Quickstart

1. Create an organisation and API key

In the WakaPay dashboard:

Become a merchant (if you are not already)
Create an organisation
Create an API key for that organisation
Store the public key and secret securely — the secret is only shown once

2. Sign every merchant request

Merchant endpoints require three headers:

Header	Value
`X-Wakapay-Key`	Your API public key
`X-Wakapay-Timestamp`	Unix time in milliseconds
`X-Wakapay-Signature`	`HMAC-SHA256(secret, "{timestamp}.{rawBody}")` as hex

Sign the exact raw HTTP body bytes. Do not re-serialize JSON before hashing.

import crypto from 'crypto';

function signWakapayRequest({ secret, timestamp, rawBody }) {
  return crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');
}

const timestamp = Date.now().toString();
const body = JSON.stringify({
  user: {
    id: 'cust_123',
    email: 'customer@example.com',
  },
  items: [
    {
      name: 'Pro plan',
      quantity: 1,
      unit_price: 5000,
    },
  ],
  currency: 'XAF',
  expires_in_minutes: 30,
});
const signature = signWakapayRequest({
  secret: process.env.WAKAPAY_API_SECRET,
  timestamp,
  rawBody: body,
});

const res = await fetch('https://api.wakapay.cash/checkout-sessions', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'X-Wakapay-Key': process.env.WAKAPAY_API_KEY,
    'X-Wakapay-Timestamp': timestamp,
    'X-Wakapay-Signature': signature,
    'Idempotency-Key': 'order-42',
  },
  body,
});

const session = await res.json();
// Redirect the payer to your hosted checkout (e.g. checkout.wakapay.cash)

Timestamps older than 5 minutes are rejected.

3. Complete the flow

See also Authentication.