Documentation API

POST/payments/create

Initie un paiement. Le client reçoit une demande de confirmation sur son téléphone.

curl -X POST https://api.kadopay.africa/v1/payments/create \
  -H "Authorization: Bearer sk_test_xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 15000,
    "currency": "XOF",
    "operator": "wave",
    "customer_phone": "+221770000000",
    "description": "Commande #1024",
    "callback_url": "https://monsite.com/merci"
  }'

Réponse

{
  "id": "KDP-8F3A21C9D0",
  "status": "pending",
  "amount": 15000,
  "fee": 900,
  "net_amount": 14100,
  "currency": "XOF",
  "operator": "wave"
}

GET/payments/verify/:id

Vérifie le statut final : pending, success, failed ou cancelled.

curl https://api.kadopay.africa/v1/payments/verify/KDP-8F3A21C9D0 \
  -H "Authorization: Bearer sk_test_xxx"

Webhooks

À chaque changement de statut, Zymomo envoie un POST à votre URL avec l'en-tête X-KadoPay-Signature = HMAC-SHA256(secret, corps brut). Vérifiez-le avant tout traitement.

import crypto from "crypto";

const expected = crypto
  .createHmac("sha256", process.env.KADOPAY_WEBHOOK_SECRET)
  .update(rawBody)
  .digest("hex");

const valid = crypto.timingSafeEqual(
  Buffer.from(expected),
  Buffer.from(req.headers["x-kadopay-signature"]),
);

Erreurs