Requests and responses

Base URL, the { ok, data } envelope, amounts in minor units and CORS.

Base URL

https://api.autopayke.com/api/v1

Everything is HTTPS. Send JSON bodies with Content-Type: application/json.

The response envelope

Every response, success or failure, has the same outer shape:

// Success
{ "ok": true, "data": { … } }

// Failure
{ "ok": false, "error": "Enter a valid amount", "code": "VALIDATION_ERROR" }

Branch on ok, then on code. error is a sentence written for people: you can show it as it is. See Errors for every code.

Amounts

Requests take major units as a decimal string: "1500" is KES 1,500, "40" is 40 USDC. Responses give minor units as a decimal string, so no precision is lost to floating point.

Currency	Minor units	1 unit is	Example
`KES`	2 decimals (cents)	`"100"`	`"150000"` = KES 1,500.00
`NGN`	2 decimals (kobo)	`"100"`	`"2000000"` = ₦20,000.00
`USD`	2 decimals (cents)	`"100"`	`"5000"` = $50.00
`USDC`	6 decimals	`"1000000"`	`"40000000"` = 40 USDC

Parse minor units with BigInt in JavaScript or int in Python, and only divide when you display them.

Idempotency

Anything that moves money accepts an idempotencyKey (8–80 characters) in the body. Top-ups also accept it as an Idempotency-Key header. Retrying with the same key returns the original result instead of charging twice, so it's safe to retry after a timeout.

curl -X POST "https://api.autopayke.com/api/v1/funding/mobile-money" \
  -H "Authorization: Bearer $AUTOPAYKE_TOKEN" \
  -H "Idempotency-Key: order-1042-topup" \
  -H "Content-Type: application/json" \
  -d '{ "amount": "1500", "phone": "+254712345678" }'

Identifiers and timestamps

Ids are UUIDs, except payment link codes (6–32 letters, digits, - or _).
Times are ISO 8601 in UTC, e.g. 2026-11-03T09:10:41.000Z.
Countries are ISO 3166-1 alpha-2 (KE), currencies ISO 4217 (KES), phones E.164 (+254712345678).

Calling from a browser

Browsers only allow calls from AutoPayKe's own sites (CORS). Call the API from your server, and keep tokens there. Public endpoints work from any server, script or terminal.

Caching

/capabilities and /fees/published send Cache-Control: public, max-age=60. Caching them for up to a minute is safe; quotes and everything else should be fetched fresh.