Developers

An API you can integrate in an afternoon

REST and JSON, Bearer-key authentication, idempotency, signed webhooks and a sandbox with predictable test outcomes.

Quickstart

Create an account and copy your test secret key (vp_test_sk_…) from the dashboard.
Create a payment from your server with an Idempotency-Key.
Listen for payment.succeeded on your webhook endpoint and verify the signature.
Fulfil the order only after the verified webhook, or after GET /payments/{id} returns succeeded.

curl https://script.liberlite.com/api/v1/payments \
  -H "Authorization: Bearer vp_test_sk_…" \
  -H "Idempotency-Key: 5f0c2d1e-order-1042" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 25000,
    "currency": "TZS",
    "country": "TZ",
    "method": "mobile_money",
    "phone": "+255712345678",
    "reference": "order-1042",
    "description": "Order #1042"
  }'

Core endpoints

Method	Path	Purpose
GET	/payment-methods	Methods available to you for a country, currency and amount
POST	/payments	Create a mobile money payment (push to the customer's phone)
GET	/payments/{id}	Retrieve a payment and its current status
GET	/payments	List payments with filters and cursor pagination
POST	/checkout-sessions	Create a hosted checkout session
POST	/payment-links	Create a shareable payment link
POST	/refunds	Refund a payment where the provider supports it
POST	/webhook-endpoints	Register a webhook endpoint and receive its signing secret
GET	/events	List events, and replay with POST /events/{id}/resend

Payment statuses

pending: Sent to the provider; waiting for the customer to approve.
processing: The provider reports the payment is in progress.
succeeded: Confirmed by the provider and verified by VoxoPay.
failed: Declined. See failure_code.
expired: Not completed in time.
cancelled: Cancelled before completion.
unknown: The provider's outcome is not yet certain. VoxoPay reconciles it automatically; do not fulfil yet.
refunded: Refunded in full or in part through the provider.

Webhook signatures

Each delivery carries Webhook-Signature: t=<unix>,v1=<hex>, an HMAC-SHA256 of t + "." + raw_body using your endpoint secret. Reject anything older than 5 minutes and deduplicate on Webhook-Event-Id.

Failed deliveries are retried after 1 m, 5 m, 30 m, 2 h, 6 h, 12 h and 24 h, and you can replay any event from the dashboard or the API.

Get your test keys

Create an account and start building in test mode right away.

Create account