PayEurasia logoPayEurasia
Developer Documentation

PayEurasia API Documentation

Build wallet, UPI and bank payouts across Bangladesh, India, Pakistan and Nepal with a single REST API. All endpoints return JSON and use standard HTTP status codes.

AuthenticationEndpointsWebhooksErrors

Base URL

All requests are made over HTTPS to the regional gateway.

Production
https://api.payeurasia.com/v1
Sandbox
https://sandbox.payeurasia.com/v1

Authentication

The PayEurasia API uses HMAC-signed bearer tokens. Every request must include an Authorization header and a request signature.

  1. Create an API key pair in the developer dashboard — you receive a key_id and secret.
  2. Generate a request signature: HMAC_SHA256(secret, timestamp + "." + raw_body).
  3. Send Authorization: Bearer <key_id>, X-PE-Timestamp, and X-PE-Signature headers.
  4. Rotate keys every 90 days. Sandbox keys never expire but cannot move real funds.
bash
curl https://api.payeurasia.com/v1/payments \
  -H "Authorization: Bearer pe_live_8fH3..." \
  -H "X-PE-Timestamp: 1718900000" \
  -H "X-PE-Signature: 9a1c4e8b2f..." \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 250000,
    "currency": "BDT",
    "method": "bkash",
    "customer": { "msisdn": "+8801XXXXXXXXX" },
    "reference": "order_18A2",
    "callback_url": "https://example.com/cb"
  }'

Core Endpoints

POST/v1/paymentsCreate a payment intent
GET/v1/payments/:idRetrieve a payment
POST/v1/payments/:id/captureCapture an authorized payment
POST/v1/refundsRefund a captured payment
POST/v1/payoutsSend a payout to a wallet or bank account
GET/v1/balancesList balances per currency
GET/v1/eventsList recent API and webhook events

Example: create a UPI payment

http
POST /v1/payments HTTP/1.1
Host: api.payeurasia.com
Authorization: Bearer pe_live_8fH3...
Content-Type: application/json

{
  "amount": 49900,
  "currency": "INR",
  "method": "upi",
  "customer": { "vpa": "user@okhdfcbank" },
  "reference": "INV-2026-0042",
  "callback_url": "https://merchant.example.com/webhooks/pe"
}

Example response

json
{
  "id": "pay_01HZX9K8M4R",
  "object": "payment",
  "status": "pending",
  "amount": 49900,
  "currency": "INR",
  "method": "upi",
  "reference": "INV-2026-0042",
  "created_at": "2026-06-20T10:14:22Z",
  "next_action": {
    "type": "collect_request_sent",
    "expires_at": "2026-06-20T10:19:22Z"
  }
}

Webhooks

Register an HTTPS endpoint and PayEurasia will POST a JSON event for every state change. Events are retried with exponential backoff for up to 24 hours until your endpoint returns a 2xx.

Event types

payment.created
payment.succeeded
payment.failed
payment.refunded
payout.completed
payout.failed
dispute.opened

Example payload

json
{
  "id": "evt_01HZX9P2QN",
  "type": "payment.succeeded",
  "created_at": "2026-06-20T10:15:01Z",
  "data": {
    "id": "pay_01HZX9K8M4R",
    "amount": 49900,
    "currency": "INR",
    "method": "upi",
    "reference": "INV-2026-0042",
    "status": "succeeded"
  }
}

Verifying signatures

Every webhook includes an X-PE-Signature header. Recompute the HMAC and use a constant-time comparison before trusting the payload.

javascript
import { createHmac, timingSafeEqual } from "crypto";

export function verifyWebhook(rawBody, signature, secret) {
  const expected = createHmac("sha256", secret).update(rawBody).digest("hex");
  const a = Buffer.from(signature, "hex");
  const b = Buffer.from(expected, "hex");
  return a.length === b.length && timingSafeEqual(a, b);
}

Errors

PayEurasia uses conventional HTTP status codes.

200Successful request.400Invalid parameters or signature.401Missing or invalid authentication.404Resource does not exist.409Idempotency conflict.429Rate limited — retry with backoff.5xxTransient gateway error — safe to retry.
Request API access