Skip to content
ToruPay

ToruPay API

ToruPay turns a mobile-money transfer in Bangladesh into something your server can act on. Your backend opens a checkout session, the buyer sends money from bKash, Nagad, Rocket, Upay or Cellfin and enters the TrxID on a hosted page, a phone you paired reads the provider SMS, and your webhook_url receives an HMAC-signed callback.

The path of one payment

  1. Your server calls POST /api/v1/checkout/initialize with your API key and gets back a checkout_url.
  2. You send the buyer to that URL. The page is in Bengali and English and counts down to the session expiry.
  3. The buyer sends the money and types the TrxID from the SMS into the page.
  4. A paired Android phone uploads the same SMS, signed with its own device key. Postgres matches the parsed transaction to the open session in one atomic statement.
  5. ToruPay POSTs a signed callback to your webhook_url and retries until your endpoint returns a 2xx.

Endpoints

EndpointAuthPurpose
POST /api/v1/checkout/initializex-api-keyCreate or idempotently reuse a checkout session for one order.
POST /api/v1/checkout/verifyx-api-keyClaim a session from your own server when you already hold the TrxID.
POST /api/v1/checkout/submitSession idThe hosted page’s own claim call. You do not normally call this yourself.

Base URL and formats

  • The base URL is the ToruPay domain issued with your account. Every example writes it as $KRONX_BASE_URL.
  • Requests and responses are JSON. Send content-type: application/json.
  • Amounts are Bangladeshi taka with at most two decimal places, sent as a string such as "1200.00" so nothing passes through floating-point arithmetic.
  • Every failure returns a JSON body with an error field. The full list is on the errors page.
NextQuickstart →