matches your credentials
  • Check that all required headers are being sent
  • Contact TemboPay support to verify account status
Orders not updating after payment

Solutions:

  • Verify webhook URL is configured in TemboPay dashboard
  • Check webhook secret key matches plugin configuration
  • Review WordPress error logs for webhook processing errors
  • Test webhook delivery using TemboPay dashboard tools
Release Readiness Sandbox first, production after approval

Sandbox & Go Live Checklist

Use this checklist before moving from test payments to live checkout. The same API routes work in both modes; only the environment header and credential set change.

Sandbox

Use test credentials and X-Environment: sandbox. Transactions are marked as sandbox and do not represent real money movement. Sandbox keys can be generated before KYB approval.

  • Create a business profile, then generate test Business ID, API Key, and API Secret (no KYB wait).
  • Send signed API requests with the sandbox secret.
  • Test success, cancel, pending, failed, webhook, and verify flows.

Production

Use live credentials and X-Environment: production only after admin approval, wallet readiness, and gateway configuration are complete.

  • Merchant status must be approved.
  • Every live currency must have an active merchant wallet.
  • Payment Gateway Controls should contain only gateways you want customers to see.
Production Launch Checks Required before live traffic
Review Config
Approved merchant Production API returns 403 until admin approval is complete.
Server-side signing Each request includes X-Timestamp and X-Signature generated with the matching API secret.
Wallet coverage Each merchant currency has an active receiver wallet.
Gateway coverage Selected gateways match the currencies customers will use.
Redirect URLs success_redirect and cancel_redirect are HTTPS and handle repeated visits safely.
IPN verification Webhook signature is verified before fulfillment or wallet-side order updates.
Important Never switch only the X-Environment header. Always switch the Business ID, API Key, and API Secret together so the environment and credential set match.

Interactive API Testing

Test TemboPay API endpoints directly from this documentation. Use the demo credentials below for sandbox testing.

Demo Payment Information SANDBOX MODE

Use these demo credentials to test all payment methods in sandbox environment:

Demo Wallet
Wallet ID: 123456789 Wallet PIN: 123456
Auto-approved in sandbox
Demo Voucher
Voucher Code: TESTVOUCHER
Instant redemption
Gateway Payment
Behavior: Auto Success
No external redirection
Testing Guidelines
  • Environment Header: Always include X-ENVIRONMENT: sandbox in your API requests
  • Demo Credentials: Use the provided demo wallet/voucher codes for testing payment flows
  • Sandbox Behavior: All payments auto-complete successfully without real money processing
  • Gateway Controls: Hosted checkout respects the gateways configured from Merchant API Config for the selected currency.
  • Transaction Status: Sandbox transactions are marked with "SANDBOX_TRANSACTION" in remarks
  • IPN Notifications: Webhook notifications work normally in sandbox mode
Environment Setup: Use sandbox for testing and production for live transactions. Only sandbox credentials use test_ prefix, production credentials have no prefix.
API Testing Console
Authentication Headers
Sandbox: test_*, Production: no prefix
Sandbox: test_*, Production: no prefix
Used locally to generate X-Signature. Prefer sandbox secrets in the browser console.
Request Parameters
Currency code must be uppercase (e.g. USD, EUR, BDT). You must use the currency that matches your merchant shop setup.
Limit checkout methods by name. Accepts CSV string or JSON array. Case-insensitive.
Sandbox Environment

Base URL: https://tembopay.africa

Environment Header: X-Environment: sandbox

Credentials: Use test_ prefixed keys

Purpose: Safe testing without real money

Production Environment

Base URL: https://tembopay.africa

Environment Header: X-Environment: production

Credentials: No prefix for production keys

Purpose: Live transactions with real money

Error Codes

TemboPay API uses conventional HTTP response codes to indicate the success or failure of API requests.

HTTP Status Codes

Code Status Description
200 OK Request succeeded
400 Bad Request Invalid request parameters
401 Unauthorized Invalid or missing API credentials
403 Forbidden Insufficient permissions
404 Not Found Resource not found
429 Too Many Requests Rate limit exceeded
500 Internal Server Error Server error occurred

API Error Codes

Error Code Description Solution
INVALID_CREDENTIALS Invalid API credentials provided Check your Business ID and API Key
INSUFFICIENT_FUNDS Customer has insufficient funds Customer needs to add funds to their wallet
PAYMENT_DECLINED Payment was declined by payment processor Customer should try a different payment method
INVALID_AMOUNT Payment amount is invalid Check minimum and maximum amount limits
INVALID_CURRENCY Unsupported currency code Use a supported currency code (USD, EUR, etc.)
DUPLICATE_REFERENCE Transaction reference already exists Use a unique transaction reference
EXPIRED_SESSION Payment session has expired Create a new payment request
MERCHANT_SUSPENDED business account is suspended Contact TemboPay support

Error Response Format

TemboPay APIs return a short `error` label and a human `message`. Validation failures may also include an `errors` object. There is no separate `error_code` field — treat `error` as the stable machine-readable key.

{
  "error": "Payout Rejected",
  "message": "Complete KYB approval before requesting payouts."
}
{
  "error": "Validation failed",
  "message": "The given data was invalid.",
  "errors": {
    "amount": [
      "The amount field is required."
    ]
  }
}
Error Handling Check HTTP status plus the `error` / `message` fields. Do not retry INPROGRESS or AMBIGUOUS Selcom outcomes as a new charge.

Support

Technical Support

Need assistance with TemboPay API integration? Our technical team provides comprehensive support.

Support Hours: 24/7 for critical issues