RozPay API Documentation

Welcome to the official developer documentation for the RozPay API. Easily integrate secure, high-speed payments for your color trading platforms, slot games, 3 Patti, and other gaming or investment websites. We make accepting deposits and sending withdrawals simple, secure, and fully automated.

Environments

We provide two environments for your integration needs. Please use the testing environment during your development phase to avoid initiating real financial transactions.

Authentication

Authentication is handled via HTTP Headers. You must include your API Key in the x-api-key header and a cryptographic signature in the x-signature header for every request. You can find your API keys in your Merchant Panel under API Settings.

Content-Type: application/json
x-api-key: your_live_api_key_here
x-signature: hmac_sha256_hex_signature

Creating the Signature

The x-signature must be an HMAC-SHA256 hash of your exact raw JSON request body, signed using your API Secret Key.

<?php
$apiKey = 'your_api_key';
$apiSecret = 'your_api_secret';

$payload = json_encode([
    'amount' => 500,
    'currency' => 'PKR',
    'method' => 'easypaisa',
    'order_id' => 'ORD-12345'
]);

$signature = hash_hmac('sha256', $payload, $apiSecret);

// Attach $apiKey and $signature to your cURL headers

Initiate Payin (Deposit)

Create a deposit request. Your user will be redirected to the payment page to complete the transaction using their chosen method (Easypaisa, Jazzcash, UPI, or USDT).

{
  "status": "success",
  "message": "Payment initiated",
  "data": {
    "transaction_id": "TXN-2026-99382",
    "payment_url": "https://rozpay.pro/pay/checkout/TXN-2026-99382"
  }
}

Initiate Payout (Withdrawal)

Send money to your users automatically. You can collect payments in UPI and payout in Easypaisa, or collect in PKR and withdraw to your own USDT wallet directly from the merchant panel.

Webhooks

Since payment processing takes a few seconds (or longer if the user takes time), we send an HTTP POST request to your provided callback_url the exact moment a transaction succeeds or fails.

{
  "event": "payment.completed",
  "transaction_id": "TXN-2026-99382",
  "order_id": "ORD-12345",
  "amount": 500,
  "status": "success",
  "signature": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
}

Verifying Webhook Signatures

To ensure the webhook actually came from RozPay and not a hacker, you MUST verify the signature. Compute an HMAC-SHA256 hash using your API Secret over the raw body (excluding the signature field itself).

const crypto = require('crypto');

app.post('/webhook', (req, res) => {
    const payload = req.body;
    const receivedSignature = payload.signature;
    
    // Remove signature from payload before verification
    delete payload.signature;
    const rawBody = JSON.stringify(payload);
    
    const expectedSignature = crypto
        .createHmac('sha256', process.env.ROZPAY_API_SECRET)
        .update(rawBody)
        .digest('hex');
        
    if (expectedSignature === receivedSignature) {
        // Mark order as paid in DB
        res.status(200).send('OK');
    } else {
        res.status(403).send('Invalid signature');
    }
});