GatePay · Developers

Payment Verification API

Public endpoint that lets partner sites confirm a payment matches a transaction recorded in GatePay, and stamp it with the verifier's business identity.

Overview

GatePay exposes two primary flows and supporting endpoints for partner sites:

  1. Submit — your server POSTs a transaction when an order is placed. It lands in GatePay as unverified.
  2. Verify callback (GatePay → your site) — a GatePay admin selects unverified transactions and clicks Trigger verify. GatePay groups them by business, POSTs each group to your configured callback_url, and on a 2xx response stamps them as verified.
  3. Verify on demand (your site → GatePay) — your server can also call this endpoint directly to check a single transaction's status.

All endpoints require an API key via the Authorization: Bearer header (except health & OpenAPI spec). Manage keys from Admin → API Keys. The full token is shown only once on creation.

POST — Submit transaction

Creates an unverified transaction in GatePay. Call this when an order is placed on your end. Safe to retry with the Idempotency-Key header.

Endpoint

http
POST https://pay.darvizlabs.com/api/v1/public/transactions/submit

Headers

http
Authorization: Bearer YOUR_API_KEY

Request body

FieldTypeRequiredNotes
transaction_refstring (1–120)YesYour unique transaction ID.
amountnumber ≥ 0YesPayment amount.
currencystring (≤8)NoDefaults to 'BDT'.
occurred_atISO 8601 datetimeNoDefaults to now().
methodstring (≤40)Noe.g. 'bkash', 'card', 'nagad'.
business_namestring (1–160)No*Falls back to the API key's business_name.
external_user_idstring (≤160)NoYour end-user ID for cross-reference.
sourcestring (≤160)NoFree-form tag, e.g. 'web-checkout'.
notesstring (≤2000)NoFree-form notes.

Example

json
{
  "transaction_ref": "INV-2026-00482",
  "amount": 1499,
  "currency": "BDT",
  "method": "bkash",
  "business_name": "Nerdy",
  "external_user_id": "user_8821",
  "source": "web-checkout",
  "occurred_at": "2026-05-27T10:00:00Z"
}

POST — Verify transaction

Checks if a submitted transaction matches a known ref. Returns the transaction details if found. Use when you need to confirm a specific payment on demand.

Endpoint

http
POST https://pay.darvizlabs.com/api/v1/public/transactions/verify

Headers

http
Authorization: Bearer YOUR_API_KEY

Request body

FieldTypeRequiredNotes
transaction_refstring (1–120)YesTransaction ID to look up. Case-insensitive.
business_namestring (1–160)YesMust match the API key's business_name.
external_user_idstring (≤160)NoYour internal user ID, stored on the transaction.
dateISO date / datetimeNoIf set, must match the transaction's UTC day.
amountnumber ≥ 0NoIf set, must equal recorded amount exactly.
sourcestring (≤160)NoFree-form audit label.

Example

json
{
  "transaction_ref": "INV-2026-00482",
  "business_name": "Nerdy",
  "external_user_id": "user_8821",
  "date": "2026-05-27",
  "amount": 1499,
  "source": "web-checkout"
}

POST — Review transaction

Submits a client-side review (confirmed amount + note) against an existing transaction. Use when you want your customer or internal team to confirm or annotate a recorded transaction.

Endpoint

http
POST https://pay.darvizlabs.com/api/v1/public/transactions/review

Headers

http
Authorization: Bearer YOUR_API_KEY

Request body

FieldTypeRequiredNotes
transaction_idstringYesTransaction ID returned by the submit endpoint.
amountnumber ≥ 0YesConfirmed amount for the transaction.
notestring (≤2000)YesReview note or feedback.

Example

json
{
  "transaction_id": "jf3m2k9x1p",
  "amount": 1499,
  "note": "Payment confirmed by customer — project setup fee."
}

Verify callback (GatePay → your site)

When an admin clicks Trigger verify in the dashboard, GatePay groups the selected transactions by business name, finds the matching API key's callback_url, and POSTs each group to that URL. Your 2xx response is the verification — nothing more needed.

What is a callback URL?

A callback URL is an HTTP endpoint on your own server that GatePay calls to confirm a batch of transactions. Example: https://api.nerdy.com/gatekeepr/verify. It must be HTTPS, must return a 2xx to confirm verification, and you can verify the request via the X-GatePay-Signature HMAC header.

Why verify fails from the admin

If your API key has no callback_url set, or the URL is unreachable (like https://example.com/verify), the admin verification will show skipped_no_callback or callback_timeout. Set a real callback URL on your API key in Admin → API Keys.

Request GatePay sends

http
POST <your callback_url>
Content-Type: application/json
X-GatePay-Signature: sha256=<hex hmac>
User-Agent: GatePay-Verify/1.0

{
  "business_name": "Nerdy",
  "sent_at": "2026-05-27T16:30:00.000Z",
  "transactions": [
    {
      "transaction_ref": "INV-2026-00482",
      "amount": 1499.00,
      "currency": "BDT",
      "occurred_at": "2026-05-27T10:00:00.000Z",
      "method": "bkash",
      "external_user_id": "user_8821",
      "source": "web-checkout"
    }
  ]
}

What your endpoint should do

  1. Verify the X-GatePay-Signature HMAC (optional but recommended).
  2. For each transaction, look it up in your own DB and confirm it matches a real order.
  3. Respond 2xx if everything checks out — GatePay stamps the batch as verified.
  4. Respond with a non-2xx status and a JSON error body on failure.
  5. You do not need to call the verify endpoint from inside the callback.

GET — Health check

Lightweight endpoint to verify the API is operational. No auth required.

http
GET https://pay.darvizlabs.com/api/v1/public/health
json
{"status":"ok"}

Error codes

StatusResponseMeaning
201{"received":true,"status":"unverified"}Submit success
200{"verified":true,"transaction":{...}}Transaction matches
200{"verified":false,"reason":"not_found"}No matching transaction
200{"verified":false,"reason":"date_mismatch"}Date doesn't match
200{"verified":false,"reason":"amount_mismatch"}Amount doesn't match
400{"error":"invalid_body","issues":[...]}Zod validation failed
400{"error":"invalid_json"}Body is not valid JSON
401{"error":"missing_api_key"}No Authorization header
401{"error":"invalid_api_key"}Token unknown or revoked
409{"error":"duplicate_ref"}Ref already exists (submit)
413{"error":"body_too_large"}Body exceeds 10 KB
429{"error":"rate_limited"}IP rate limit hit (30/60 req/min)
429{"error":"key_rate_limited"}Key rate limit hit (100 req/min)
500{"verified":false,"reason":"lookup_error"}Server / DB error

Every response includes an x-request-id header. Include this when reporting issues.

Security

  • All endpoints require HTTPS. HTTP requests are rejected.
  • API keys are hashed with SHA-256 before storage. Revocation is immediate.
  • Tenant isolation: keys can only verify transactions matching their own business_name.
  • Rate limits: verify 30 req/min/IP, submit 60 req/min/IP, 100 req/min per key.
  • Request body limited to 10 KB. CSRF enforced when Origin/Referer is present.
  • Responses include Strict-Transport-Security and X-Content-Type-Options.
  • Callback URLs must use HTTPS. Callbacks have a 15-second timeout.
  • Callback signatures use HMAC-SHA256 with your key's signing_secret.
Questions? Contact the GatePay team.