Developer docs

Authenticate with an API key, create invoices, verify payments, receive signed webhooks.

Interactive API reference → OpenAPI schema ReDoc

The reference is generated from the live OpenAPI schema, so it can't drift from the API.

Authentication

Send your secret key as a bearer token. Use sk_test_ for sandbox, sk_live_ for real payments. Keys are shown once — store them securely.

Authorization: Bearer [PLACEHOLDER_SK_LIVE_KEY]

Create an invoice

curl https://api.asolpay.com/api/v1/invoices/ \
  -H "Authorization: Bearer [PLACEHOLDER_SK_LIVE_KEY]" \
  -H "Idempotency-Key: order-4821" \
  -d amount_poisha=25000

$ch = curl_init("https://api.asolpay.com/api/v1/invoices/");
curl_setopt_array($ch, [
  CURLOPT_HTTPHEADER => ["Authorization: Bearer [PLACEHOLDER_SK_LIVE_KEY]"],
  CURLOPT_POSTFIELDS => ["amount_poisha" => 25000],
  CURLOPT_RETURNTRANSFER => true,
]);
$invoice = json_decode(curl_exec($ch), true);

const res = await fetch("https://api.asolpay.com/api/v1/invoices/", {
  method: "POST",
  headers: { Authorization: "Bearer [PLACEHOLDER_SK_LIVE_KEY]" },
  body: new URLSearchParams({ amount_poisha: "25000" }),
});
const invoice = await res.json();

import requests
invoice = requests.post(
    "https://api.asolpay.com/api/v1/invoices/",
    headers={"Authorization": "Bearer [PLACEHOLDER_SK_LIVE_KEY]"},
    data={"amount_poisha": 25000},
).json()

Verifying webhooks

Every delivery is signed HMAC-SHA256 over the raw body with your endpoint secret, plus a timestamp to block replay. Check both headers before trusting the payload:

X-AsolPay-Signature: <hex>
X-AsolPay-Timestamp: <unix seconds>
signature = HMAC_SHA256(secret, f"{timestamp}.{raw_body}")