Developer API Documentation

const res = await fetch('https://pay.kryznet.com/api/v1/payments', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer kpt_live_xxxxxxxxxxxxxxxxxxxxxxxx',
    'Content-Type': 'application/json',
    'Idempotency-Key': 'order-1234'
  },
  body: JSON.stringify({
    amount_sen: 1200, // Base price: RM 12.00
    order_ref: 'TOPUP-1234',
    expected_payer: 'Ahmad'
  })
});

const data = await res.json();
console.log('Customer Payment URL:', data.pay_url);
console.log('Direct QR Code Image:', data.qr_image);
console.log('Exact Amount Customer Must Pay:', data.payment.amount_myr); // e.g. RM 12.28

import requests

headers = {
    'Authorization': 'Bearer kpt_live_xxxxxxxxxxxxxxxxxxxxxxxx',
    'Content-Type': 'application/json',
    'Idempotency-Key': 'order-1234'
}

payload = {
    'amount_sen': 1200, # Base price: RM 12.00
    'order_ref': 'TOPUP-1234',
    'expected_payer': 'Ahmad'
}

res = requests.post('https://pay.kryznet.com/api/v1/payments', json=payload, headers=headers)
data = res.json()
print('Customer Payment URL:', data['pay_url'])
print('Direct QR Code Image:', data.get('qr_image'))
print('Exact Amount Customer Must Pay:', data['payment']['amount_myr'])

<?php
$ch = curl_init('https://pay.kryznet.com/api/v1/payments');
$payload = json_encode([
    'amount_sen' => 1200, // Base price: RM 12.00
    'order_ref' => 'TOPUP-1234',
    'expected_payer' => 'Ahmad'
]);

curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => $payload,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer kpt_live_xxxxxxxxxxxxxxxxxxxxxxxx',
        'Content-Type: application/json',
        'Idempotency-Key: order-1234'
    ]
]);

$response = curl_exec($ch);
curl_close($ch);
$data = json_decode($response, true);
echo "Payment URL: " . $data['pay_url'] . "\n";
echo "QR Image: " . $data['qr_image'] . "\n";
echo "Amount to Pay: RM " . $data['payment']['amount_myr'];

const res = await fetch('https://pay.kryznet.com/api/v1/payments/PG-6C5CB378', {
  headers: { 'Authorization': 'Bearer kpt_live_xxxxxxxxxxxxxxxxxxxxxxxx' }
});
const data = await res.json();
if (data.payment.status === 'received') {
  console.log('Payment settled! Order confirmed. Reference:', data.payment.reference);
}

import requests

res = requests.get(
    'https://pay.kryznet.com/api/v1/payments/PG-6C5CB378',
    headers={'Authorization': 'Bearer kpt_live_xxxxxxxxxxxxxxxxxxxxxxxx'}
)
data = res.json()
if data['payment']['status'] == 'received':
    print('Payment confirmed! Reference:', data['payment']['reference'])

<?php
$ch = curl_init('https://pay.kryznet.com/api/v1/payments/PG-6C5CB378');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer kpt_live_xxxxxxxxxxxxxxxxxxxxxxxx'
    ]
]);

$response = curl_exec($ch);
curl_close($ch);
$data = json_decode($response, true);
if ($data['payment']['status'] === 'received') {
    echo "Payment confirmed! Order ref: " . $data['payment']['order_ref'];
}

const express = require('express');
const crypto = require('crypto');
const app = express();

// IMPORTANT: Parse raw body as Buffer or UTF-8 string to preserve exact JSON bytes
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const secret = process.env.KPT_WEBHOOK_SECRET; // from Merchant Dashboard
  const timestamp = req.headers['x-kpt-timestamp'];
  const signature = req.headers['x-kpt-signature'];
  const delivery = req.headers['x-kpt-delivery']; // sequential attempt id, useful for logs
  const rawBody = req.body.toString('utf8');

  // 1. Defend against replay attacks: reject requests older than 5 minutes
  if (!timestamp || Math.abs(Date.now() - Number(timestamp)) > 300_000) {
    return res.status(400).send('Timestamp expired or invalid');
  }

  // 2. Compute expected HMAC-SHA256 signature over "<timestamp>.<rawBody>"
  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');

  // 3. Timing-safe comparison to prevent side-channel timing leaks
  let valid = false;
  try {
    valid = crypto.timingSafeEqual(Buffer.from(signature, 'hex'), Buffer.from(expected, 'hex'));
  } catch (_) {
    valid = false;
  }

  if (!valid) {
    return res.status(401).send('Invalid signature');
  }

  // 4. Handle event. Deduplicate on payment reference + event type
  // (retries reuse the same event; X-KPT-Delivery is a fresh id per attempt).
  const payload = JSON.parse(rawBody);
  if (payload.event === 'payment.received') {
    const payment = payload.data.payment;
    console.log(`[delivery ${delivery}] Order ${payment.order_ref} settled! Base: RM ${payment.base_amount_myr}`);
    // Credit your customer or deliver digital goods here.
    // IMPORTANT: make this idempotent — the same reference can arrive again on retry.
  }

  // 5. Must return HTTP 2xx within 10 seconds
  res.status(200).json({ received: true });
});

app.listen(3000);

import hmac
import hashlib
import time
from flask import Flask, request, jsonify

app = Flask(__name__)
WEBHOOK_SECRET = "your_webhook_secret_here".encode('utf-8')

@app.route('/webhook', methods=['POST'])
def webhook_handler():
    timestamp = request.headers.get('X-KPT-Timestamp', '')
    signature = request.headers.get('X-KPT-Signature', '')
    delivery = request.headers.get('X-KPT-Delivery', '')  # sequential attempt id, useful for logs
    raw_body = request.get_data() # Raw bytes

    # 1. Defend against replay attacks: reject requests older than 5 minutes
    try:
        ts_ms = int(timestamp)
        if abs(time.time() * 1000 - ts_ms) > 300000:
            return jsonify({'error': 'Timestamp expired'}), 400
    except ValueError:
        return jsonify({'error': 'Invalid timestamp'}), 400

    # 2. Compute expected HMAC-SHA256 over "<timestamp>.<raw_body>"
    signed_payload = f"{timestamp}.".encode('utf-8') + raw_body
    expected = hmac.new(WEBHOOK_SECRET, signed_payload, hashlib.sha256).hexdigest()

    # 3. Timing-safe comparison
    if not hmac.compare_digest(signature, expected):
        return jsonify({'error': 'Invalid signature'}), 401

    # 4. Handle event. Deduplicate on payment reference + event type.
    payload = request.get_json()
    if payload.get('event') == 'payment.received':
        payment = payload['data']['payment']
        print(f"[delivery {delivery}] Settled order {payment.get('order_ref')} for RM {payment.get('base_amount_myr')}")
        # IMPORTANT: make this idempotent — the same reference can arrive again on retry.

    # 5. Return HTTP 2xx
    return jsonify({'received': True}), 200

if __name__ == '__main__':
    app.run(port=3000)

<?php
$secret = 'your_webhook_secret_here';
$timestamp = $_SERVER['HTTP_X_KPT_TIMESTAMP'] ?? '';
$signature = $_SERVER['HTTP_X_KPT_SIGNATURE'] ?? '';
$delivery  = $_SERVER['HTTP_X_KPT_DELIVERY'] ?? ''; // sequential attempt id, useful for logs
$rawBody = file_get_contents('php://input');

// 1. Defend against replay attacks (5 minute threshold)
$nowMs = round(microtime(true) * 1000);
if (abs($nowMs - (int)$timestamp) > 300000) {
    http_response_code(400);
    exit(json_encode(['error' => 'Timestamp expired']));
}

// 2. Compute expected HMAC-SHA256
$expected = hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);

// 3. Timing-safe comparison
if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    exit(json_encode(['error' => 'Invalid signature']));
}

// 4. Handle event. Deduplicate on payment reference + event type.
$payload = json_decode($rawBody, true);
if (($payload['event'] ?? '') === 'payment.received') {
    $payment = $payload['data']['payment'] ?? [];
    error_log("[delivery $delivery] Settled order " . ($payment['order_ref'] ?? '?')
        . " for RM " . ($payment['base_amount_myr'] ?? '?'));
    // IMPORTANT: make this idempotent — the same reference can arrive again on retry.
}

// 5. Acknowledge with 200 OK
http_response_code(200);
echo json_encode(['received' => true]);