HashBack & HashPay APIs

const res = await fetch('https://api.hashback.co.ke/decode', {
  method: 'POST',
  headers: { 'API_KEY': 'YOUR_API_KEY_HERE' },
  body: new URLSearchParams({
    hash: '4f87c55d393937f18fbf3003512195aa8e62be340946ab547c2eada26cc43c1e'
  })
});

const { MSISDN } = await res.json();
console.log(MSISDN); // "254712345678"

<?php
$ch = curl_init('https://api.hashback.co.ke/decode');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS,
  http_build_query(['hash' => '4f87c55d...'])
);
curl_setopt($ch, CURLOPT_HTTPHEADER, ['API_KEY: YOUR_API_KEY_HERE']);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$r = json_decode(curl_exec($ch), true);
curl_close($ch);
echo $r['MSISDN']; // 254712345678
?>

import requests

r = requests.post(
    'https://api.hashback.co.ke/decode',
    data={'hash': '4f87c55d...'},
    headers={'API_KEY': 'YOUR_API_KEY_HERE'}
)
print(r.json()['MSISDN'])  # 254712345678

const res = await fetch('https://api.hashback.co.ke/initiatestk', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    api_key:    'YOUR_KEY',
    account_id: 'ACC_ID',
    amount:     '1',
    msisdn:     '254712345678',
    reference:  'ORDER_001'
  })
});

const { checkout_id, success } = await res.json();
// Store checkout_id to poll transaction status

<?php
$payload = json_encode([
  'api_key'    => 'YOUR_KEY',
  'account_id' => 'ACC_ID',
  'amount'     => '1',
  'msisdn'     => '254712345678',
  'reference'  => 'ORDER_001'
]);
$ch = curl_init('https://api.hashback.co.ke/initiatestk');
curl_setopt_array($ch, [
  CURLOPT_POST           => 1,
  CURLOPT_POSTFIELDS     => $payload,
  CURLOPT_HTTPHEADER     => ['Content-Type: application/json'],
  CURLOPT_RETURNTRANSFER => true
]);
$r = json_decode(curl_exec($ch), true);
$checkoutId = $r['checkout_id'];
?>

const crypto = require('crypto');

// Express example — use express.raw() to get the raw buffer
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const secret    = 'YOUR_WEBHOOK_SECRET';
  const sigHeader = req.headers['x-hashpay-signature'] ?? '';
  const expected  = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(req.body)          // raw Buffer
    .digest('hex');

  const valid = crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(sigHeader)
  );

  if (!valid) return res.status(401).send('Invalid signature');

  const payload = JSON.parse(req.body.toString());

  if (payload.event === 'payment.success' && payload.ResponseCode === 0) {
    const { TransactionID, TransactionReference, Msisdn } = payload;
    // fulfil the order ...
  }

  res.status(200).send('OK');
});

import hmac, hashlib
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = b'YOUR_WEBHOOK_SECRET'

@app.route('/webhook', methods=['POST'])
def webhook():
    raw_body   = request.get_data()   # raw bytes, before any parsing
    sig_header = request.headers.get('X-Hashpay-Signature', '')

    expected = 'sha256=' + hmac.new(
        SECRET, raw_body, hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(expected, sig_header):
        abort(401)

    payload = request.get_json()

    if payload.get('event') == 'payment.success' and payload.get('ResponseCode') == 0:
        tx_id = payload['TransactionID']         # "UEC496402X"
        ref   = payload['TransactionReference']   # your order ref
        # fulfil the order ...

    return '', 200

const res = await fetch('https://api.hashback.co.ke/walletbalance', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ api_key: 'KEY', account_id: 'WALLET_ID' })
});
const { balance, status } = await res.json();
console.log(`KES ${balance} — ${status}`);

import requests

r = requests.post(
    'https://api.hashback.co.ke/walletbalance',
    json={'api_key': 'KEY', 'account_id': 'WALLET_ID'}
)
data = r.json()
print(f"KES {data['balance']} — {data['status']}")

{
  "success": false,
  "message": "Transaction not found"
}