JKAPay

Quickstart

Accept your first mobile-money payment in under five minutes. You'll create a merchant account, issue an API key, stand up a webhook endpoint, and run a real test transaction.

1. Create an account

Sign up on the registration page. Your account starts in PENDING review until an admin approves it for Live traffic, but you can issue Test keys and run end-to-end transactions immediately.

2. Issue an API key

From your dashboard, open API keys → New API key. Pick a descriptive label and the TEST environment, then store the secret somewhere safe — JKAPay shows it once at creation and never displays it again.

Treat secret keys like passwords. Never commit them to source control, never ship them in browser-side code, and rotate them whenever a teammate leaves.

3. Stand up a callback endpoint

JKAPay delivers final transaction state to a URL on your server. For local development, services like webhook.site work well. In production, point JKAPay at an HTTPS endpoint you control — e.g. https://example.com. The endpoint receives a signed POST every time a transaction settles. See Webhooks for the full payload and signing recipe.

4. Initialize your first payment

Replace sk_test_… and MCH_… with the values from your dashboard. The callbackUrl below is where JKAPay will POST the final state.

cURL
curl -X POST https://api.jkapay.com/v1/payments/initialize \
  -H "Authorization: Bearer sk_test_YOUR_KEY" \
  -H "X-JKAPay-Merchant-Id: MCH_XXXXXXXXXXXX" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": "1.00",
    "customer": {
      "msisdn": "0244000000",
      "network": "MTN"
    },
    "description": "Test payment",
    "callbackUrl": "https://example.com",
    "merchantRef": "ORDER-12345",
    "idempotencyKey": "ORDER-12345"
  }'

The customer's phone receives a mobile-money prompt. As soon as they authorise the payment, JKAPay POSTs a signed webhook to the callbackUrl you supplied.

5. Verify the webhook

Read Verifying webhook signatures before going live. Always verify the HMAC before acting on a webhook — never trust an unverified payload.

What's next