Katpay API Documentation

const headers = {
  'Authorization': `Bearer ${apiSecret}`,
  'Content-Type': 'application/json',
  'api-key': apiKey
};

$headers = [
    'Authorization: Bearer ' . $apiSecret,
    'Content-Type: application/json',
    'api-key: ' . $apiKey
];

headers = {
    'Authorization': f'Bearer {api_secret}',
    'Content-Type': 'application/json',
    'api-key': api_key
}

const payout = await fetch('https://api.katpay.co/v1/payouts', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer YOUR_SECRET_KEY',
    'Content-Type': 'application/json',
    'api-key': 'YOUR_PUBLIC_KEY'
  },
  body: JSON.stringify({
    amount: 5000,
    bank_code: "000013",
    account_number: "0123456789",
    account_name: "Sadeeq Doe",
    description: "Salary Payment",
    reference: "PAY_123456789"
  })
});

const data = await payout.json();
console.log(data);

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.katpay.co/v1/payouts",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_POST => true,
  CURLOPT_POSTFIELDS => json_encode([
    "amount" => 5000,
    "bank_code" => "000013",
    "account_number" => "0123456789",
    "account_name" => "Sadeeq Doe",
    "description" => "Salary Payment",
    "reference" => "PAY_123456789"
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer YOUR_SECRET_KEY",
    "Content-Type: application/json",
    "api-key: YOUR_PUBLIC_KEY"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error: " . $err;
} else {
  echo $response;
}

{
  "success": false,
  "message": "Payout could not be processed. Your balance has been refunded.",
  "data": {
    "reference": "PAY_123456789",
    "status": "failed"
  }
}

<?php
/**
 * KatPay Webhook Handler
 * Replace YOUR_SECRET_KEY with your Live Secret Key from KatPay
 */

// Your Live Secret Key from KatPay dashboard
$SECRET_KEY = 'your-webhook-secret-key';

// Get webhook data
$payload = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_KATPAY_SIGNATURE'] ?? '';
$timestamp = $_SERVER['HTTP_X_KATPAY_TIMESTAMP'] ?? '';

header('Content-Type: application/json');

try {
    // Validate secret key is set
    if (empty($SECRET_KEY) || $SECRET_KEY === 'your-webhook-secret-key') {
        http_response_code(500);
        echo json_encode(['error' => 'Webhook secret not configured']);
        exit;
    }

    // Validate required headers
    if (empty($signature) || empty($timestamp)) {
        http_response_code(400);
        echo json_encode(['error' => 'Missing required headers']);
        exit;
    }

    // Verify signature
    $signedPayload = $timestamp . '.' . $payload;
    $expectedSignature = hash_hmac('sha256', $signedPayload, $SECRET_KEY);

    if (!hash_equals($expectedSignature, $signature)) {
        http_response_code(401);
        echo json_encode(['error' => 'Invalid signature']);
        exit;
    }

    // Process webhook
    $data = json_decode($payload, true);
    
    if (json_last_error() !== JSON_ERROR_NONE) {
        http_response_code(400);
        echo json_encode(['error' => 'Invalid JSON payload']);
        exit;
    }

    $eventType = $data['event_type'] ?? '';

    // Handle payment received event
    if ($eventType === 'virtual_account.payment_received') {
        $transaction = $data['data']['transaction'] ?? [];
        $customer = $data['data']['customer'] ?? [];
        
        $amount = $transaction['order_amount'] ?? 0;
        $orderNo = $transaction['order_no'] ?? '';
        $transactionId = $transaction['id'] ?? '';
        $customerEmail = $customer['email'] ?? '';
        $customerPhone = $customer['phone'] ?? '';
        
        // Your business logic here
        // Example: Update database, send confirmation email, etc.
        
        // Respond with success
        http_response_code(200);
        echo json_encode([
            'status' => 'success',
            'message' => 'Payment processed'
        ]);
    } else {
        // Handle other event types
        http_response_code(200);
        echo json_encode([
            'status' => 'success',
            'message' => 'Event received'
        ]);
    }

} catch (Exception $e) {
    http_response_code(500);
    echo json_encode(['error' => 'Internal server error']);
}
?>

from flask import Flask, request, jsonify
import hmac
import hashlib
import json

app = Flask(__name__)

# Your Live Secret Key from KatPay dashboard
SECRET_KEY = 'your-webhook-secret-key'

@app.route('/webhook', methods=['POST'])
def handle_webhook():
    try:
        # Get webhook data
        payload = request.get_data(as_text=True)
        signature = request.headers.get('X-Katpay-Signature', '')
        timestamp = request.headers.get('X-Katpay-Timestamp', '')
        
        # Validate secret key
        if not SECRET_KEY or SECRET_KEY == 'your-webhook-secret-key':
            return jsonify({'error': 'Webhook secret not configured'}), 500
        
        # Validate required headers
        if not signature or not timestamp:
            return jsonify({'error': 'Missing required headers'}), 400
        
        # Verify signature
        signed_payload = f"{timestamp}.{payload}"
        expected_signature = hmac.new(
            SECRET_KEY.encode('utf-8'),
            signed_payload.encode('utf-8'),
            hashlib.sha256
        ).hexdigest()
        
        if not hmac.compare_digest(expected_signature, signature):
            return jsonify({'error': 'Invalid signature'}), 401
        
        # Process webhook
        data = json.loads(payload)
        event_type = data.get('event_type', '')
        
        # Handle payment received event
        if event_type == 'virtual_account.payment_received':
            transaction = data.get('data', {}).get('transaction', {})
            customer = data.get('data', {}).get('customer', {})
            
            amount = transaction.get('order_amount', 0)
            order_no = transaction.get('order_no', '')
            transaction_id = transaction.get('id', '')
            customer_email = customer.get('email', '')
            customer_phone = customer.get('phone', '')
            
            # Your business logic here
            # Example: Update database, send confirmation email, etc.
            
            return jsonify({
                'status': 'success',
                'message': 'Payment processed'
            }), 200
        
        # Handle other event types
        return jsonify({
            'status': 'success',
            'message': 'Event received'
        }), 200
        
    except Exception as e:
        return jsonify({'error': 'Internal server error'}), 500

if __name__ == '__main__':
    app.run(port=5000)

const express = require('express');
const crypto = require('crypto');

const app = express();

// Your Live Secret Key from KatPay dashboard
const SECRET_KEY = 'your-webhook-secret-key';

// Middleware to get raw body for signature verification
app.use(express.json({
    verify: (req, res, buf) => {
        req.rawBody = buf.toString('utf8');
    }
}));

app.post('/webhook', (req, res) => {
    try {
        // Get webhook data
        const payload = req.rawBody;
        const signature = req.headers['x-katpay-signature'] || '';
        const timestamp = req.headers['x-katpay-timestamp'] || '';
        
        // Validate secret key
        if (!SECRET_KEY || SECRET_KEY === 'your-webhook-secret-key') {
            return res.status(500).json({ error: 'Webhook secret not configured' });
        }
        
        // Validate required headers
        if (!signature || !timestamp) {
            return res.status(400).json({ error: 'Missing required headers' });
        }
        
        // Verify signature
        const signedPayload = `${timestamp}.${payload}`;
        const expectedSignature = crypto
            .createHmac('sha256', SECRET_KEY)
            .update(signedPayload)
            .digest('hex');
        
        if (expectedSignature !== signature) {
            return res.status(401).json({ error: 'Invalid signature' });
        }
        
        // Process webhook
        const data = req.body;
        const eventType = data.event_type || '';
        
        // Handle payment received event
        if (eventType === 'virtual_account.payment_received') {
            const transaction = data.data?.transaction || {};
            const customer = data.data?.customer || {};
            
            const amount = transaction.order_amount || 0;
            const orderNo = transaction.order_no || '';
            const transactionId = transaction.id || '';
            const customerEmail = customer.email || '';
            const customerPhone = customer.phone || '';
            
            // Your business logic here
            // Example: Update database, send confirmation email, etc.
            
            return res.status(200).json({
                status: 'success',
                message: 'Payment processed'
            });
        }
        
        // Handle other event types
        return res.status(200).json({
            status: 'success',
            message: 'Event received'
        });
        
    } catch (error) {
        return res.status(500).json({ error: 'Internal server error' });
    }
});

app.listen(3000, () => {
    console.log('Webhook server running on port 3000');
});