Skip to main content
Sandbox accountContact
REST API

A predictable API, built to integrate fast

Per-environment API keys, idempotency, explicit errors, signed webhooks: everything you expect from a modern payments API.

Create a sandbox accountExplore the API
Create a payment link
X-CHARI-PAY-API-KEY: chari_sk_test_… POST /v1/payment-links{  "amount": 149.90,  "description": "Commande n° 1234",  "externalId": "order-1234"} // 201 Created{  "reference": "pl_3ND8xk",  "status": "ACTIVE",  "currency": "MAD",  "payUrl": "https://…"}
Conventions

Conventions that hold no surprises

The key is the environment

A sandbox key operates on test data, a production key on live data. The datasets are separate — just keep distinct idempotency keys between the two environments.

Idempotency

Replay a call with the same externalId: you get the existing object back, never a duplicate.

Explicit errors

A single envelope, a stable machine code and a correlationId on every response — success and error alike.

Transparent rate limiting

The publicly exposed endpoints (authentication, payment page, inbound webhooks) advertise X-RateLimit-Limit, Remaining and Reset, and answer 429 with Retry-After when exceeded.

Finely scoped keys

Keys per company and per environment, per-module permissions (scopes) — the full key is shown exactly once, at creation.

Signed webhooks

Every event is HMAC-signed with a timestamp, and retried automatically if your server is unavailable.

Developer space

Your keys, your webhooks, your logs

Create a sandbox key in a minute, declare your receiving URLs, and review every delivery alongside the code your server returned.

portal-psp.charipay.ma/app/developers
ChariPay portal developer space: API keys, webhook endpoints and the delivery log.
The full key is shown exactly once, at creation: store it in a vault.

Webhooks you can trust

Verify the signature before reading the body, deduplicate by event id, reply 2xx once processed: the platform handles the retries. Notification URLs require HTTPS.

  • HMAC signature + timestamp on every event
  • Automatic retries if your server is unavailable
  • HTTPS required on all notification URLs
webhook
// En-têtes reçusX-CHARI-SIGNATURE: a3f19c… (HMAC-SHA256)X-CHARI-TIMESTAMP: 1756166400000Chari-Event-Id: 9f2c31a4-…Chari-Event-Type: payment.succeeded // Corps — signé tel quel, octet par octet{ … }

Start without asking permission

A complete test environment — API keys, webhooks, sample data — with self-serve sign-up: create your account online, activate it by email, log in to the portal and mint your own API key. No email to support, no commitment.

The full API reference — 62 endpoints with curl, JavaScript, Python and PHP examples — is published on this site, freely accessible.

From first call to production

  1. Create your sandbox key

    Online sign-up, email activation, key created from the portal — shown exactly once.

  2. Integrate and test

    Links, sessions, subscriptions, webhooks — everything is available in the sandbox.

  3. Go live

    KYB approved, account activated: your production key takes over.

Ready to make your first call?

Create a sandbox account or tell us about your integration.

Contact us