ECASHPAYECASHPAYDocumentation
Back to site

Introduction

  • EcashPay API
  • Quickstart

Core concepts

  • Environments and API keys
  • Signing requests
  • Errors

Accept payments

  • Creating a payment
  • Payment methods
  • Confirming the outcome
  • Refunds, capture and cancel

Testing

  • Testing

API reference

  • API reference

API reference

Every endpoint, generated from the running API: schemas, samples and code.

Every endpoint below is generated from the running API, so what you read here is what the server accepts today. Each entry lists the security layers it requires, its parameters, a sample response, and a complete signed request in six languages.

Paths carry their own version segment. Send them against your API base URL — https://be.ecashpay.com/api — and read Signing requests first: every endpoint marked SIGNATURE rejects an unsigned call.

Payments

Create a payment and drive it: read, capture, cancel, refund.

GET/v1/payments/server-time

Fetch server time + tolerance window before signing a request.

Security
NONE
Endpoint
GET https://be.ecashpay.com/api/v1/payments/server-time

This endpoint takes no request body.

Example request

# Public probe — no auth required
curl -s "https://be.ecashpay.com/api/v1/payments/server-time"

Sample response

200 OK
{
  "iso": "2026-07-16T09:00:00.000Z",
  "unix": 1752656400,
  "toleranceSeconds": 300
}

POST/v1/payments

Create a payment.

Security
API_KEYSIGNATUREENCRYPTION
Endpoint
POST https://be.ecashpay.com/api/v1/payments

Request body

FieldDescription
referenceIdstringrequired

Caller-unique reference. Guards against double-charge.

e.g. order-1001

amountnumberrequired

Amount in the major currency unit.

e.g. 1500

currencystringoptional

ISO-4217 code. Defaults to app config.

e.g. PHP

methodstringrequired

How the customer pays. EcashPay charges it on whichever of its rails currently handles that method — you never choose one.

One of:CARD_CREDITCARD_DEBITQREWALLET

e.g. EWALLET

customerEmailstringrequired

Payer email. Required — the receipt and any payment instructions go here.

e.g. payer@example.com

descriptionstringoptional

Human-readable description.

e.g. Order #1001

successReturnUrlstringoptional

Redirect after a successful hosted checkout.

cancelReturnUrlstringoptional

Redirect after a cancelled hosted checkout.

Example request

# Building a signed request from scratch. To just re-send THIS request, press Run and
# and copy the ready-made curl from the response.
#
# Paste this whole block into a terminal. Fill in the marked values and it runs —
# or type them into "Your keys" above the samples and this fills itself in.
# ECASH_API_KEY is environment-scoped (ecpay_test_/ecpay_live_) and decides which environment the request executes in; it comes from your API keys page, and ECASH_API_SECRET (HMAC) + ECASH_ENC_KEY (32-byte AES key) are the security keys issued with your account — never ship any of them to a browser.
export ECASH_BASE_URL="https://be.ecashpay.com/api"
export ECASH_API_KEY="ecpay_test_…"
export ECASH_API_SECRET="…"        # HMAC signing secret
export ECASH_ENC_KEY="…"           # 32-byte AES key, hex

# 1) authoritative time — the signature is rejected outside a tolerance window
TS=$(curl -s "$ECASH_BASE_URL/v1/payments/server-time" | jq -r .unix)
NONCE=$(openssl rand -hex 16)

# 2) seal the body: AES-256-GCM, then rawBody = base64(iv || tag || ciphertext).
#    Node's crypto is used because openssl's CLI cannot emit the GCM auth tag —
#    nothing to install, and no key ever leaves this shell.
RAW_BODY=$(ECASH_ENC_KEY="$ECASH_ENC_KEY" node -e '
  const c = require("crypto");
  const key = Buffer.from(process.env.ECASH_ENC_KEY, "hex");
  const iv = c.randomBytes(12);
  const cipher = c.createCipheriv("aes-256-gcm", key, iv);
  const body = Buffer.concat([cipher.update(process.argv[1], "utf8"), cipher.final()]);
  process.stdout.write(Buffer.concat([iv, cipher.getAuthTag(), body]).toString("base64"));
' '{"referenceId":"order-1001","amount":1500,"currency":"PHP","method":"EWALLET","customerEmail":"payer@example.com","description":"Order #1001"}')

# 3) sign the CIPHERTEXT, never the plaintext — the server verifies before it decrypts
SIG=$(printf '%s.%s.%s' "$TS" "$NONCE" "$RAW_BODY" \
  | openssl dgst -sha256 -hmac "$ECASH_API_SECRET" -r | cut -d' ' -f1)

# 4) send
curl -s -X POST "https://be.ecashpay.com/api/v1/payments" \
  -H "X-Api-Key: $ECASH_API_KEY" \
  -H "X-Ecash-Timestamp: $TS" \
  -H "X-Ecash-Nonce: $NONCE" \
  -H "X-Ecash-Signature: t=$TS,v1=$SIG" \
  -H "Content-Type: application/octet-stream" \
  --data "$RAW_BODY"

Sample response

200 OK
{
  "id": "b0f9…",
  "referenceId": "order-1001",
  "status": "PENDING",
  "environment": "TEST",
  "flow": "SESSION",
  "amount": 1500,
  "currency": "PHP",
  "method": "EWALLET",
  "paymentLinkUrl": "https://pay.ecashpay.example/checkout/…"
}

GET/v1/payments/:paymentId

Read the current state of a payment.

Security
API_KEYSIGNATURE
Endpoint
GET https://be.ecashpay.com/api/v1/payments/:paymentId

Path parameters

FieldDescription
paymentIdstringrequired

Example request

# Building a signed request from scratch. To just re-send THIS request, press Run and
# and copy the ready-made curl from the response.
#
# Paste this whole block into a terminal. Fill in the marked values and it runs —
# or type them into "Your keys" above the samples and this fills itself in.
# ECASH_API_KEY is environment-scoped (ecpay_test_/ecpay_live_) and decides which environment the request executes in; it comes from your API keys page, and ECASH_API_SECRET (HMAC) + ECASH_ENC_KEY (32-byte AES key) are the security keys issued with your account — never ship any of them to a browser.
export ECASH_BASE_URL="https://be.ecashpay.com/api"
export ECASH_API_KEY="ecpay_test_…"
export ECASH_API_SECRET="…"        # HMAC signing secret

# 1) authoritative time — the signature is rejected outside a tolerance window
TS=$(curl -s "$ECASH_BASE_URL/v1/payments/server-time" | jq -r .unix)
NONCE=$(openssl rand -hex 16)

RAW_BODY=""

# 2) sign "timestamp.nonce.rawBody"
SIG=$(printf '%s.%s.%s' "$TS" "$NONCE" "$RAW_BODY" \
  | openssl dgst -sha256 -hmac "$ECASH_API_SECRET" -r | cut -d' ' -f1)

# 3) send
curl -s -X GET "https://be.ecashpay.com/api/v1/payments/paymentId_123" \
  -H "X-Api-Key: $ECASH_API_KEY" \
  -H "X-Ecash-Timestamp: $TS" \
  -H "X-Ecash-Nonce: $NONCE" \
  -H "X-Ecash-Signature: t=$TS,v1=$SIG" \
  -H "Content-Type: application/json"

Sample response

200 OK
{
  "id": "b0f9…",
  "referenceId": "order-1001",
  "status": "SUCCEEDED",
  "environment": "TEST",
  "flow": "SESSION",
  "amount": 1500,
  "currency": "PHP"
}

POST/v1/payments/:paymentId/capture

Capture a previously AUTHORIZED payment (manual-capture flow).

Security
API_KEYSIGNATUREENCRYPTION
Endpoint
POST https://be.ecashpay.com/api/v1/payments/:paymentId/capture

Path parameters

FieldDescription
paymentIdstringrequired

Request body

FieldDescription
amountnumberoptional

Amount to capture. Omit for the full authorized amount.

e.g. 1500

Example request

# Building a signed request from scratch. To just re-send THIS request, press Run and
# and copy the ready-made curl from the response.
#
# Paste this whole block into a terminal. Fill in the marked values and it runs —
# or type them into "Your keys" above the samples and this fills itself in.
# ECASH_API_KEY is environment-scoped (ecpay_test_/ecpay_live_) and decides which environment the request executes in; it comes from your API keys page, and ECASH_API_SECRET (HMAC) + ECASH_ENC_KEY (32-byte AES key) are the security keys issued with your account — never ship any of them to a browser.
export ECASH_BASE_URL="https://be.ecashpay.com/api"
export ECASH_API_KEY="ecpay_test_…"
export ECASH_API_SECRET="…"        # HMAC signing secret
export ECASH_ENC_KEY="…"           # 32-byte AES key, hex

# 1) authoritative time — the signature is rejected outside a tolerance window
TS=$(curl -s "$ECASH_BASE_URL/v1/payments/server-time" | jq -r .unix)
NONCE=$(openssl rand -hex 16)

# 2) seal the body: AES-256-GCM, then rawBody = base64(iv || tag || ciphertext).
#    Node's crypto is used because openssl's CLI cannot emit the GCM auth tag —
#    nothing to install, and no key ever leaves this shell.
RAW_BODY=$(ECASH_ENC_KEY="$ECASH_ENC_KEY" node -e '
  const c = require("crypto");
  const key = Buffer.from(process.env.ECASH_ENC_KEY, "hex");
  const iv = c.randomBytes(12);
  const cipher = c.createCipheriv("aes-256-gcm", key, iv);
  const body = Buffer.concat([cipher.update(process.argv[1], "utf8"), cipher.final()]);
  process.stdout.write(Buffer.concat([iv, cipher.getAuthTag(), body]).toString("base64"));
' '{"amount":1500}')

# 3) sign the CIPHERTEXT, never the plaintext — the server verifies before it decrypts
SIG=$(printf '%s.%s.%s' "$TS" "$NONCE" "$RAW_BODY" \
  | openssl dgst -sha256 -hmac "$ECASH_API_SECRET" -r | cut -d' ' -f1)

# 4) send
curl -s -X POST "https://be.ecashpay.com/api/v1/payments/paymentId_123/capture" \
  -H "X-Api-Key: $ECASH_API_KEY" \
  -H "X-Ecash-Timestamp: $TS" \
  -H "X-Ecash-Nonce: $NONCE" \
  -H "X-Ecash-Signature: t=$TS,v1=$SIG" \
  -H "Content-Type: application/octet-stream" \
  --data "$RAW_BODY"

Sample response

200 OK
{
  "id": "b0f9…",
  "status": "SUCCEEDED",
  "amount": 1500,
  "currency": "PHP"
}

POST/v1/payments/:paymentId/cancel

Void an AUTHORIZED payment.

Security
API_KEYSIGNATURE
Endpoint
POST https://be.ecashpay.com/api/v1/payments/:paymentId/cancel

Path parameters

FieldDescription
paymentIdstringrequired

Example request

# Building a signed request from scratch. To just re-send THIS request, press Run and
# and copy the ready-made curl from the response.
#
# Paste this whole block into a terminal. Fill in the marked values and it runs —
# or type them into "Your keys" above the samples and this fills itself in.
# ECASH_API_KEY is environment-scoped (ecpay_test_/ecpay_live_) and decides which environment the request executes in; it comes from your API keys page, and ECASH_API_SECRET (HMAC) + ECASH_ENC_KEY (32-byte AES key) are the security keys issued with your account — never ship any of them to a browser.
export ECASH_BASE_URL="https://be.ecashpay.com/api"
export ECASH_API_KEY="ecpay_test_…"
export ECASH_API_SECRET="…"        # HMAC signing secret

# 1) authoritative time — the signature is rejected outside a tolerance window
TS=$(curl -s "$ECASH_BASE_URL/v1/payments/server-time" | jq -r .unix)
NONCE=$(openssl rand -hex 16)

RAW_BODY=""

# 2) sign "timestamp.nonce.rawBody"
SIG=$(printf '%s.%s.%s' "$TS" "$NONCE" "$RAW_BODY" \
  | openssl dgst -sha256 -hmac "$ECASH_API_SECRET" -r | cut -d' ' -f1)

# 3) send
curl -s -X POST "https://be.ecashpay.com/api/v1/payments/paymentId_123/cancel" \
  -H "X-Api-Key: $ECASH_API_KEY" \
  -H "X-Ecash-Timestamp: $TS" \
  -H "X-Ecash-Nonce: $NONCE" \
  -H "X-Ecash-Signature: t=$TS,v1=$SIG" \
  -H "Content-Type: application/json"

Sample response

200 OK
{
  "id": "b0f9…",
  "status": "CANCELLED",
  "amount": 1500,
  "currency": "PHP"
}

POST/v1/payments/:paymentId/refunds

Refund a payment, in full or in part.

Security
API_KEYSIGNATUREENCRYPTION
Endpoint
POST https://be.ecashpay.com/api/v1/payments/:paymentId/refunds

Path parameters

FieldDescription
paymentIdstringrequired

Request body

FieldDescription
reasonstringrequired

Refund reason code.

One of:FRAUDULENTDUPLICATEREQUESTED_BY_CUSTOMERCANCELLATIONOTHERS

e.g. REQUESTED_BY_CUSTOMER

amountnumberoptional

Partial amount. Omit for a full refund.

e.g. 500

referenceIdstringoptional

Optional caller reference for this refund.

Example request

# Building a signed request from scratch. To just re-send THIS request, press Run and
# and copy the ready-made curl from the response.
#
# Paste this whole block into a terminal. Fill in the marked values and it runs —
# or type them into "Your keys" above the samples and this fills itself in.
# ECASH_API_KEY is environment-scoped (ecpay_test_/ecpay_live_) and decides which environment the request executes in; it comes from your API keys page, and ECASH_API_SECRET (HMAC) + ECASH_ENC_KEY (32-byte AES key) are the security keys issued with your account — never ship any of them to a browser.
export ECASH_BASE_URL="https://be.ecashpay.com/api"
export ECASH_API_KEY="ecpay_test_…"
export ECASH_API_SECRET="…"        # HMAC signing secret
export ECASH_ENC_KEY="…"           # 32-byte AES key, hex

# 1) authoritative time — the signature is rejected outside a tolerance window
TS=$(curl -s "$ECASH_BASE_URL/v1/payments/server-time" | jq -r .unix)
NONCE=$(openssl rand -hex 16)

# 2) seal the body: AES-256-GCM, then rawBody = base64(iv || tag || ciphertext).
#    Node's crypto is used because openssl's CLI cannot emit the GCM auth tag —
#    nothing to install, and no key ever leaves this shell.
RAW_BODY=$(ECASH_ENC_KEY="$ECASH_ENC_KEY" node -e '
  const c = require("crypto");
  const key = Buffer.from(process.env.ECASH_ENC_KEY, "hex");
  const iv = c.randomBytes(12);
  const cipher = c.createCipheriv("aes-256-gcm", key, iv);
  const body = Buffer.concat([cipher.update(process.argv[1], "utf8"), cipher.final()]);
  process.stdout.write(Buffer.concat([iv, cipher.getAuthTag(), body]).toString("base64"));
' '{"reason":"REQUESTED_BY_CUSTOMER","amount":500}')

# 3) sign the CIPHERTEXT, never the plaintext — the server verifies before it decrypts
SIG=$(printf '%s.%s.%s' "$TS" "$NONCE" "$RAW_BODY" \
  | openssl dgst -sha256 -hmac "$ECASH_API_SECRET" -r | cut -d' ' -f1)

# 4) send
curl -s -X POST "https://be.ecashpay.com/api/v1/payments/paymentId_123/refunds" \
  -H "X-Api-Key: $ECASH_API_KEY" \
  -H "X-Ecash-Timestamp: $TS" \
  -H "X-Ecash-Nonce: $NONCE" \
  -H "X-Ecash-Signature: t=$TS,v1=$SIG" \
  -H "Content-Type: application/octet-stream" \
  --data "$RAW_BODY"

Sample response

200 OK
{
  "id": "r1a2…",
  "paymentId": "b0f9…",
  "status": "SUCCEEDED",
  "environment": "TEST",
  "amount": 500,
  "currency": "PHP",
  "reason": "REQUESTED_BY_CUSTOMER"
}

Transactions

Read your own ledger — filtered lists and one transaction in full.

GET/v1/transactions

List your transactions, filtered, sorted and paginated.

Security
API_KEYSIGNATURE
Endpoint
GET https://be.ecashpay.com/api/v1/transactions

Query parameters

FieldDescription
statusstringoptional

One or more statuses, comma-separated (e.g. SUCCEEDED,PENDING).

e.g. SUCCEEDED

currencystringoptional

ISO-4217 code.

e.g. PHP

amountMinnumberoptional

Smallest amount to include.

e.g. 100

amountMaxnumberoptional

Largest amount to include.

e.g. 5000

fromstringoptional

ISO-8601 start of the window.

tostringoptional

ISO-8601 end of the window.

refundedstringoptional

Narrow by refund state.

One of:anynonepartialfull

customerIdstringoptional

Only this payer’s transactions.

qstringoptional

Free-text search over reference / id.

sortstringoptional

field:direction — defaults to createdAt:desc.

e.g. createdAt:desc

pagenumberoptional

Page number, from 1.

e.g. 1

pageSizenumberoptional

Rows per page, max 200.

e.g. 50

Example request

# Building a signed request from scratch. To just re-send THIS request, press Run and
# and copy the ready-made curl from the response.
#
# Paste this whole block into a terminal. Fill in the marked values and it runs —
# or type them into "Your keys" above the samples and this fills itself in.
# ECASH_API_KEY is environment-scoped (ecpay_test_/ecpay_live_) and decides which environment the request executes in; it comes from your API keys page, and ECASH_API_SECRET (HMAC) + ECASH_ENC_KEY (32-byte AES key) are the security keys issued with your account — never ship any of them to a browser.
export ECASH_BASE_URL="https://be.ecashpay.com/api"
export ECASH_API_KEY="ecpay_test_…"
export ECASH_API_SECRET="…"        # HMAC signing secret

# 1) authoritative time — the signature is rejected outside a tolerance window
TS=$(curl -s "$ECASH_BASE_URL/v1/payments/server-time" | jq -r .unix)
NONCE=$(openssl rand -hex 16)

RAW_BODY=""

# 2) sign "timestamp.nonce.rawBody"
SIG=$(printf '%s.%s.%s' "$TS" "$NONCE" "$RAW_BODY" \
  | openssl dgst -sha256 -hmac "$ECASH_API_SECRET" -r | cut -d' ' -f1)

# 3) send
curl -s -X GET "https://be.ecashpay.com/api/v1/transactions" \
  -H "X-Api-Key: $ECASH_API_KEY" \
  -H "X-Ecash-Timestamp: $TS" \
  -H "X-Ecash-Nonce: $NONCE" \
  -H "X-Ecash-Signature: t=$TS,v1=$SIG" \
  -H "Content-Type: application/json"

Sample response

200 OK
{
  "items": [
    {
      "id": "b0f9…",
      "referenceId": "order-1001",
      "status": "SUCCEEDED",
      "environment": "TEST",
      "method": "EWALLET",
      "amount": 1500,
      "currency": "PHP",
      "createdAt": "2026-07-16T09:00:00.000Z"
    }
  ],
  "page": 1,
  "pageSize": 50,
  "total": 1,
  "totalPages": 1
}

GET/v1/transactions/:txId

Read one transaction in full, with its timeline and refunds.

Security
API_KEYSIGNATURE
Endpoint
GET https://be.ecashpay.com/api/v1/transactions/:txId

Path parameters

FieldDescription
txIdstringrequired

Example request

# Building a signed request from scratch. To just re-send THIS request, press Run and
# and copy the ready-made curl from the response.
#
# Paste this whole block into a terminal. Fill in the marked values and it runs —
# or type them into "Your keys" above the samples and this fills itself in.
# ECASH_API_KEY is environment-scoped (ecpay_test_/ecpay_live_) and decides which environment the request executes in; it comes from your API keys page, and ECASH_API_SECRET (HMAC) + ECASH_ENC_KEY (32-byte AES key) are the security keys issued with your account — never ship any of them to a browser.
export ECASH_BASE_URL="https://be.ecashpay.com/api"
export ECASH_API_KEY="ecpay_test_…"
export ECASH_API_SECRET="…"        # HMAC signing secret

# 1) authoritative time — the signature is rejected outside a tolerance window
TS=$(curl -s "$ECASH_BASE_URL/v1/payments/server-time" | jq -r .unix)
NONCE=$(openssl rand -hex 16)

RAW_BODY=""

# 2) sign "timestamp.nonce.rawBody"
SIG=$(printf '%s.%s.%s' "$TS" "$NONCE" "$RAW_BODY" \
  | openssl dgst -sha256 -hmac "$ECASH_API_SECRET" -r | cut -d' ' -f1)

# 3) send
curl -s -X GET "https://be.ecashpay.com/api/v1/transactions/txId_123" \
  -H "X-Api-Key: $ECASH_API_KEY" \
  -H "X-Ecash-Timestamp: $TS" \
  -H "X-Ecash-Nonce: $NONCE" \
  -H "X-Ecash-Signature: t=$TS,v1=$SIG" \
  -H "Content-Type: application/json"

Sample response

200 OK
{
  "id": "b0f9…",
  "referenceId": "order-1001",
  "status": "SUCCEEDED",
  "environment": "TEST",
  "amount": 1500,
  "currency": "PHP",
  "events": [
    {
      "eventType": "payment.succeeded",
      "occurredAt": "2026-07-16T09:01:00.000Z"
    }
  ],
  "refunds": []
}

Customers

The payers you have taken payments from, with their totals.

GET/v1/customers

List the payers you have taken payments from.

Security
API_KEYSIGNATURE
Endpoint
GET https://be.ecashpay.com/api/v1/customers

Query parameters

FieldDescription
qstringoptional

Case-insensitive search on email / name / phone.

e.g. payer@

sortstringoptional

field:direction — defaults to lastSeenAt:desc.

e.g. lastSeenAt:desc

pagenumberoptional

Page number, from 1.

e.g. 1

pageSizenumberoptional

Rows per page.

e.g. 20

Example request

# Building a signed request from scratch. To just re-send THIS request, press Run and
# and copy the ready-made curl from the response.
#
# Paste this whole block into a terminal. Fill in the marked values and it runs —
# or type them into "Your keys" above the samples and this fills itself in.
# ECASH_API_KEY is environment-scoped (ecpay_test_/ecpay_live_) and decides which environment the request executes in; it comes from your API keys page, and ECASH_API_SECRET (HMAC) + ECASH_ENC_KEY (32-byte AES key) are the security keys issued with your account — never ship any of them to a browser.
export ECASH_BASE_URL="https://be.ecashpay.com/api"
export ECASH_API_KEY="ecpay_test_…"
export ECASH_API_SECRET="…"        # HMAC signing secret

# 1) authoritative time — the signature is rejected outside a tolerance window
TS=$(curl -s "$ECASH_BASE_URL/v1/payments/server-time" | jq -r .unix)
NONCE=$(openssl rand -hex 16)

RAW_BODY=""

# 2) sign "timestamp.nonce.rawBody"
SIG=$(printf '%s.%s.%s' "$TS" "$NONCE" "$RAW_BODY" \
  | openssl dgst -sha256 -hmac "$ECASH_API_SECRET" -r | cut -d' ' -f1)

# 3) send
curl -s -X GET "https://be.ecashpay.com/api/v1/customers" \
  -H "X-Api-Key: $ECASH_API_KEY" \
  -H "X-Ecash-Timestamp: $TS" \
  -H "X-Ecash-Nonce: $NONCE" \
  -H "X-Ecash-Signature: t=$TS,v1=$SIG" \
  -H "Content-Type: application/json"

Sample response

200 OK
{
  "items": [
    {
      "id": "c7d1…",
      "environment": "TEST",
      "email": "payer@example.com",
      "name": "Ana Cruz",
      "transactionCount": 3,
      "lastSeenAt": "2026-07-16T09:00:00.000Z"
    }
  ],
  "page": 1,
  "pageSize": 20,
  "total": 1,
  "totalPages": 1
}

GET/v1/customers/:customerId

Read one payer with their per-currency totals.

Security
API_KEYSIGNATURE
Endpoint
GET https://be.ecashpay.com/api/v1/customers/:customerId

Path parameters

FieldDescription
customerIdstringrequired

Example request

# Building a signed request from scratch. To just re-send THIS request, press Run and
# and copy the ready-made curl from the response.
#
# Paste this whole block into a terminal. Fill in the marked values and it runs —
# or type them into "Your keys" above the samples and this fills itself in.
# ECASH_API_KEY is environment-scoped (ecpay_test_/ecpay_live_) and decides which environment the request executes in; it comes from your API keys page, and ECASH_API_SECRET (HMAC) + ECASH_ENC_KEY (32-byte AES key) are the security keys issued with your account — never ship any of them to a browser.
export ECASH_BASE_URL="https://be.ecashpay.com/api"
export ECASH_API_KEY="ecpay_test_…"
export ECASH_API_SECRET="…"        # HMAC signing secret

# 1) authoritative time — the signature is rejected outside a tolerance window
TS=$(curl -s "$ECASH_BASE_URL/v1/payments/server-time" | jq -r .unix)
NONCE=$(openssl rand -hex 16)

RAW_BODY=""

# 2) sign "timestamp.nonce.rawBody"
SIG=$(printf '%s.%s.%s' "$TS" "$NONCE" "$RAW_BODY" \
  | openssl dgst -sha256 -hmac "$ECASH_API_SECRET" -r | cut -d' ' -f1)

# 3) send
curl -s -X GET "https://be.ecashpay.com/api/v1/customers/customerId_123" \
  -H "X-Api-Key: $ECASH_API_KEY" \
  -H "X-Ecash-Timestamp: $TS" \
  -H "X-Ecash-Nonce: $NONCE" \
  -H "X-Ecash-Signature: t=$TS,v1=$SIG" \
  -H "Content-Type: application/json"

Sample response

200 OK
{
  "id": "c7d1…",
  "environment": "TEST",
  "email": "payer@example.com",
  "name": "Ana Cruz",
  "phone": "+639171234567",
  "transactionCount": 3,
  "totals": [
    {
      "currency": "PHP",
      "succeededAmount": 4500,
      "refundedAmount": 0
    }
  ]
}

Merchant account

Who this API key belongs to, and its KYC / KYB verdict.

GET/v1/merchant/profile

Who this API key belongs to — workspace, business and contact.

Security
API_KEYSIGNATURE
Endpoint
GET https://be.ecashpay.com/api/v1/merchant/profile

This endpoint takes no request body.

Example request

# Building a signed request from scratch. To just re-send THIS request, press Run and
# and copy the ready-made curl from the response.
#
# Paste this whole block into a terminal. Fill in the marked values and it runs —
# or type them into "Your keys" above the samples and this fills itself in.
# ECASH_API_KEY is environment-scoped (ecpay_test_/ecpay_live_) and decides which environment the request executes in; it comes from your API keys page, and ECASH_API_SECRET (HMAC) + ECASH_ENC_KEY (32-byte AES key) are the security keys issued with your account — never ship any of them to a browser.
export ECASH_BASE_URL="https://be.ecashpay.com/api"
export ECASH_API_KEY="ecpay_test_…"
export ECASH_API_SECRET="…"        # HMAC signing secret

# 1) authoritative time — the signature is rejected outside a tolerance window
TS=$(curl -s "$ECASH_BASE_URL/v1/payments/server-time" | jq -r .unix)
NONCE=$(openssl rand -hex 16)

RAW_BODY=""

# 2) sign "timestamp.nonce.rawBody"
SIG=$(printf '%s.%s.%s' "$TS" "$NONCE" "$RAW_BODY" \
  | openssl dgst -sha256 -hmac "$ECASH_API_SECRET" -r | cut -d' ' -f1)

# 3) send
curl -s -X GET "https://be.ecashpay.com/api/v1/merchant/profile" \
  -H "X-Api-Key: $ECASH_API_KEY" \
  -H "X-Ecash-Timestamp: $TS" \
  -H "X-Ecash-Nonce: $NONCE" \
  -H "X-Ecash-Signature: t=$TS,v1=$SIG" \
  -H "Content-Type: application/json"

Sample response

200 OK
{
  "merchantId": "3230a735…",
  "name": "Acme Retail",
  "slug": "acme-retail",
  "status": "ACTIVE",
  "environment": "TEST",
  "businessName": "Acme Retail Inc.",
  "contactEmail": "owner@acme.example",
  "contactName": "Ana Cruz",
  "contactMobile": "+639171234567",
  "accountType": "organization",
  "verificationStatus": "approved"
}

GET/v1/merchant/verification

Your KYC / KYB verdict, and whether it lets you charge yet.

Security
API_KEYSIGNATURE
Endpoint
GET https://be.ecashpay.com/api/v1/merchant/verification

This endpoint takes no request body.

Example request

# Building a signed request from scratch. To just re-send THIS request, press Run and
# and copy the ready-made curl from the response.
#
# Paste this whole block into a terminal. Fill in the marked values and it runs —
# or type them into "Your keys" above the samples and this fills itself in.
# ECASH_API_KEY is environment-scoped (ecpay_test_/ecpay_live_) and decides which environment the request executes in; it comes from your API keys page, and ECASH_API_SECRET (HMAC) + ECASH_ENC_KEY (32-byte AES key) are the security keys issued with your account — never ship any of them to a browser.
export ECASH_BASE_URL="https://be.ecashpay.com/api"
export ECASH_API_KEY="ecpay_test_…"
export ECASH_API_SECRET="…"        # HMAC signing secret

# 1) authoritative time — the signature is rejected outside a tolerance window
TS=$(curl -s "$ECASH_BASE_URL/v1/payments/server-time" | jq -r .unix)
NONCE=$(openssl rand -hex 16)

RAW_BODY=""

# 2) sign "timestamp.nonce.rawBody"
SIG=$(printf '%s.%s.%s' "$TS" "$NONCE" "$RAW_BODY" \
  | openssl dgst -sha256 -hmac "$ECASH_API_SECRET" -r | cut -d' ' -f1)

# 3) send
curl -s -X GET "https://be.ecashpay.com/api/v1/merchant/verification" \
  -H "X-Api-Key: $ECASH_API_KEY" \
  -H "X-Ecash-Timestamp: $TS" \
  -H "X-Ecash-Nonce: $NONCE" \
  -H "X-Ecash-Signature: t=$TS,v1=$SIG" \
  -H "Content-Type: application/json"

Sample response

200 OK
{
  "programme": "kyb",
  "status": "approved",
  "canTransact": true,
  "submittedAt": "2026-07-01T08:00:00.000Z",
  "reviewedAt": "2026-07-03T10:30:00.000Z",
  "reason": null
}
PreviousTesting

On this page

  • Payments
  • Transactions
  • Customers
  • Merchant account