HashBack & HashPay APIs

Request parameters

Code examples

curl -X POST https://api.hashback.co.ke/decode \
  -d 'hash=4f87c55d393937f18fbf3003512195aa8e62be340946ab547c2eada26cc43c1e' \
  -H 'API_KEY: YOUR_API_KEY_HERE'

const res = await fetch('https://api.hashback.co.ke/decode', {
  method: 'POST',
  headers: { 'API_KEY': 'YOUR_API_KEY_HERE' },
  body: new URLSearchParams({
    hash: '4f87c55d393937f18fbf3003512195aa8e62be340946ab547c2eada26cc43c1e'
  })
});

const { MSISDN } = await res.json();
console.log(MSISDN); // "254712345678"

<?php
$ch = curl_init('https://api.hashback.co.ke/decode');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS,
  http_build_query(['hash' => '4f87c55d...'])
);
curl_setopt($ch, CURLOPT_HTTPHEADER, ['API_KEY: YOUR_API_KEY_HERE']);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$r = json_decode(curl_exec($ch), true);
curl_close($ch);
echo $r['MSISDN']; // 254712345678
?>

import requests

r = requests.post(
    'https://api.hashback.co.ke/decode',
    data={'hash': '4f87c55d...'},
    headers={'API_KEY': 'YOUR_API_KEY_HERE'}
)
print(r.json()['MSISDN'])  # 254712345678

Response

{
  "ResultCode": "0",
  "MSISDN":     "254712345678"
}

How many service tokens the authenticated account has left, and the plan rate they were bought at. Free — this call never spends a token. Each decode costs one token, so the balance is also your remaining decode count. Poll it before a batch job, or on your own dashboard, so a run doesn't stop halfway on an empty balance.

Request parameters

Code examples

curl https://api.hashback.co.ke/credits/balance \
  -H 'API_KEY: YOUR_API_KEY_HERE'

const res = await fetch('https://api.hashback.co.ke/credits/balance', {
  headers: { 'API_KEY': 'YOUR_API_KEY_HERE' }
});

const { balance, rate_per_token } = await res.json();
console.log(`${balance} tokens left`); // "480 tokens left"

// Stop a batch before it runs dry
if (balance < rows.length) throw new Error('Top up before running this batch');

<?php
$ch = curl_init('https://api.hashback.co.ke/credits/balance');
curl_setopt($ch, CURLOPT_HTTPHEADER, ['API_KEY: YOUR_API_KEY_HERE']);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$r = json_decode(curl_exec($ch), true);
curl_close($ch);

echo $r['balance'];         // 480
echo $r['rate_per_token'];  // 0.5
?>

import requests

r = requests.get(
    'https://api.hashback.co.ke/credits/balance',
    headers={'API_KEY': 'YOUR_API_KEY_HERE'}
).json()

print(r['balance'], 'tokens')  # 480 tokens
if r['low_balance']:
    print('Top up — minimum KES', r['min_topup'])

Response

{
  "success":         true,
  "balance":         480,
  "plan":            "silver",
  "rate_per_token":  0.5,
  "min_topup":       100,
  "estimated_value": 240,
  "low_balance":     false,
  "currency":        "KES"
}

Response fields

Plan rates

{
  "success": false,
  "message": "Unauthorized: Invalid API key"
}

// A missing key returns 401 with "Missing API key"

{
  "success": false,
  "message": "Too Many Requests"
}

// Limit: 30 requests per 60 seconds per IP.
// Cache the balance rather than polling it per decode.

Three steps — the merchant only ever exposes their public account ID.

Tap the button below — you get STK prompt to enter pin and complete checkout.

This live button loads hashpay.js from the CDN and calls HashPay.pay({...}) — exactly the snippet below.

Drop this into any page — just add the CDN <script> and a button.

<script src="https://pay.hashback.co.ke/hashpay.js"></script>

<button id="pay">Pay KES 100</button>
<script>
  var handler = HashPay.setup({
    account:   'HP945692',      // your public account id (required)
    amount:    100,             // KES (required)
    reference: 'order_12345',   // optional — auto-generated if omitted
    onSuccess: function (txn) { alert('Paid! Receipt: ' + txn.receipt); },
    onCancel:  function () { console.log('closed'); },
    onError:   function (e) { console.error(e); }
  });
  document.getElementById('pay').addEventListener('click', handler.openIframe);
</script>

<script src="https://pay.hashback.co.ke/hashpay.js"></script>

<button class="hashpay-button"
        data-account="HP945692"
        data-amount="100"
        data-reference="order_12345">Pay KES 100</button>

onSuccess payload

{
  "reference":  "order_12345",
  "receipt":    "SGH3XYZ123",     // M-PESA receipt number
  "amount":     100,
  "checkoutid": "ws_CO_...",
  "status":     "success"
}

// The real price of the package/order the customer picked.
const expectedAmount = ORDER.package.price;   // e.g. 1000 — from YOUR data, not the page

HashPay.setup({
  account: 'HP945692',
  amount:  expectedAmount,
  reference: ORDER.id,
  onSuccess: function (txn) {
    // Guard: confirm the paid amount matches what the order should cost.
    if (Number(txn.amount) !== Number(expectedAmount)) {
      // Amount was tampered with — do NOT fulfil. Flag / refund / contact support.
      console.error('Amount mismatch', txn.amount, 'expected', expectedAmount);
      return;
    }
    // Amounts match — safe to release the package / order.
    fulfilOrder(ORDER.id, txn.receipt);
  }
});

If you already know the payer's number — they are logged in, or you captured it at checkout — pass it to the button and the popup opens with the field already filled in. The payer just taps Pay. Typing a 10-digit number on a phone keypad is the single biggest drop-off point in the flow, so this removes it.

<button class="hashpay-button"
        data-account="HP945692"
        data-amount="100"
        data-reference="order_12345"
        data-phone="0712345678">Pay KES 100</button>

<!-- Lock it: the field becomes read-only and payment can only come from this number -->
<button class="hashpay-button"
        data-account="HP945692"
        data-amount="100"
        data-phone="254712345678"
        data-phone-lock>Pay KES 100</button>

HashPay.pay({
  account:   'HP945692',
  amount:    100,
  reference: 'order_12345',
  phone:     USER.msisdn,     // '0712345678' | '+254712345678' | '712345678'
  lockPhone: true,             // optional — make the field read-only
  onSuccess: function (txn) { fulfilOrder(txn); }
});

Options

Accepted number formats

Pass the number in whatever shape your database holds it — the button normalises it to the local 07XXXXXXXX / 01XXXXXXXX form and displays it grouped as 0712 345 678.

What the payer sees

HashPay sends a POST request to your webhook URL when a payment transaction completes. Configure your URL in the Settings tab of your HashPay portal.

Global vs per-account endpoints

A webhook can be registered against a single payment channel or as a global webhook that covers every channel on your account — including channels you add later. Use the AccountID field in the payload to tell the channels apart. Exactly one endpoint fires per transaction: if the channel has its own webhook that one is used, otherwise the global one is. You may hold one global webhook, and it carries its own signing secret like any other endpoint.

Incoming request headers

Webhook payload (success)

{
  "event":                 "payment.success",
  "ResponseCode":         0,
  "ResponseDescription":  "Success. Request accepted for processing",
  "MerchantRequestID":    "ws_CO_12052026084940",
  "CheckoutRequestID":    "ws_CO_12052026084940776662",
  "TransactionID":        "UEC496402X",
  "TransactionAmount":    1,
  "TransactionReceipt":   "UEC496402X",
  "TransactionDate":      20260512084950,
  "TransactionReference": "HPL1XBF0",
  "Msisdn":               254701234567,
  "AccountID":            "HP56"
}

Verifying the X-Hashpay-Signature

Every webhook request includes an X-Hashpay-Signature header containing an HMAC-SHA256 digest of the raw request body, signed with your webhook secret (found in the HashPay Settings portal). Always verify this signature before trusting the payload — reject any request that fails the check with a 401 response.

<?php
// Retrieve raw body BEFORE reading $_POST or json_decode()
$rawBody       = file_get_contents('php://input');
$secret        = 'YOUR_WEBHOOK_SECRET';  // from HashPay Settings
$sigHeader     = $_SERVER['HTTP_X_HASHPAY_SIGNATURE'] ?? '';

// Header format: "sha256=<hex>"
$expected      = 'sha256=' . hash_hmac('sha256', $rawBody, $secret);

if (!hash_equals($expected, $sigHeader)) {
    http_response_code(401);
    exit('Invalid signature');
}

// Signature valid — safe to process
$payload = json_decode($rawBody, true);

if ($payload['event'] === 'payment.success' && $payload['ResponseCode'] === 0) {
    $txid = $payload['TransactionID'];    // "UEC496402X"
    $ref  = $payload['TransactionReference']; // your order ref
    $msisdn = $payload['Msisdn'];           // 254701234567
    // fulfil the order ...
}

http_response_code(200);
?>

const crypto = require('crypto');

// Express example — use express.raw() to get the raw buffer
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const secret    = 'YOUR_WEBHOOK_SECRET';
  const sigHeader = req.headers['x-hashpay-signature'] ?? '';
  const expected  = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(req.body)          // raw Buffer
    .digest('hex');

  const valid = crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(sigHeader)
  );

  if (!valid) return res.status(401).send('Invalid signature');

  const payload = JSON.parse(req.body.toString());

  if (payload.event === 'payment.success' && payload.ResponseCode === 0) {
    const { TransactionID, TransactionReference, Msisdn } = payload;
    // fulfil the order ...
  }

  res.status(200).send('OK');
});

import hmac, hashlib
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = b'YOUR_WEBHOOK_SECRET'

@app.route('/webhook', methods=['POST'])
def webhook():
    raw_body   = request.get_data()   # raw bytes, before any parsing
    sig_header = request.headers.get('X-Hashpay-Signature', '')

    expected = 'sha256=' + hmac.new(
        SECRET, raw_body, hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(expected, sig_header):
        abort(401)

    payload = request.get_json()

    if payload.get('event') == 'payment.success' and payload.get('ResponseCode') == 0:
        tx_id = payload['TransactionID']         # "UEC496402X"
        ref   = payload['TransactionReference']   # your order ref
        # fulfil the order ...

    return '', 200

Your bot shows a Pay button in the chat. The customer taps it and is taken to the HashPay payment page to pay with M-PESA. Once done, they’re brought back to the chat and the bot confirms the payment.

Place a Pay button anywhere in your app — on a cart, an order or a subscription screen. Tapping it opens the HashPay payment page; after paying, the customer lands right back in your app.

curl -X POST https://api.hashback.co.ke/initiatestk \
  -H 'Content-Type: application/json' \
  -d '{
    "api_key":    "YOUR_KEY",
    "account_id": "ACC_ID",
    "amount":     "1",
    "msisdn":     "254712345678",
    "reference":  "ORDER_001"
  }'

const res = await fetch('https://api.hashback.co.ke/initiatestk', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    api_key:    'YOUR_KEY',
    account_id: 'ACC_ID',
    amount:     '1',
    msisdn:     '254712345678',
    reference:  'ORDER_001'
  })
});

const { checkout_id, success } = await res.json();
// Store checkout_id to poll transaction status

<?php
$payload = json_encode([
  'api_key'    => 'YOUR_KEY',
  'account_id' => 'ACC_ID',
  'amount'     => '1',
  'msisdn'     => '254712345678',
  'reference'  => 'ORDER_001'
]);
$ch = curl_init('https://api.hashback.co.ke/initiatestk');
curl_setopt_array($ch, [
  CURLOPT_POST           => 1,
  CURLOPT_POSTFIELDS     => $payload,
  CURLOPT_HTTPHEADER     => ['Content-Type: application/json'],
  CURLOPT_RETURNTRANSFER => true
]);
$r = json_decode(curl_exec($ch), true);
$checkoutId = $r['checkout_id'];
?>

Response

{
  "success":             true,
  "message":             "STK push initiated successfully",
  "checkout_id":         "ws_CO_16092026004400759796721744",
  "MerchantRequestID":   "f718-44d8-a5df-b9b3b074c8e717034596",
  "CheckoutRequestID":   "ws_CO_16092026004400759796721744",
  "ResponseCode":        "0",
  "ResponseDescription": "Success. Request accepted for processing",
  "CustomerMessage":     "Success. Request accepted for processing"
}

checkout_id and CheckoutRequestID always carry the same value. Both are returned so existing integrations written against Safaricom's field names keep working — prefer checkout_id in new code.

<?php
$ctx = stream_context_create(['http' => [
  'method'  => 'POST',
  'header'  => 'Content-type: application/json',
  'content' => json_encode([
    'api_key'    => 'KEY',
    'account_id' => 'WALLET_ID'
  ])
]]);
$r = json_decode(
  file_get_contents('https://api.hashback.co.ke/walletbalance', false, $ctx),
  true
);
echo "Balance: KES " . $r['balance'];
?>

const res = await fetch('https://api.hashback.co.ke/walletbalance', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ api_key: 'KEY', account_id: 'WALLET_ID' })
});
const { balance, status } = await res.json();
console.log(`KES ${balance} — ${status}`);

import requests

r = requests.post(
    'https://api.hashback.co.ke/walletbalance',
    json={'api_key': 'KEY', 'account_id': 'WALLET_ID'}
)
data = r.json()
print(f"KES {data['balance']} — {data['status']}")

Response

{
  "success":  true,
  "walletId": "WALLET_ID",
  "balance":  47,
  "status":   "Active",
  "currency": "KES"
}

What a message costs

You are billed per unit, and a unit is 168 characters. A longer message is simply more units — there is no separate "long SMS" price. One flat rate applies whichever sender ID the message goes out under.

Choosing a sender ID

An account can hold several sender IDs at once — say a transactional one for receipts and a promotional one for campaigns. Every sending endpoint takes an optional sender_id:

{ "to": "0712345678", "message": "Hi" }                        // your default sender
{ "to": "0712345678", "message": "Hi", "sender_id": null }     // same thing
{ "to": "0712345678", "message": "Hi", "sender_id": "ACMEKE" } // that one specifically

• Omitted or null — your account default: your most recently assigned own sender ID, or the shared sender if you have none of your own.
• Named — that sender ID, which must be live on your account.

Request parameters

Code examples

curl -X POST https://api.hashback.co.ke/sms/send \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "to":      "0712345678",
    "message": "Your code is 4821"
  }'

const res = await fetch('https://api.hashback.co.ke/sms/send', {
  method:  'POST',
  headers: {
    'Authorization': 'Bearer YOUR_API_KEY',
    'Content-Type':  'application/json'
  },
  body: JSON.stringify({
    to:        '0712345678',
    message:   'Your code is 4821',
    sender_id: null   // null = your default sender
  })
});
const sms = await res.json();

$ch = curl_init('https://api.hashback.co.ke/sms/send');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => [
        'Authorization: Bearer YOUR_API_KEY',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'to'      => '0712345678',
        'message' => 'Your code is 4821',
    ]),
]);
$sms = json_decode(curl_exec($ch), true);

Response 201 Created

{
  "success":   true,
  "id":        "e3ff2f66e71a21a647bca309042e8694",
  "to":        "254712345678",
  "sender_id": "ACMEKE",
  "status":    "sent",
  "units":     1,
  "cost":      0.35,
  "balance":   412.60
}

Keep id — it is what /sms/status takes.

One wallet movement for the whole campaign, while each message keeps its own rate snapshot and refunds individually. Up to 20,000 recipients per request.

* Either message or template_id.

Personalised bulk

Pass merge values per recipient and they are resolved before anything is charged — a missing placeholder is one clear error, not ten thousand messages reading “Hi {name}”.

curl -X POST https://api.hashback.co.ke/sms/bulk \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "template_id": 7,
    "to": [
      { "to": "0712345678", "vars": { "name": "Asha",  "order": "A-1024" } },
      { "to": "0722000000", "vars": { "name": "Brian", "order": "A-1025" } }
    ]
  }'

Response 201 Created

{
  "success":      true,
  "batch_id":     "8e29fac815d3149f6dcd1da21a56389b",
  "accepted":     2,
  "invalid":      [],
  "duplicates":   0,
  "sender_id":    "ACMEKE",
  "cost":         0.70,
  "status":       "processing",
  "scheduled_at": null,
  "balance":      411.90
}

invalid lists numbers that could not be used, and duplicates counts entries collapsed into another — neither is ever charged for. A recipient total lower than the list you sent is explained by these two.

Same body as /sms/send or /sms/bulk. It runs the identical pricing the send path runs, so a quote and the real charge cannot disagree. Nothing is billed.

{
  "success":     true,
  "sender_id":   "ACMEKE",
  "encoding":    "GSM7",
  "chars":       34,
  "units":       1,
  "rate":        0.35,
  "recipients":  2,
  "invalid":     [],
  "duplicates":  0,
  "total_cost":  0.70,
  "balance":     412.60,
  "sufficient":  true
}

encoding matters: one emoji or accented character switches the whole message to UCS2 and roughly halves how much text fits in a unit.

Which names are valid in sender_id, and which one you get if you omit it. Unusable senders are listed too, with a status saying why — so you can tell “never registered” from “suspended”.

{
  "success": true,
  "default": "ACMEKE",
  "senders": [
    { "sender_id": "ACMEKE",    "kind": "own",    "type": "transactional",
      "status": "live",     "usable": true,  "rate": 0.35, "is_default": true },
    { "sender_id": "ACMEPROMO", "kind": "own",    "type": "promotional",
      "status": "pending",  "usable": false, "rate": 0.35, "is_default": false }
  ]
}

Delivery states

refunded on the response tells you whether the money came back, so you never have to infer it from the status.

Returns balance, your current rate, and units — how many single-part messages that money buys right now.

Errors worth handling

Branch on code, never on the English in message — the wording may be improved, the codes are stable.

Creates a new collection channel under your partner account. The paybill or till is verified against Safaricom (Hakikisha) before anything is written, and the channel goes live immediately in Pay-As-You-Go mode. Linking costs 10 service tokens, charged once per successful link — the channel then costs KES 0.25 (1 token) per STK prompt.

The same paybill or till can be linked as many times as you need. One shortcode commonly sits behind several platforms — a website, a mobile app, a Telegram bot — and each one should be its own channel. Call this endpoint once per platform: every call returns a fresh account_id, and that account_id is what tells the channels apart everywhere else in the API — webhook routing, transaction history, and enabling or disabling a channel on its own. Money still settles into the same till. Duplicate shortcodes are never rejected.

curl -X POST https://api.hashback.co.ke/linkaccount \
  -H 'Content-Type: application/json' \
  -d '{
    "API_KEY":          "YOUR_PARTNER_KEY",
    "accountName":      "Mama Njeri Groceries",
    "accountType":      "CustomerPayBillOnline",
    "paybill_no":       "247247",
    "account_no":       "MNG001"
  }'

{
  "ResultCode": "0",
  "message": "HashPay account linked successfully",
  "account_id": "HPAP202608130417",
  "accountName": "Mama Njeri Groceries",
  "accountType": "CustomerPayBillOnline",
  "status": "active",
  "active_till": "2026-09-12 14:22:05",
  "billing": {
    "mode": "payg",
    "link_cost_tokens": 10,
    "cost_per_stk_tokens": 1,
    "token_balance": 470,
    "note": "Linking cost 10 service tokens. No renewal fee. Each STK prompt costs 1 service token."
  },
  "sibling_channels": [],
  "validation": {
    "type": "paybill",
    "shortcode": "247247",
    "merchant_name": "MAMA NJERI GROCERIES LTD",
    "verified": true
  }
}

// Linking 247247 / MNG001 a second time, this time for the mobile app.
// A new account_id is issued; the channel linked earlier is reported
// back under "sibling_channels" and is left untouched.
{
  "ResultCode": "0",
  "message": "HashPay account linked successfully",
  "account_id": "HPAP202608147732",
  "accountName": "Mama Njeri — Mobile App",
  "accountType": "CustomerPayBillOnline",
  "status": "active",
  "sibling_channels": [
    {
      "account_id": "HPAP202608130417",
      "accountName": "Mama Njeri Groceries"
    }
  ],
  "validation": {
    "type": "paybill",
    "shortcode": "247247",
    "merchant_name": "MAMA NJERI GROCERIES LTD",
    "verified": true
  }
}

{
  "ResultCode": "400",
  "message": "Invalid till number: The till number does not exist or is not active",
  "validation_error": "The till number does not exist or is not active",
  "code": "4001"
}

Lists every channel belonging to your partner account with a status summary and your current service-token balance. Accepts GET query parameters, or POST with JSON / form-data. Free.

Channel status values

{
  "ResultCode": "0",
  "count": 2,
  "summary": { "total": 2, "payg": 2, "active": 0, "suspended": 0 },
  "billing": { "mode": "payg", "cost_per_stk_tokens": 1, "token_balance": 480 },
  "data": [
    {
      "billing_mode": "payg",
      "account_id": "HPAP202608130417",
      "accountName": "Mama Njeri Groceries",
      "accountType": "CustomerPayBillOnline",
      "paybill_no": "247247",
      "account_no": "MNG001",
      "status": "payg",
      "is_expired": false,
      "days_remaining": null,
      "callback_webhook": "https://example.com/hashback/callback"
    }
  ]
}

is_expired and days_remaining are always false / null for PAYG channels, since active_till does not gate them. token_balance funds every STK prompt across all your channels.

Updates an existing channel — free, nothing is charged for edits. The account must belong to your partner account; another partner's account_id returns 404.

• Any new till or paybill is re-verified against Safaricom before it is saved.
• Switching type nullifies the other shortcode field — the cleared field appears in updated_fields as e.g. paybill_no (cleared).
• If accountName is omitted but Safaricom returns a merchant name, that name is used.
• Sending nothing changeable returns 400 No changes detected.

curl -X POST https://api.hashback.co.ke/editlinkedaccount \
  -H 'Content-Type: application/json' \
  -d '{
    "API_KEY":     "YOUR_PARTNER_KEY",
    "account_id":  "HPAP202608130417",
    "accountType": "CustomerBuyGoodsOnline",
    "till_no":     "884422",
    "accountName": "Kibera Electronics"
  }'

{
  "ResultCode": "0",
  "message": "Account updated successfully",
  "account_id": "HPAP202608130417",
  "updated_fields": ["till_no", "paybill_no (cleared)", "accountType", "accountName"],
  "rows_affected": 1
}

Sets or clears the payment callback URL for one channel — free. Send webhook_url as an empty string to remove it. This is the same thing as passing callback_webhook to Edit Linked Account; use whichever fits your flow.

{
  "ResultCode": "0",
  "message": "Webhook updated successfully",
  "account_id": "HPAP202608130417",
  "webhook_url": "https://example.com/hashback/callback"
}

{
  "ResultCode": "0",
  "message": "Webhook removed successfully",
  "account_id": "HPAP202608130417",
  "webhook_url": null
}

Reference list of Kenyan banks and their M-Pesa paybill numbers — useful for populating a bank picker in your onboarding UI. Accepts GET query parameters or POST with JSON / form-data. Free. The list is static and does not reflect your account in any way.

{
  "ResultCode": "0",
  "count": 42,
  "data": [
    { "name": "ABC Bank",          "paybill": "111777", "type": "bank" },
    { "name": "ABSA Bank",         "paybill": "303030", "type": "bank" },
    { "name": "Cooperative Bank",  "paybill": "400200", "type": "bank" },
    { "name": "Equity Bank",       "paybill": "247247", "type": "bank" }
  ]
}

Retired — always returns 410. Partner channels run on Pay-As-You-Go, so there is no subscription to renew: linking is free and each STK prompt costs KES 0.25. If your integration still calls this, remove it and top up service tokens under Credits instead. The endpoint is kept alive rather than deleted so existing integrations get this explanation instead of a bare 404.

{
  "ResultCode": "410",
  "message": "Renewals are no longer required. Partner channels run on Pay-As-You-Go: linking is free and each STK prompt costs 1 service token. Top up your service tokens in the dashboard under Credits.",
  "billing": { "mode": "payg", "cost_per_stk_tokens": 1 }
}