HashBack & HashPay APIs

const res = await fetch('https://api.hashback.co.ke/decode', {
  method: 'POST',
  headers: { 'API_KEY': 'YOUR_API_KEY_HERE' },
  body: new URLSearchParams({
    hash: '4f87c55d393937f18fbf3003512195aa8e62be340946ab547c2eada26cc43c1e'
  })
});

const { MSISDN } = await res.json();
console.log(MSISDN); // "254712345678"

<?php
$ch = curl_init('https://api.hashback.co.ke/decode');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS,
  http_build_query(['hash' => '4f87c55d...'])
);
curl_setopt($ch, CURLOPT_HTTPHEADER, ['API_KEY: YOUR_API_KEY_HERE']);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$r = json_decode(curl_exec($ch), true);
curl_close($ch);
echo $r['MSISDN']; // 254712345678
?>

import requests

r = requests.post(
    'https://api.hashback.co.ke/decode',
    data={'hash': '4f87c55d...'},
    headers={'API_KEY': 'YOUR_API_KEY_HERE'}
)
print(r.json()['MSISDN'])  # 254712345678

<script src="https://pay.hashback.co.ke/hashpay.js"></script>

<button class="hashpay-button"
        data-account="HP945692"
        data-amount="100"
        data-reference="order_12345">Pay KES 100</button>

No JavaScript needed. Auto-bound buttons emit DOM events on themselves: hashpay:success, hashpay:cancel, hashpay:error (payload on event.detail).

const crypto = require('crypto');

// Express example — use express.raw() to get the raw buffer
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const secret    = 'YOUR_WEBHOOK_SECRET';
  const sigHeader = req.headers['x-hashpay-signature'] ?? '';
  const expected  = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(req.body)          // raw Buffer
    .digest('hex');

  const valid = crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(sigHeader)
  );

  if (!valid) return res.status(401).send('Invalid signature');

  const payload = JSON.parse(req.body.toString());

  if (payload.event === 'payment.success' && payload.ResponseCode === 0) {
    const { TransactionID, TransactionReference, Msisdn } = payload;
    // fulfil the order ...
  }

  res.status(200).send('OK');
});

import hmac, hashlib
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = b'YOUR_WEBHOOK_SECRET'

@app.route('/webhook', methods=['POST'])
def webhook():
    raw_body   = request.get_data()   # raw bytes, before any parsing
    sig_header = request.headers.get('X-Hashpay-Signature', '')

    expected = 'sha256=' + hmac.new(
        SECRET, raw_body, hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(expected, sig_header):
        abort(401)

    payload = request.get_json()

    if payload.get('event') == 'payment.success' and payload.get('ResponseCode') == 0:
        tx_id = payload['TransactionID']         # "UEC496402X"
        ref   = payload['TransactionReference']   # your order ref
        # fulfil the order ...

    return '', 200

const res = await fetch('https://api.hashback.co.ke/walletbalance', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ api_key: 'KEY', account_id: 'WALLET_ID' })
});
const { balance, status } = await res.json();
console.log(`KES ${balance} — ${status}`);

import requests

r = requests.post(
    'https://api.hashback.co.ke/walletbalance',
    json={'api_key': 'KEY', 'account_id': 'WALLET_ID'}
)
data = r.json()
print(f"KES {data['balance']} — {data['status']}")

{
  "success": false,
  "message": "Transaction not found"
}

const res = await fetch(
  'https://p2p.hashback.co.ke/api/v1/query?tx_code=QH7X8LKJ22',
  { headers: { 'X-Api-Key': 'YOUR_API_KEY' } }
);
const data = await res.json();

$ch = curl_init(
    'https://p2p.hashback.co.ke/api/v1/query?tx_code=' . urlencode('QH7X8LKJ22')
);
curl_setopt_array($ch, [
    CURLOPT_HTTPHEADER     => ['X-Api-Key: YOUR_API_KEY'],
    CURLOPT_RETURNTRANSFER => true,
]);
$data = json_decode(curl_exec($ch), true);

curl -X POST https://p2p.hashback.co.ke/api/v1/confirm \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 1500,
    "name": "John Doe",
    "phone": "0704971999"
  }'

const res = await fetch('https://p2p.hashback.co.ke/api/v1/confirm', {
  method: 'POST',
  headers: {
    'X-Api-Key': 'YOUR_API_KEY',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    amount: 1500,
    name: 'John',        // partial name match works
    phone: '0704***999'  // masked phone works too
  })
});
const data = await res.json();

const crypto = require('crypto');

app.post('/webhook/hashpeer', express.raw({ type: 'application/json' }), (req, res) => {
  const secret   = process.env.HASHPEER_WEBHOOK_SECRET;
  const sig      = req.headers['x-hashpeer-signature'];
  const expected = crypto
    .createHmac('sha256', secret)
    .update(req.body)
    .digest('hex');

  if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(sig))) {
    return res.status(401).send('Signature mismatch');
  }

  const { event, transaction } = JSON.parse(req.body);
  // handle event …
  res.status(200).end();
});

import hmac, hashlib
from flask import request, abort

SECRET = b'YOUR_WEBHOOK_SECRET'

@app.route('/webhook/hashpeer', methods=['POST'])
def hashpeer_webhook():
    sig      = request.headers.get('X-HashPeer-Signature', '')
    expected = hmac.new(SECRET, request.data, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, sig):
        abort(401)
    payload = request.get_json()
    event   = payload['event']
    tx      = payload['transaction']
    return '', 200