Your account & keys
NetPay accounts are opened by our team after a short review of your business. Once you are in, everything you need to integrate is on the Developers page of your dashboard.
What you get
A dashboard login
Sign in at netpay.ph/login. The first time, you choose your own password.
LIVE and TEST API keys
Each key is a key id (
npk_live_...ornpk_test_...) and a secret that is shown once. Keep the secret on your server, never in a browser or an app.A webhook secret
Used to sign the webhooks we send you. Set your webhook URL on the Developers page.
Secrets cannot be shown again. Create a new key on the Developers page and revoke the old one; rotate the webhook secret the same way.
Your first call
Every request is signed. Start with GET /v1/ping: if it answers, your keys and signature are right.
const crypto = require('crypto');
async function netpay(method, path, body) {
const raw = body ? JSON.stringify(body) : '';
const ts = String(Math.floor(Date.now() / 1000));
const signature = crypto.createHmac('sha256', process.env.NETPAY_SECRET)
.update(ts + '\n' + method + '\n' + path + '\n' + raw).digest('hex');
const res = await fetch('https://api.netpay.ph' + path, {
method, body: raw || undefined,
headers: { 'Content-Type': 'application/json', 'X-Api-Key': process.env.NETPAY_KEY,
'X-Timestamp': ts, 'X-Signature': signature },
});
return res.json();
}function netpay(string $method, string $path, ?array $body = null): array {
$raw = $body ? json_encode($body) : '';
$ts = (string)time();
$signature = hash_hmac('sha256', "$ts\n$method\n$path\n$raw", getenv('NETPAY_SECRET'));
$ch = curl_init('https://api.netpay.ph' . $path);
curl_setopt_array($ch, [CURLOPT_CUSTOMREQUEST => $method, CURLOPT_RETURNTRANSFER => true,
CURLOPT_POSTFIELDS => $raw ?: null, CURLOPT_HTTPHEADER => ['Content-Type: application/json',
'X-Api-Key: ' . getenv('NETPAY_KEY'), "X-Timestamp: $ts", "X-Signature: $signature"]]);
return json_decode(curl_exec($ch), true);
}The full signing rules are in Webhooks & API.
Security settings
- IP allowlist - only accept API calls from your servers' addresses.
- Allowed return domains - only send customers back to your own sites after checkout.
- Staff - your team signs in with their own accounts; you can see and sign out every active session.