Fast Hosted Checkout
Create a payment session, redirect the customer, then verify or receive IPN updates when the transaction completes.
Accept wallet, gateway, and hosted checkout payments with environment-aware credentials, merchant-level currency control, and dashboard-managed payment gateway rules.
Create a payment session, redirect the customer, then verify or receive IPN updates when the transaction completes.
The requested currency must be enabled for the merchant and backed by an active merchant wallet.
Merchants can choose eligible payment gateways from API Config without regenerating API credentials.
TemboPay API uses business-generated credentials to authenticate requests. Complete KYB and receive approval before generating credentials from your business dashboard.
TemboPay API supports both sandbox (testing) and production environments. Always test in sandbox first before going live.
Use for: Development, testing, integration
X-Environment: sandbox
Credentials: Use tp_test_* credentials generated after approval
Use for: Live payments, real money
X-Environment: production
Credentials: Use tp_live_* credentials generated after approval
| Credential | Header | Description | Location |
|---|---|---|---|
Business ID |
X-Merchant-Key or X-Business-Key |
Your unique business identifier. X-Business-Key is an accepted alias. | Dashboard → Business → Config |
API Key |
X-API-Key |
API authentication key | Dashboard → Business → Config |
Request Timestamp |
X-Timestamp |
Unix timestamp in seconds used for replay protection | Generated by your server for each API request |
API Signature |
X-Signature |
HMAC-SHA256 signature for the request | Generated using your Client Secret |
Client Secret |
- | Used for API request signing and webhook signature verification | Dashboard → Business → CONFIG |
| Production API Key | X-API-Key |
Production API key (no prefix) | Business dashboard > API Config > Production Mode |
| Production Business ID | X-Merchant-Key |
Production business identifier (no prefix) | Business dashboard > API Config > Production Mode |
When API signatures are required, sign this exact payload with your Client Secret:
timestamp.HTTP_METHOD.path_with_query.raw_body
First payment in about five minutes (sandbox). TemboPay uses Selcom underneath; you only integrate TemboPay. Live collecting requires KYB approval and Selcom-whitelisted HTTPS URLs.
Create a business account and business profile. Sandbox API keys are available before KYB approval.
Open Dashboard → Business → API Config and generate sandbox Business ID, API Key, and API Secret.
POST /api/v1/payments with HMAC headers and X-Environment: sandbox. Redirect the customer to the returned checkout URL or trigger USSD push.
Complete KYB, generate live keys, whitelist your redirect/cancel/webhook domains with Selcom, then collect. After settlement, POST /api/v1/payouts to your MSISDN.
Prefer payment links for events and no-code collecting — same Selcom rails, no HMAC required for guests.
The merchant API is no longer a single-currency, fixed-gateway flow. A merchant can now support multiple currency rails, keep separate sandbox and production credentials, and choose eligible gateways from the API Config page without regenerating API keys.
Your code sends amount, currency, redirects, IPN URL, and optional gateway keywords. The dashboard decides which currency rails, wallets, and payment gateways are actually available for that merchant.
Pending merchants can test in sandbox. Production API access and live checkout are available only after admin approval.
Each request currency_code must exist in the merchant-supported currency list. Unsupported currencies are rejected before checkout opens.
The merchant owner must have an active wallet for the requested currency, otherwise the API returns a wallet availability error.
Only active automatic gateways that match the requested currency and merchant selection can appear on hosted checkout.
X-Environment decides which merchant key, API key, and API secret are used.
Rejected or disabled merchants are blocked. Production also requires approved business status.
currency_code must match a merchant-supported rail such as USD, EUR, or BDT.
The merchant owner needs an active wallet for that same currency.
Business API Config selections restrict checkout to the chosen eligible gateways. If none are selected, the safe fallback is all active automatic gateways for that currency.
allow_payment_methods can narrow the available gateway list, but it cannot expose an unconfigured or wrong-currency gateway.
| Case | API Result | Fix |
|---|---|---|
| Merchant supports USD and EUR, but only USD wallet exists. | 422 Receiver wallet for this currency is not available. |
Create/activate the EUR merchant wallet before accepting EUR checkout. |
| Stripe USD is selected, but the request sends currency_code EUR. | Stripe USD will not appear on checkout. | Select an active EUR gateway or send USD. |
| Merchant has not selected any gateway yet. | Checkout falls back to all active automatic gateways that match the requested currency. | Use API Config to lock checkout to preferred gateways. |
allow_payment_methods=["paypal"] but PayPal is not configured for the merchant. |
PayPal remains hidden. | Enable PayPal from Payment Gateway Controls if its currency matches. |
| Pending merchant calls production API. | 403 Merchant Pending Approval |
Use sandbox until admin approval is complete. |
A gateway configured for USD cannot process EUR checkout unless a separate EUR gateway exists.
API Secret is used only to sign server-to-server API requests and verify IPN signatures.
The returned payment_url is time-limited. Create a new payment session for expired checkout links.
A merchant can verify only its own transaction and only in the matching sandbox or production environment.
Merchant API checkout is controlled by three layers: merchant-supported currency, active receiver wallet, and configured payment gateways. This keeps checkout options accurate after API credentials are generated.
A gateway appears on hosted checkout only when every rule below is true. If the merchant has selected gateways, those selected gateways become the allowed set for checkout.
| Layer | Who controls it | Effect |
|---|---|---|
currency_code |
API request | Must match a merchant-supported currency with an active receiver wallet. |
Payment Gateway Controls |
Merchant dashboard | Defines the gateway set available to hosted checkout for each eligible currency. |
allow_payment_methods |
API request | Optional name/code keyword filter applied after merchant gateway rules. It cannot expose a gateway the merchant did not configure. |
TemboPay is the business-facing payment provider. You integrate TemboPay APIs; Selcom runs underneath as the rail and is never exposed to your customers or credentials.
https://tembopay.africa/api/v1/openapi.json
| Method | Path | Purpose |
|---|---|---|
| POST | /api/v1/payments |
Create payment (hosted checkout or USSD push) |
| GET | /api/v1/payments |
List payments (paginated) |
| GET | /api/v1/payments/{trx_id} |
Get payment status |
| POST | /api/v1/payments/{trx_id}/push |
Trigger mobile money USSD push |
| GET | /api/v1/balance |
Business wallet balance |
| POST | /api/v1/billing/plans |
Create billing plan |
| POST | /api/v1/billing/subscriptions |
Create subscription with consent |
| GET | /api/v1/billing/invoices |
List billing invoices |
All endpoints require HMAC headers (X-API-Key, X-Merchant-Key, X-Timestamp, X-Signature, X-Environment). Optional Idempotency-Key on create (max 64 chars, 24h).
Create a payment intent. Returns trx_id plus checkout_url (hosted) or initiates USSD push when payment_mode=push.
https://tembopay.africa/api/v1/payments
| Field | Notes |
|---|---|
payment_amount | Required. Amount in currency units (e.g. TZS). |
currency_code | Required. Must be enabled for the merchant. |
ref_trx | Required. Your order reference (merchant_ref). |
webhook_url / ipn_url | Optional if default webhook URL is set on Business API Config. Production requires HTTPS. |
payment_mode | hosted (default) or push |
customer_phone | Required when payment_mode=push (MSISDN, e.g. 2557…). |
success_redirect / cancel_redirect | Optional; defaults to site URL. |
{
"status": "success",
"data": {
"trx_id": "TXN…",
"merchant_ref": "ORD-123",
"amount": 5000,
"currency": "TZS",
"status": "pending",
"checkout_url": "https://…",
"expires_at": "…",
"environment": "sandbox"
},
"payment_url": "https://…",
"trx_id": "TXN…"
}Paginated merchant payments for the authenticated environment.
https://tembopay.africa/api/v1/payments?limit=20&offset=0Query: limit, offset, status, merchant_ref
Fetch a single payment by TemboPay trx_id.
https://tembopay.africa/api/v1/payments/{trx_id}Trigger mobile money USSD for a pending payment. Sandbox simulates the push without calling Selcom.
https://tembopay.africa/api/v1/payments/{trx_id}/pushBody: {"customer_phone":"2557XXXXXXXX"} (optional if already set on create)
Available wallet balances for merchant-supported currencies.
https://tembopay.africa/api/v1/balanceAlias of POST /api/v1/payments. Prefer /payments for new integrations. Returns trx_id and checkout_url in data, plus legacy payment_url.
https://tembopay.africa/api/v1/initiate-payment
| Header | Value | Required | Description |
|---|---|---|---|
Content-Type |
application/json |
Yes | Request content type |
Accept |
application/json |
Yes | Expected response type |
X-Environment |
sandbox | production |
Yes | Use sandbox for testing and production for live payments |
X-Merchant-Key |
{merchant_key} |
Yes | Merchant identifier from the API Config page |
X-API-Key |
{api_key} |
Yes | API key for the selected environment |
X-Timestamp |
{unix_timestamp} |
Yes | Current Unix timestamp in seconds. Requests outside the allowed tolerance are rejected. |
X-Signature |
sha256={hmac} |
Yes | HMAC-SHA256 of timestamp.METHOD.path_with_query.raw_body using the API Secret for the selected environment. |
| Parameter | Type | Required | Description |
|---|---|---|---|
payment_amount |
number | Yes | Payment amount. Minimum value is 1.00. |
currency_code |
string | Yes | 3-letter currency code. Must be enabled for the merchant and backed by an active merchant wallet. |
ref_trx |
string | Yes | Your unique order or transaction reference. Max 60 characters. |
success_redirect |
url | Yes | Customer is redirected here after a successful hosted checkout. |
cancel_redirect |
url | Yes | Customer is redirected here when checkout is canceled or cannot continue. |
ipn_url |
url | Yes | Server-to-server webhook URL for payment status updates. |
description |
string | No | Payment description visible in merchant transaction context. |
customer_name |
string | No | Customer name. Max 100 characters. |
customer_email |
No | Customer email address. Max 100 characters. | |
allow_payment_methods |
string | array | No | Optional keyword filter applied after merchant gateway rules. Example: "stripe,paypal" or ["stripe","paypal"]. |
| Field | Type | Meaning |
|---|---|---|
info.merchant_payment_methods_restricted |
boolean | true when the merchant has selected specific gateways in API Config. |
info.merchant_payment_method_ids |
array | Eligible deposit method IDs for the requested currency. |
info.merchant_payment_method_codes |
array | Eligible method codes that can appear on hosted checkout. |
curl -X POST "https://tembopay.africa/api/v1/initiate-payment" \
-H "Content-Type: application/json" \
-H "Accept: application/json" \
-H "X-Environment: sandbox" \
-H "X-Merchant-Key: test_merchant_key" \
-H "X-API-Key: test_api_key" \
-H "X-Timestamp: 1778650000" \
-H "X-Signature: sha256=generated_hmac_signature" \
-d '{
"payment_amount": 250.00,
"currency_code": "USD",
"ref_trx": "ORDER_12345",
"description": "Premium Subscription",
"success_redirect": "https://merchant.example/payments/success",
"cancel_redirect": "https://merchant.example/payments/cancel",
"ipn_url": "https://merchant.example/webhooks/tembopay",
"customer_name": "John Doe",
"customer_email": "john@example.com",
"allow_payment_methods": ["stripe", "paypal"]
}'
<?php
use Illuminate\Support\Facades\Http;
$payload = [
'payment_amount' => 250.00,
'currency_code' => 'USD',
'ref_trx' => 'ORDER_12345',
'description' => 'Premium Subscription',
'success_redirect' => route('payments.success'),
'cancel_redirect' => route('payments.cancel'),
'ipn_url' => route('webhooks.tembopay'),
'customer_name' => 'John Doe',
'customer_email' => 'john@example.com',
'allow_payment_methods' => ['stripe', 'paypal'],
];
$body = json_encode($payload, JSON_THROW_ON_ERROR);
$timestamp = (string) time();
$path = '/api/v1/initiate-payment';
$signature = hash_hmac(
'sha256',
$timestamp.'.POST.'.$path.'.'.$body,
config('services.tembopay.api_secret')
);
$response = Http::withHeaders([
'Content-Type' => 'application/json',
'Accept' => 'application/json',
'X-Environment' => 'sandbox',
'X-Merchant-Key' => config('services.tembopay.merchant_key'),
'X-API-Key' => config('services.tembopay.api_key'),
'X-Timestamp' => $timestamp,
'X-Signature' => 'sha256='.$signature,
])->withBody($body, 'application/json')
->post('https://tembopay.africa/api/v1/initiate-payment')
->throw()
->json();
return redirect()->away($response['payment_url']);
const crypto = require('crypto');
const payload = {
payment_amount: 250.00,
currency_code: 'USD',
ref_trx: 'ORDER_12345',
description: 'Premium Subscription',
success_redirect: 'https://merchant.example/payments/success',
cancel_redirect: 'https://merchant.example/payments/cancel',
ipn_url: 'https://merchant.example/webhooks/tembopay',
customer_name: 'John Doe',
customer_email: 'john@example.com',
allow_payment_methods: ['stripe', 'paypal']
};
const body = JSON.stringify(payload);
const timestamp = Math.floor(Date.now() / 1000).toString();
const path = '/api/v1/initiate-payment';
const signature = crypto
.createHmac('sha256', process.env.TEMBOPAY_API_SECRET)
.update(`${timestamp}.POST.${path}.${body}`)
.digest('hex');
const response = await fetch('https://tembopay.africa/api/v1/initiate-payment', {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'Accept': 'application/json',
'X-Environment': 'sandbox',
'X-Merchant-Key': process.env.TEMBOPAY_MERCHANT_KEY,
'X-API-Key': process.env.TEMBOPAY_API_KEY,
'X-Timestamp': timestamp,
'X-Signature': `sha256=${signature}`
},
body
});
const data = await response.json();
if (!response.ok) {
throw new Error(data.error || 'Payment initiation failed');
}
window.location.href = data.payment_url;
{
"payment_url": "https://TemboPay.test/payment/checkout?token=encrypted&signature=signed",
"info": {
"ref_trx": "ORDER_12345",
"description": "Premium Subscription",
"ipn_url": "https://merchant.example/webhooks/tembopay",
"cancel_redirect": "https://merchant.example/payments/cancel",
"success_redirect": "https://merchant.example/payments/success",
"customer_name": "John Doe",
"customer_email": "john@example.com",
"merchant_id": 1,
"merchant_name": "Demo Store",
"amount": 250,
"currency_code": "USD",
"environment": "sandbox",
"is_sandbox": true,
"allow_payment_methods": ["stripe", "paypal"],
"merchant_payment_methods_restricted": true,
"merchant_payment_method_ids": [7],
"merchant_payment_method_codes": ["stripe-usd"]
}
}
The requested currency_code is not in the merchant-supported currency list.
The merchant owner does not have an active wallet for the requested currency.
Check X-Environment, X-Merchant-Key, and X-API-Key for the same environment.
Fetch the latest status for a hosted checkout transaction. Always verify server-side before fulfilling an order.
https://tembopay.africa/api/v1/verify-payment/{trxId}
| Header | Value | Required | Description |
|---|---|---|---|
Accept |
application/json |
Yes | Expected response type |
X-Environment |
sandbox | production |
Yes | Must match the environment used to initiate the payment |
X-Merchant-Key |
{merchant_key} |
Yes | Merchant identifier from API Config |
X-API-Key |
{api_key} |
Yes | API key for the selected environment |
X-Timestamp |
{unix_timestamp} |
Yes | Use the same timestamp format as payment initiation. |
X-Signature |
sha256={hmac} |
Yes | Sign timestamp.GET./api/v1/verify-payment/{trxId}. using the matching API Secret. The raw body is empty for GET requests. |
| Parameter | Type | Required | Description |
|---|---|---|---|
trxId |
string | Yes | TemboPay transaction ID returned by hosted checkout or IPN. |
curl -X GET "https://tembopay.africa/api/v1/verify-payment/TXNQ5V8K2L9N3XM1" \
-H "Accept: application/json" \
-H "X-Environment: sandbox" \
-H "X-Merchant-Key: test_merchant_key" \
-H "X-API-Key: test_api_key" \
-H "X-Timestamp: 1778650000" \
-H "X-Signature: sha256=generated_hmac_signature"
{
"status": "success",
"trx_id": "TXNQ5V8K2L9N3XM1",
"amount": 237.5,
"fee": 12.5,
"currency": "USD",
"net_amount": 237.5,
"customer": {
"name": "John Doe",
"email": "john@example.com"
},
"description": "Premium Subscription",
"created_at": "2026-05-13T10:30:00.000000Z",
"updated_at": "2026-05-13T10:35:45.000000Z"
}
| Status | Description | Recommended Action |
|---|---|---|
pending |
Payment is still processing. | Wait for IPN or verify again later. |
success |
Payment completed successfully. | Fulfill the order after idempotency checks. |
failed |
Payment failed or was canceled. | Do not fulfill; show retry or cancel state. |
Fetch gateway branding, environment labels, and customer-facing checkout metadata for a merchant-authenticated integration.
https://tembopay.africa/api/v1/site-info
curl -X GET "https://tembopay.africa/api/v1/site-info" \
-H "Accept: application/json" \
-H "X-Environment: sandbox" \
-H "X-Merchant-Key: test_merchant_key" \
-H "X-API-Key: test_api_key" \
-H "X-Timestamp: 1778650000" \
-H "X-Signature: sha256=generated_hmac_signature"
{
"site_name": "TemboPay",
"site_logo": "https://tembopay.africa/general/static/logo/tembopay-mark.svg",
"site_url": "https://tembopay.africa",
"gateway_name": "TemboPay Payment Gateway",
"gateway_description": "Secure payment powered by TemboPay",
"features": {
"ssl_secured": "SSL Secured",
"instant_processing": "Instant",
"global_support": "Global",
"mobile_ready": "Mobile Ready"
},
"environments": {
"production": "Production Mode - Live payment processing is active",
"sandbox": "Test Mode - This is a test transaction. No real money will be charged"
},
"api_version": "1.0",
"status": "active"
}
Approved businesses can disburse settled balance to the KYB settlement MSISDN over Selcom. Use TemboPay Business API keys only — Selcom platform credentials stay on TemboPay servers.
| Method | Endpoint | Description |
|---|---|---|
| POST | /api/v1/payouts/preview |
Fee preview (amount, fee, payable_amount) |
| POST | /api/v1/payouts |
Create payout. Optional Idempotency-Key header (max 64 chars). |
| GET | /api/v1/payouts |
List payouts for the business |
| GET | /api/v1/payouts/{id} |
Fetch a single payout by UUID |
{
"amount": 10000,
"destination": "2557XXXXXXXX"
}
destination is optional and must match the approved settlement MSISDN when supplied.
curl -X POST "https://tembopay.africa/api/v1/payouts" \
-H "X-API-Key: tp_test_..." \
-H "X-Business-Key: tp_test_merchant_..." \
-H "X-Environment: sandbox" \
-H "X-Timestamp: $(date +%s)" \
-H "X-Signature: ..." \
-H "Idempotency-Key: payout-order-42" \
-H "Content-Type: application/json" \
-d '{"amount":10000}'
Recurring mobile money charges require explicit customer consent. Each charge uses Selcom Request-to-Pay (USSD push) — the customer must approve with their PIN. Silent debit is not supported on Track A.
| Method | Path | Purpose |
|---|---|---|
| POST | /api/v1/billing/plans |
Create a recurring billing plan |
| POST | /api/v1/billing/subscriptions |
Create subscription with recorded consent + first USSD push |
| GET | /api/v1/billing/invoices |
List invoices (optional ?subscription=sub_… filter) |
| Field | Notes |
|---|---|
plan_code | Required. Plan code from create plan. |
customer_phone | Required. Tanzania MSISDN for USSD push. |
terms_shown | Required. Exact recurring billing terms shown to the customer. |
webhook_url | Optional override for subscription/invoice events. |
In addition to payment.completed / payment.failed, TemboPay emits:
| Event | When |
|---|---|
subscription.created | Subscription created after consent recorded |
subscription.cancelled | Subscription cancelled |
subscription.suspended | Max dunning failures reached |
invoice.created | New billing invoice opened |
invoice.paid | Invoice settled via USSD push |
invoice.payment_failed | Charge attempt failed; dunning schedule applies |
TemboPay sends signed HTTP POSTs to your webhook URL when a payment completes or fails. Configure a default URL and signing secret on Business API Config, or pass webhook_url / ipn_url per payment.
| Event | When |
|---|---|
payment.completed |
Payment settled successfully |
payment.failed |
Payment failed or canceled |
subscription.* / invoice.* |
Billing autopay lifecycle (see Billing Webhooks section) |
| Header | Description |
|---|---|
X-TemboPay-Event |
Event type, e.g. payment.completed |
X-TemboPay-Timestamp |
Unix timestamp used in the signature |
X-TemboPay-Signature |
HMAC-SHA256 hex digest |
X-Environment |
sandbox | production |
{
"id": "evt_…",
"type": "payment.completed",
"api_version": "2026-07-18",
"created_at": "2026-07-18T12:00:00+00:00",
"data": {
"trx_id": "TXN…",
"merchant_ref": "ORD-123",
"status": "completed",
"amount": { "value": 5000, "currency": "TZS" },
"settlement": {
"gross": { "value": 5000, "currency": "TZS" },
"fees": { "value": 50, "currency": "TZS" },
"net": { "value": 4950, "currency": "TZS" }
},
"customer": { "name": "Jane", "email": "jane@example.com", "phone": "2557…" },
"environment": "sandbox"
}
}
$timestamp = $request->header('X-TemboPay-Timestamp');
$signature = $request->header('X-TemboPay-Signature');
$raw = $request->getContent();
$expected = hash_hmac('sha256', $timestamp.'.'.$raw, $webhookSecret);
if (!hash_equals($expected, $signature)) {
abort(401);
}
// Return 2xx quickly; process asynchronously.
Failed deliveries retry with backoff (immediate, then 3 / 6 / 12 / 24 minutes) up to 5 attempts, then abandoned. Handle duplicates using the event id.
Production-oriented integration examples for popular platforms and frameworks. Keep gateway selection in Business API Config, then sign each API request from your server.
<?php
// Laravel Integration Service
namespace App\Services;
use Illuminate\Support\Facades\Http;
use Exception;
class TemboPayService
{
private string $baseUrl;
private string $merchantKey;
private string $apiKey;
private string $environment;
public function __construct()
{
$this->baseUrl = config('tembopay.base_url');
$this->merchantKey = config('tembopay.merchant_key');
$this->apiKey = config('tembopay.api_key');
$this->environment = config('tembopay.environment'); // 'sandbox' or 'production'
}
public function initiatePayment(array $paymentData): array
{
try {
$response = Http::withHeaders([
'Content-Type' => 'application/json',
'X-Environment' => $this->environment,
'X-Merchant-Key' => $this->merchantKey,
'X-API-Key' => $this->apiKey,
])->post("{$this->baseUrl}/api/v1/initiate-payment", $paymentData);
if ($response->successful()) {
return $response->json();
}
throw new Exception('TemboPay API Error: Payment initiation failed');
} catch (Exception $e) {
throw new Exception('TemboPay API Error: ' . $e->getMessage());
}
}
public function verifyPayment(string $transactionId): array
{
try {
$response = Http::withHeaders([
'Accept' => 'application/json',
'X-Environment' => $this->environment,
'X-Merchant-Key' => $this->merchantKey,
'X-API-Key' => $this->apiKey,
])->get("{$this->baseUrl}/api/v1/verify-payment/{$transactionId}");
if ($response->successful()) {
return $response->json();
}
throw new Exception('TemboPay API Error: Payment verification failed');
} catch (Exception $e) {
throw new Exception('TemboPay API Error: ' . $e->getMessage());
}
}
}
// Configuration (config/tembopay.php)
return [
'base_url' => env('TEMBOPAY_BASE_URL', 'https://tembopay.africa'),
'environment' => env('TEMBOPAY_ENVIRONMENT', 'sandbox'), // sandbox or production
'merchant_key' => env('TEMBOPAY_MERCHANT_KEY'), // Use appropriate prefix
'api_key' => env('TEMBOPAY_API_KEY'), // Use appropriate prefix
];
// Usage in Controller
class PaymentController extends Controller
{
public function initiatePayment(Request $request, TemboPayService $tembopay)
{
$paymentData = [
'payment_amount' => $request->amount,
'currency_code' => 'USD',
'ref_trx' => 'ORDER_' . time(),
'description' => $request->description,
'success_redirect' => route('payment.success'),
'cancel_redirect' => route('payment.cancelled'),
'ipn_url' => route('webhooks.tembopay'),
'allow_payment_methods' => ['stripe', 'paypal'],
];
try {
$result = $tembopay->initiatePayment($paymentData);
return redirect($result['payment_url']);
} catch (Exception $e) {
return back()->withErrors(['error' => $e->getMessage()]);
}
}
}
// Node.js Integration Service
const axios = require('axios');
class TemboPayService {
constructor() {
this.baseUrl = process.env.TEMBOPAY_BASE_URL || 'https://tembopay.africa';
this.environment = process.env.TEMBOPAY_ENVIRONMENT || 'sandbox'; // sandbox or production
this.merchantKey = process.env.TEMBOPAY_MERCHANT_KEY; // Use appropriate prefix
this.apiKey = process.env.TEMBOPAY_API_KEY; // Use appropriate prefix
}
async initiatePayment(paymentData) {
try {
const response = await axios.post(`${this.baseUrl}/api/v1/initiate-payment`, paymentData, {
headers: {
'Content-Type': 'application/json',
'X-Environment': this.environment,
'X-Merchant-Key': this.merchantKey,
'X-API-Key': this.apiKey
}
});
return response.data;
} catch (error) {
throw new Error(`TemboPay API Error: ${error.message}`);
}
}
async verifyPayment(transactionId) {
try {
const response = await axios.get(`${this.baseUrl}/api/v1/verify-payment/${transactionId}`, {
headers: {
'Accept': 'application/json',
'X-Environment': this.environment,
'X-Merchant-Key': this.merchantKey,
'X-API-Key': this.apiKey
}
});
return response.data;
} catch (error) {
throw new Error(`TemboPay API Error: ${error.message}`);
}
}
}
// Express.js Route Example
const express = require('express');
const app = express();
const tembopay = new TemboPayService();
app.post('/initiate-payment', async (req, res) => {
const paymentData = {
payment_amount: req.body.amount,
currency_code: 'USD',
ref_trx: `ORDER_${Date.now()}`,
description: req.body.description,
success_redirect: `${req.protocol}://${req.get('host')}/payment/success`,
cancel_redirect: `${req.protocol}://${req.get('host')}/payment/cancelled`,
ipn_url: `${req.protocol}://${req.get('host')}/webhooks/tembopay`,
allow_payment_methods: ['stripe', 'paypal'],
};
try {
const result = await tembopay.initiatePayment(paymentData);
res.redirect(result.payment_url);
} catch (error) {
res.status(500).json({ error: error.message });
}
});
module.exports = TemboPayService;
# Python/Django Integration Service
import os
import requests
from django.conf import settings
class TemboPayService:
def __init__(self):
self.base_url = getattr(settings, 'TEMBOPAY_BASE_URL', 'https://tembopay.africa')
self.environment = getattr(settings, 'TEMBOPAY_ENVIRONMENT', 'sandbox') # sandbox or production
self.merchant_key = getattr(settings, 'TEMBOPAY_MERCHANT_KEY') # Use appropriate prefix
self.api_key = getattr(settings, 'TEMBOPAY_API_KEY') # Use appropriate prefix
def initiate_payment(self, payment_data):
try:
headers = {
'Content-Type': 'application/json',
'X-Environment': self.environment,
'X-Merchant-Key': self.merchant_key,
'X-API-Key': self.api_key
}
response = requests.post(
f"{self.base_url}/api/v1/initiate-payment",
headers=headers,
json=payment_data,
timeout=30
)
response.raise_for_status()
return response.json()
except requests.RequestException as e:
raise Exception(f'TemboPay API Error: {str(e)}')
def verify_payment(self, transaction_id):
try:
headers = {
'Accept': 'application/json',
'X-Environment': self.environment,
'X-Merchant-Key': self.merchant_key,
'X-API-Key': self.api_key
}
response = requests.get(
f"{self.base_url}/api/v1/verify-payment/{transaction_id}",
headers=headers,
timeout=30
)
response.raise_for_status()
return response.json()
except requests.RequestException as e:
raise Exception(f'TemboPay API Error: {str(e)}')
# Django Settings Configuration
TEMBOPAY_BASE_URL = 'https://tembopay.africa'
TEMBOPAY_ENVIRONMENT = 'sandbox' # Change to 'production' for live
TEMBOPAY_MERCHANT_KEY = os.environ.get('TEMBOPAY_MERCHANT_KEY') # Use appropriate prefix
TEMBOPAY_API_KEY = os.environ.get('TEMBOPAY_API_KEY') # Use appropriate prefix
# Django View Example
from django.shortcuts import redirect
from django.http import JsonResponse
from django.views.decorators.csrf import csrf_exempt
import json
tembopay = TemboPayService()
@csrf_exempt
def initiate_payment(request):
if request.method == 'POST':
data = json.loads(request.body)
payment_data = {
'payment_amount': data['amount'],
'currency_code': 'USD',
'ref_trx': f'ORDER_{int(time.time())}',
'description': data['description'],
'success_redirect': request.build_absolute_uri('/payment/success/'),
'cancel_redirect': request.build_absolute_uri('/payment/cancelled/'),
'ipn_url': request.build_absolute_uri('/webhooks/tembopay/'),
'allow_payment_methods': ['stripe', 'paypal'],
}
try:
result = tembopay.initiate_payment(payment_data)
return redirect(result['payment_url'])
except Exception as e:
return JsonResponse({'error': str(e)}, status=500)
# Environment Variables Setup
export TEMBOPAY_ENVIRONMENT="sandbox" # or "production"
export TEMBOPAY_MERCHANT_KEY="test_merchant_your_key" # or "merchant_your_key" for production
export TEMBOPAY_API_KEY="test_your_api_key" # or "your_api_key" for production
# Initiate Payment
curl -X POST "https://tembopay.africa/api/v1/initiate-payment" \
-H "Content-Type: application/json" \
-H "X-Environment: $TEMBOPAY_ENVIRONMENT" \
-H "X-Merchant-Key: $TEMBOPAY_MERCHANT_KEY" \
-H "X-API-Key: $TEMBOPAY_API_KEY" \
-d '{
"payment_amount": 250.00,
"currency_code": "USD",
"ref_trx": "ORDER_12345",
"description": "Premium Subscription",
"success_redirect": "https://yoursite.com/payment/success",
"cancel_redirect": "https://yoursite.com/payment/cancelled",
"ipn_url": "https://yoursite.com/api/webhooks/tembopay",
"allow_payment_methods": ["stripe", "paypal"]
}'
# Verify Payment
curl -X GET "https://tembopay.africa/api/v1/verify-payment/TXNQ5V8K2L9N3XM1" \
-H "Accept: application/json" \
-H "X-Environment: $TEMBOPAY_ENVIRONMENT" \
-H "X-Merchant-Key: $TEMBOPAY_MERCHANT_KEY" \
-H "X-API-Key: $TEMBOPAY_API_KEY"
# Environment-specific credential examples:
# Sandbox: test_merchant_xxxxx, test_api_key_xxxxx
# Production: merchant_xxxxx, api_key_xxxxx
Advanced TemboPay payment gateway with modern WooCommerce Blocks support, dynamic branding, and enterprise-grade security features.
Production-ready payment gateway with WooCommerce Blocks (Gutenberg) support, dynamic branding, and secure webhook processing.
Enterprise-grade WooCommerce payment gateway with modern Blocks support and dynamic branding.
Enterprise-grade payment processing with modern architecture
Full Gutenberg checkout compatibility with React-based UI
Auto-fetch logo, colors, and branding from TemboPay API
HMAC-SHA256 signature verification for payment callbacks
Space-efficient, responsive design for all devices
Multi-header authentication with environment isolation
Seamless sandbox testing with production deployment
Get started with TemboPay WooCommerce integration in minutes
Download TemboPay WooCommerce Gateway v2.8.0 from the download section above. This includes all latest features and security updates.
Navigate to Plugins → Add New → Upload Plugin and select the downloaded ZIP file. The plugin will auto-extract and install.
Activate the plugin and go to WooCommerce → Settings → Payments → TemboPay. Enter your API credentials and webhook secret.
Enable Test Mode, process a sandbox transaction to verify Blocks checkout, webhook delivery, and order completion.
Disable test mode, ensure production API keys are configured, and start accepting real payments with full webhook processing.
Essential API settings for secure payment processing
https://tembopay.africa
Your unique merchant credentials from TemboPay dashboard
RequiredHMAC-SHA256 signature verification for secure callbacks
RecommendedRequired headers for all TemboPay API requests:
X-Environment: sandbox|production
X-Merchant-Key: your_merchant_id
X-API-Key: your_api_key
Content-Type: application/json
Real-time payment status updates and order processing
https://yoursite.com/wc-api/tembopay_webhook
Configure this URL in your TemboPay merchant dashboard for automatic order updates.
Modern Gutenberg checkout with React-based payment UI
Compact, mobile-optimized payment interface that adapts to any screen size.
Automatically fetches and displays your TemboPay branding and logos.
Clear SSL and security badges to build customer trust during checkout.
Clear sandbox indicators for testing without affecting live transactions.
Ensure everything is configured correctly before going live
Common issues and solutions for TemboPay WooCommerce integration
Solutions:
Solutions:
Solutions:
Use this checklist before moving from test payments to live checkout. The same API routes work in both modes; only the environment header and credential set change.
Use test credentials and X-Environment: sandbox. Transactions are marked as sandbox and do not represent real money movement. Sandbox keys can be generated before KYB approval.
Use live credentials and X-Environment: production only after admin approval, wallet readiness, and gateway configuration are complete.
Test TemboPay API endpoints directly from this documentation. Use the demo credentials below for sandbox testing.
Use these demo credentials to test all payment methods in sandbox environment:
123456789
Wallet PIN:
123456
TESTVOUCHER
Auto Success
X-ENVIRONMENT: sandbox in your API requestssandbox for testing and production for live transactions. Only sandbox credentials use test_ prefix, production credentials have no prefix.
Base URL: https://tembopay.africa
Environment Header: X-Environment: sandbox
Credentials: Use test_ prefixed keys
Purpose: Safe testing without real money
Base URL: https://tembopay.africa
Environment Header: X-Environment: production
Credentials: No prefix for production keys
Purpose: Live transactions with real money
TemboPay API uses conventional HTTP response codes to indicate the success or failure of API requests.
| Code | Status | Description |
|---|---|---|
| 200 | OK | Request succeeded |
| 400 | Bad Request | Invalid request parameters |
| 401 | Unauthorized | Invalid or missing API credentials |
| 403 | Forbidden | Insufficient permissions |
| 404 | Not Found | Resource not found |
| 429 | Too Many Requests | Rate limit exceeded |
| 500 | Internal Server Error | Server error occurred |
| Error Code | Description | Solution |
|---|---|---|
INVALID_CREDENTIALS |
Invalid API credentials provided | Check your Business ID and API Key |
INSUFFICIENT_FUNDS |
Customer has insufficient funds | Customer needs to add funds to their wallet |
PAYMENT_DECLINED |
Payment was declined by payment processor | Customer should try a different payment method |
INVALID_AMOUNT |
Payment amount is invalid | Check minimum and maximum amount limits |
INVALID_CURRENCY |
Unsupported currency code | Use a supported currency code (USD, EUR, etc.) |
DUPLICATE_REFERENCE |
Transaction reference already exists | Use a unique transaction reference |
EXPIRED_SESSION |
Payment session has expired | Create a new payment request |
MERCHANT_SUSPENDED |
business account is suspended | Contact TemboPay support |
TemboPay APIs return a short `error` label and a human `message`. Validation failures may also include an `errors` object. There is no separate `error_code` field — treat `error` as the stable machine-readable key.
{
"error": "Payout Rejected",
"message": "Complete KYB approval before requesting payouts."
}
{
"error": "Validation failed",
"message": "The given data was invalid.",
"errors": {
"amount": [
"The amount field is required."
]
}
}
Need assistance with TemboPay API integration? Our technical team provides comprehensive support.