Payments API

Authentication

TakaPay REST API uses API Key for authentication — no login required. Each store has its own API key, and it identifies which store a request is for.

API Key

Go to Admin → Webhooks, pick the store in the navbar, and copy that store’s API key. Send it on every request via the X-Api-Key header — payments you create with it always belong to that store. If you run multiple stores, use each store’s own key.

header

X-Api-Key: YOUR_STORE_API_KEY

curl example

curl https://pay.brainicsoft.com/api/v1/payments \
  -H "X-Api-Key: YOUR_STORE_API_KEY"

Security tips

Never expose the API key in frontend JS or mobile apps.
Always call from your server backend.
Rotate it anytime from Admin → Webhooks — this only invalidates the old key for that one store, not your others.

Base URL

production

https://pay.brainicsoft.com/api/v1

All REST endpoints below are relative to this base.

Public endpoints (no key needed)

These are used by the hosted checkout page — your customers open them in the browser.

GET /payments/public/:id — load checkout page data
POST /payments/public/:id/verify — customer submits TrxID

Inbound SMS webhook (TakaPay Android app)

The TakaPay Android app reads bKash / Nagad / Rocket receipts and forwards them here. Auth uses a separate X-Webhook-Secret header (view/regenerate in Admin → Webhooks).

POST/api/webhooks/takapay

payload from app

{
  "app": "TakaPay",
  "provider": "bkash",
  "kind": "received",
  "trxId": "BKH8X2K1M",
  "amount": 1490,
  "counterparty": "01711111111",
  "receivedAt": "2026-08-19T15:00:00.000Z"
}