Authentication
A bearer API key on every request. Nothing else — no cookie, no query parameter, no signature to compute.
Developers
A small REST API, and webhooks that tell you what happened
Create a payment from your own system, hand your customer a hosted checkout URL, and let PayMQR tell your server when the payment changes. Plain HTTPS and JSON — there is no SDK to install.
The basics
Everything the API expects from you
Two environments
A test key creates test payments that involve no money; a live key creates live ones. Every response says which.
Money as decimal strings
Amounts are strings like "299.00". The payable amount may carry a unique-paise suffix — that is the amount your customer must send.
Idempotency
Send an idempotency key when creating a payment. Repeating the same request returns the same payment instead of a second one.
Hosted checkout
Open a checkout for a payment and redirect your customer to the URL it returns. You do not build a payment page.
Webhooks
Register an HTTPS endpoint and receive signed events when a payment changes. Retries are automatic.
The shape of it
Three calls to take a payment
Create the payment, open a checkout, then read its status — or let a webhook tell you. The sample key below is a placeholder and will not authenticate.
- Every response is {"success": …, "data": …, "request_id": …}.
- A failure carries an error object instead of data.
- Quote the request_id if you need to ask about a specific call.
# 1. Create a payment
POST /api/v1/payments
Authorization: Bearer pmqr_test_<your-key>
Idempotency-Key: order-1042
{ "order_id": "1042",
"amount": "1240.00",
"description": "Table 7" }
# 2. Open a hosted checkout
POST /api/v1/payments/{payment_id}/checkout
→ { "checkout_url": "https://…/pay/<token>" }
# 3. Read the status
GET /api/v1/payments/{payment_id}
→ { "status": "verified", "livemode": true }Webhooks
Six events, signed with your endpoint's own secret
Register an HTTPS endpoint, choose the events you want, and answer with any 2xx. Anything else is retried with backoff.
- Each delivery carries an HMAC-SHA256 signature so your server can trust the payload.
- Secrets can be rotated, with the previous secret staying valid for a bounded window.
- Test and live endpoints are separate, and only receive their own environment's events.
Event types
- payment.created — a payment order was created.
- payment.processing — a submitted payment is being checked.
- payment.verified — the payment was verified.
- payment.manual_review — it needs your decision.
- payment.failed — the check did not pass.
- payment.expired — it expired without being verified.
Create a test key in a minute
Sign up, generate a test key, and create your first payment. Test payments involve no money and cannot collect any.