Nexpay API

Introduction

The Nexpay API is a JSON-over-HTTPS REST API. All requests must be made server-side, from your own backend. Secrets must never be exposed to browsers or mobile apps.

Base URL: https://pay.nexbyt.com/api/v1

Authentication

Authenticate with a public key and a secret. Send the public key in the X-Nexpay-Key header and the secret in the X-Nexpay-Secret header.

X-Nexpay-Key: nx_test_xxxxxxxxxxxxxxxx
X-Nexpay-Secret: nx_test_yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy
Content-Type: application/json

Sandbox keys begin with nx_test_. Live keys begin with nx_live_ and require an approved verification.

Sandbox & Production

Sandbox and live are strictly separated. Sandbox calls never move real money and never touch live wallets or PayPal. Live calls require the live base URL and a live key.

Create Payment

POST https://pay.nexbyt.com/api/v1/payments.php

Request body:

{
  "amount": "100.00",
  "currency": "USD",
  "reference": "ORDER-001",
  "description": "Website development"
}

Response:

{
  "ok": true,
  "payment": {
    "reference": "NX-XXXXXXXX",
    "amount": "100.00",
    "currency": "USD",
    "status": "pending",
    "checkout_url": "https://pay.nexbyt.com/pay.php?slug=..."
  }
}

PHP

<?php
$ch = curl_init('https://pay.nexbyt.com/api/v1/payments.php');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_HTTPHEADER     => [
        'X-Nexpay-Key: nx_test_xxxxxxxxxxxxxxxx',
        'X-Nexpay-Secret: nx_test_yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'amount' => '100.00',
        'currency' => 'USD',
        'reference' => 'ORDER-001',
    ]),
]);
$resp = curl_exec($ch);
curl_close($ch);
$data = json_decode($resp, true);

JavaScript (Node)

const res = await fetch('https://pay.nexbyt.com/api/v1/payments.php', {
  method: 'POST',
  headers: {
    'X-Nexpay-Key': 'nx_test_xxxxxxxxxxxxxxxx',
    'X-Nexpay-Secret': 'nx_test_yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({ amount: '100.00', currency: 'USD', reference: 'ORDER-001' }),
});
const data = await res.json();

cURL

curl -X POST https://pay.nexbyt.com/api/v1/payments.php \
  -H "X-Nexpay-Key: nx_test_xxxxxxxxxxxxxxxx" \
  -H "X-Nexpay-Secret: nx_test_yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy" \
  -H "Content-Type: application/json" \
  -d '{"amount":"100.00","currency":"USD","reference":"ORDER-001"}'

Payment Links

You can create a public payment link programmatically. The response includes the slug and the public url.

POST https://pay.nexbyt.com/api/v1/payment-links.php

{
  "slug": "my-service",
  "link_title": "Website development",
  "amount": "100.00",
  "currency": "USD",
  "payment_methods": ["paypal", "card", "nexpay_wallet"]
}

Transactions

GET https://pay.nexbyt.com/api/v1/transactions.php?reference=NX-XXXXXXXX

Returns a single transaction belonging to the authenticated seller.

GET https://pay.nexbyt.com/api/v1/balance.php

Returns the seller’s wallet balances grouped by wallet type and currency.

Webhooks

Nexpay signs webhook deliveries with a per-webhook secret. Each request carries a X-Nexpay-Signature header (HMAC-SHA256 of the raw body, hex encoded, using the webhook’s secret).

Webhook events are delivered at least once. Your handler must be idempotent — process the event_id at most once.

Example event:

{
  "event_id": "evt_XXXXXXXX",
  "type": "payment.completed",
  "created_at": "2026-09-22T00:00:16+00:00",
  "data": {
    "reference": "NX-XXXXXXXX",
    "amount": "100.00",
    "currency": "USD",
    "status": "completed"
  }
}

Errors

Errors are JSON. The HTTP status reflects the class of error.

• 400 — invalid request
• 401 — missing or invalid credentials
• 403 — not authorized for this resource
• 404 — resource not found
• 409 — duplicate request
• 422 — validation error
• 429 — rate limited
• 500 — internal error

{
  "ok": false,
  "error": "invalid_request",
  "message": "Amount must be greater than zero."
}

Security

• Always call the API from your server, never from a browser or mobile client.
• Store secrets in environment variables or a vault.
• Rotate keys if you suspect a leak.
• Verify the webhook signature on every delivery.
• Treat webhook events as at least once, implement idempotency.