Payment APIs designed for server-side control.
Build against BudyPay's documented Payin, Payout, status and callback flows using a merchant key and HMAC SHA-256 request authentication.
Sign every API request with the values you actually send.
BudyPay API requests use a valid merchant_key and a secure hash for Payin, Payout and Intent flows.
- Collect required parameters and any optional parameters you send
- URL-encode return_url for Payin hash generation when present
- Sort parameters by key in ascending order
- Join only the values using a pipe separator
- Generate HMAC SHA-256 using merchant_secret
- Never expose merchant_secret in client-side code
$hashData = $formData;
if (!empty($hashData['return_url'])) {
$hashData['return_url'] = urlencode($hashData['return_url']);
}
ksort($hashData);
$message = implode('|', array_values($hashData));
$hash = hash_hmac('sha256', $message, $merchant_secret, false);
$formData['hash'] = $hash;Four core workflows cover most merchant integration needs.
Payin Intent
StartPayment/initiate_payment/
Payin Redirect
ProcessPayment/initiate_payment/
Payout Initiate
StartPayout/initiate_payout
Status APIs
Verify Payin and Payout transaction states.
Use webhooks to react to transaction updates in real time.
Configure your webhook callback URL in the merchant dashboard. BudyPay documents callbacks for status updates including Success, Pending, Failed and Initiated.
- Payin callback includes transaction ID, status, amount and merchant reference
- Payout callback includes reference ID, status, amount, beneficiary details and merchant order
- Your server should acknowledge callbacks with HTTP 200 OK
- Process callbacks idempotently in your own application
{
"transaction_id": "1023442328647192",
"status": "Success",
"amount": "1000.00",
"merchant_reference": "ORDER1001",
"merchant_key": "Merkey123"
}Keep payment state deterministic in your own system.
Generate references server-side
Use unique order IDs and preserve the exact reference you send to BudyPay.
Keep secrets off the client
Generate HMAC hashes only in trusted server-side code.
Store callback payloads
Keep an audit trail of incoming status updates and associated references.
Re-check uncertain states
Use status APIs when a client-side redirect or callback does not give you enough certainty.