MPGS Validate Payment

Test URL

Live URL

This API will validate payment before card authorization. The API will do the following

• Check if the merchant is subscribed to the Card APIs service
• Check if they are subscribed to the MID they are using.
• Fetch the relevant chargescardNumber and cardSecurity are encrypted using AES encryption then the cypher is base64 encoded.

You can find libraries to encrypt on Github

200 Success Response Schema

Example Request

transactionReference+merchantMID+apiOperation+order.amount+order.currency+order.reference

Request Fields

curl --request POST \
     --url https://uat-unt.finserve.africa/mpgs-direct-integration/api/v3.2/validatePayment \
     --header 'Authorization: {{token}}' \
     --header 'Signature: {{signature}}' \
     --header 'content-type: application/json' \
     --data '
        {
            "transactionReference": "DEV1000008837309",
            "merchantMID": "TESTJENGA_MISC",
            "apiOperation": "CREATE_SESSION",//CREATE_SESSION/PAYMENT_LINK
            "responseUrl": "https://webhook.site/fd79166c-68e1-446b-a53a-f8aac45f0273",
            "returnUrl": "https://v3.jengahq.io",
            "merchantLogo": "https://www.finserve.africa/images/finserve-big-logo.svg",
            "order": {
                "amount": 100.56,
                "currency": "USD",
                "reference": "ORDERDEV10000059893"
            },
            "customer": {
                "firstName": "Johnstone",
                "lastName": "Doherty",
                "email": "johnstone.doherty@equitybank.co.ke"
            }
        }
'

Example Response

{
    "status": true,
    "code": 200,
    "message": "Payment validated successfully.",
    "data": {
        "chargeBearer": "CUSTOMER",
        "amount": 100.56,
        "code": 0,
        "charge": 3.52,
        "cardSchemeServiceId": 341,
        "actualAmount": 104.08,
        "message": "success"
    }
}

Error Responses

400 Bad Request

Missing or invalid parameters in the request body.

{
  "status": false,
  "code": 400,
  "message": "Invalid request parameters",
  "error_code": "INVALID_REQUEST"
}

401 Unauthorized

Invalid or expired access token.

{
  "status": false,
  "code": 401,
  "message": "Invalid or expired access token",
  "error_code": "UNAUTHORIZED"
}

403 Forbidden

Valid credentials but invalid signature or insufficient permissions.

{
  "status": false,
  "code": 403,
  "message": "Invalid signature or insufficient permissions",
  "error_code": "FORBIDDEN"
}

404 Not Found

Account not found or invalid account number.

{
  "status": false,
  "code": 404,
  "message": "Source or destination account not found",
  "error_code": "ACCOUNT_NOT_FOUND"
}

Transaction Status Errors

📖 Step-by-Step Guide

Step 1: 🔑 Set Up Security Keys

Generate your private and public key pair and share your public key with Finserve. See the Security & Signatures Documentation (opens in a new tab) for detailed instructions.

Step 2: 🎫 Authenticate

Obtain an access token using the authentication endpoint. See the Authentication API documentation (opens in a new tab) for details.

Step 3: 📋 Prepare Transaction Details

Gather all required information:

• Source account details (country code, name, account number)
• Destination account details (country code, name, account number)
• Transfer details (amount, currency, reference, date, description)

Step 4: ✍️ Generate Signature

Create the signature string by concatenating in this exact order:

transactionReference+merchantMID+apiOperation+order.amount+order.currency+order.reference

Sign this string using your private key, then Base64 encode the result.

Step 5: 📝 Set Up Headers

Include the following headers in your request:

• Content-Type: application/json
• Authorization: Bearer [your_access_token]
• Signature: [your_base64_encoded_signature]

Step 6: 🔧 Construct Request Body

Create a JSON object with all required fields following the structure shown in the example request.

Step 7: 🚀 Send POST Request

Make a POST request to the internal bank transfer endpoint with your headers and body.

🌍 Supported Countries & Currencies

Best Practices

1. ** Security**

   • Store your private key securely and never expose it in client-side code or version control
   • Always use HTTPS for API requests
   • Store access tokens securely
   • Regenerate signatures for each request

2. ** Signature Generation**

   • Ensure exact string concatenation order: transactionReference+merchantMID+apiOperation+order.amount+order.currency+order.reference
   • Do not include spaces, separators, or special characters in the concatenated string
   • Always Base64 encode the signature before including it in headers
   • Verify the values in the signature match exactly with the request body values

3. ** Transaction Reference**

   • Use unique reference numbers for each transaction
   • Implement a reference generation system to avoid duplicates
   • Store reference numbers for reconciliation and audit purposes
   • Never reuse reference numbers, even for failed transactions

4. Amount Formatting

   • Always use decimal format with two decimal places (e.g., "500.00")
   • Pass amounts as strings, not numbers
   • Ensure the amount is positive and within allowed limits
   • Verify amount matches exactly in signature and request body

5. Error Handling

   • Implement retry logic with exponential backoff for transient errors
   • Log transaction attempts and responses for audit purposes
   • Handle signature validation errors by regenerating the signature

6. Testing

   • Always test with the UAT endpoint before using the live endpoint
   • Use test account numbers provided in the documentation
   • Verify signature generation with sample data first
   • Test error scenarios to ensure proper handling

7. Data Validation

   • Validate all account numbers match the expected format
   • Verify country codes are valid and supported
   • Ensure transfer dates are in the correct format (YYYY-MM-DD)
   • Validate currency codes match the destination country

Troubleshooting

Invalid Signature Error (403)

If you receive a 403 error with "Invalid signature":

1. Verify the concatenation order: transactionReference+merchantMID + apiOperation + order.amount + order.currency + order.reference
2. Ensure no spaces or separators are included in the concatenated string
3. Check that the signature is Base64 encoded
4. Verify your public key is correctly registered with us
5. Ensure the values in the signature match exactly with the request body values

Common Signature Mistakes

• Using wrong concatenation order
• Adding spaces or separators between values
• Not Base64 encoding the final signature
• Values in signature don't match request body values

Support

For questions or issues with this API:

• Email: support@finserve.africa