API

Authentication

Every API call is a POST with a JSON body and your brand API key in a request header.

Header

MHS-GUARANTEEPAY-API-KEY: YOUR_API_KEY
Content-Type: application/json

Header names are case-insensitive. These aliases are also accepted for older integrations: MH-GUARANTEEPAY-API-KEY, MHS-PIPRAPAY-API-KEY, MH-PIPRAPAY-API-KEY.

The key must be sent as a header. Putting it in the JSON body (for example as brand_api or api_key) does not work and returns INVALID_API_KEY.

Permissions (scopes)

Each key only works for the permissions ticked when it was created:

Permission in panel	Scope	Endpoints
Create Payment	`create_payment`	`/api/create-charge`, `/api/checkout/redirect`, `/api/checkout/popup`, `/api/mark-sms-used`
Verify Payment	`verify_payment`	`/api/verify-payment`, `/api/mark-sms-used`
Refund Payment	`refund_payment`	`/api/refund-payment`

Key rules

A key belongs to one brand. Payments created with it appear under that brand only.
The key must be active and not past its expiry date.
Keep it on your server. Never put it in a website, mobile app or public repository. If it leaks, delete it and create a new one.
If you add any IP address under Domains & IP, calls from other IPs are rejected with IP_NOT_WHITELISTED.