Developer preview API v1

Sandbox only. No real funds moved. No production access is granted here. Access requirements

Web + BFF

Keep the credential behind a same-origin BFF

Server-rendered pages submit to a same-origin BFF that holds the credential and creates payments without exposing a secret.

Recommended path

Serve a server-rendered web application whose forms and links are handled by a same-origin BFF. The BFF holds the developer-app credential and issues POST /v1/payments after the customer completes checkout on your pages.

Keep session authority server-side

The browser only exchanges session cookies or same-origin form posts with the BFF. The BFF maps the signed-in merchant to merchant mer_01900000000000000000000000 and never forwards a live credential to the page.

Prohibited

Do not place a live credential in an HTML page, a static asset, or a customer-visible URL. Do not build a public client that calls the payment endpoint directly with a shared secret.

BFF creates the payment

browser_form -> same_origin_BFF -> POST /v1/payments
Authorization: Bearer <developer-app-credential>
Content-Type: application/json

{"amount_minor":1500,"currency":"ZMW","capture_method":"automatic","idempotency_key":"order-1042","setup_future_usage":"none"}