Signed requests
HMAC-SHA256 signatures with timestamps and nonces block replays.
A predictable REST API, signed requests, idempotency everywhere and a sandbox that mirrors production.

Create an API credential in the dashboard. Keys are shown once.
Send the amount, currency and terminal with a signed request.
Confirm with a test card and receive the result by webhook.
# Create a payment intent in the sandbox
curl https://api.sandbox.exelpay.com/v1/payment_intents \
-H "ExelPay-Key-Id: key_01J..." \
-H "ExelPay-Timestamp: 1798200000" \
-H "ExelPay-Nonce: 6f1c9d2e-..." \
-H "ExelPay-Signature: v1=..." \
-H "Idempotency-Key: order-1042" \
-H "Content-Type: application/json" \
-d '{
"amount_minor": 4820,
"currency": "EUR",
"terminal_id": "trm_...",
"merchant_reference": "order-1042"
}'HMAC-SHA256 signatures with timestamps and nonces block replays.
Retry any money-moving request safely; duplicates return the first result.
Signed events, automatic retries, a dead-letter queue and manual resend.
Published test cards and simulated challenges for every flow.
Pin a version date and upgrade on your own schedule.
Generate clients and validate requests from the published specification.

Tell us about your business and we will design the right setup with you.