API Documentation

Authentication

Every request needs two headers. The signature is the HMAC-SHA256 of the raw request body (an empty string for GET), keyed with your secret key.

x-merchant-id: MID_XXXXXXXXXXXX
x-signature: hex(hmac_sha256(secret_key, raw_json_body))

1. Create a deposit (pay-in)

POST /payin — send the customer to the checkout_url from the response. Once the payment is verified, the balance is credited automatically and a webhook is sent.

{
  "amount": 500,
  "method": "bkash",          // bkash | nagad | rocket | usdt
  "order_id": "ORDER-1001",   // optional, auto-generated when omitted
  "customer_account": "01712345678",              // optional
  "callback_url": "https://yoursite.com/webhook", // optional
  "redirect_url": "https://yoursite.com/thanks"   // optional
}

2. Withdrawal (pay-out)

POST /payout — the amount is debited from your balance and disbursed automatically.

{
  "amount": 250,
  "method": "nagad",
  "account": "01712345678",
  "order_id": "WD-2001"       // optional
}

3. Transaction status & balance

GET /transaction/{transaction_id}
GET /balance

4. Payment message ingest

Your phone's SMS/notification forwarder posts every bKash, Nagad, Rocket or Binance "money received" message to /notify. The message is parsed and matched against the transaction ID submitted by the customer; on a match the deposit is confirmed automatically and the webhook fires.

POST /notify
{
  "method": "bkash",
  "message": "You have received Tk 500.00 from 01712345678. TrxID 9F3KD1A2B7 ..."
}

Use the same HMAC headers (x-merchant-id, x-signature). Deposits can only be created from your allowed domain, configured in the dashboard.

Node.js example

import crypto from "node:crypto";

const BASE = "https://gopaybdt.life/api/public/v1";
const MERCHANT_ID = "MID_XXXXXXXXXXXX";
const SECRET = "sk_xxxxxxxxxxxxxxxxxxxx";

async function call(path, body, method = "POST") {
  const raw = body ? JSON.stringify(body) : "";
  const signature = crypto.createHmac("sha256", SECRET).update(raw).digest("hex");
  const res = await fetch(BASE + path, {
    method,
    headers: {
      "content-type": "application/json",
      "x-merchant-id": MERCHANT_ID,
      "x-signature": signature,
    },
    body: method === "GET" ? undefined : raw,
  });
  return res.json();
}

// Deposit
const payin = await call("/payin", {
  amount: 500, method: "bkash", order_id: "ORDER-1001",
});
console.log(payin.checkout_url);

// Withdrawal
const payout = await call("/payout", {
  amount: 250, method: "nagad", account: "01712345678", order_id: "WD-2001",
});

Verifying webhooks

We POST to your webhook URL with the same x-signature scheme.

const expected = crypto.createHmac("sha256", SECRET).update(rawBody).digest("hex");
if (expected !== req.headers["x-signature"]) return res.status(401).end();

const event = JSON.parse(rawBody);
// event.event = "payin.success" | "payin.failed" | "payout.success" | "payout.failed"
// event.order_id, event.amount, event.status, event.provider_ref