Zennopay Docs — Cross-border QR payments, one SDK

Create payment intent

curl --request POST \
  --url https://api.example.com/v1/payment_intents \
  --header 'Content-Type: application/json' \
  --header 'X-Zennopay-Key-Id: <x-zennopay-key-id>' \
  --header 'X-Zennopay-Nonce: <x-zennopay-nonce>' \
  --header 'X-Zennopay-Signature: <x-zennopay-signature>' \
  --header 'X-Zennopay-Timestamp: <x-zennopay-timestamp>' \
  --data '
{
  "partner_user_id": "<string>",
  "amount_usd_cents": 123,
  "corridor": "<string>",
  "kyc_attestation": {},
  "sanctions_attestation": {}
}
'

import requests

url = "https://api.example.com/v1/payment_intents"

payload = {
    "partner_user_id": "<string>",
    "amount_usd_cents": 123,
    "corridor": "<string>",
    "kyc_attestation": {},
    "sanctions_attestation": {}
}
headers = {
    "X-Zennopay-Key-Id": "<x-zennopay-key-id>",
    "X-Zennopay-Timestamp": "<x-zennopay-timestamp>",
    "X-Zennopay-Nonce": "<x-zennopay-nonce>",
    "X-Zennopay-Signature": "<x-zennopay-signature>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'X-Zennopay-Key-Id': '<x-zennopay-key-id>',
    'X-Zennopay-Timestamp': '<x-zennopay-timestamp>',
    'X-Zennopay-Nonce': '<x-zennopay-nonce>',
    'X-Zennopay-Signature': '<x-zennopay-signature>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    partner_user_id: '<string>',
    amount_usd_cents: 123,
    corridor: '<string>',
    kyc_attestation: {},
    sanctions_attestation: {}
  })
};

fetch('https://api.example.com/v1/payment_intents', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/v1/payment_intents",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'partner_user_id' => '<string>',
    'amount_usd_cents' => 123,
    'corridor' => '<string>',
    'kyc_attestation' => [
        
    ],
    'sanctions_attestation' => [
        
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "X-Zennopay-Key-Id: <x-zennopay-key-id>",
    "X-Zennopay-Nonce: <x-zennopay-nonce>",
    "X-Zennopay-Signature: <x-zennopay-signature>",
    "X-Zennopay-Timestamp: <x-zennopay-timestamp>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/v1/payment_intents"

	payload := strings.NewReader("{\n  \"partner_user_id\": \"<string>\",\n  \"amount_usd_cents\": 123,\n  \"corridor\": \"<string>\",\n  \"kyc_attestation\": {},\n  \"sanctions_attestation\": {}\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-Zennopay-Key-Id", "<x-zennopay-key-id>")
	req.Header.Add("X-Zennopay-Timestamp", "<x-zennopay-timestamp>")
	req.Header.Add("X-Zennopay-Nonce", "<x-zennopay-nonce>")
	req.Header.Add("X-Zennopay-Signature", "<x-zennopay-signature>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.example.com/v1/payment_intents")
  .header("X-Zennopay-Key-Id", "<x-zennopay-key-id>")
  .header("X-Zennopay-Timestamp", "<x-zennopay-timestamp>")
  .header("X-Zennopay-Nonce", "<x-zennopay-nonce>")
  .header("X-Zennopay-Signature", "<x-zennopay-signature>")
  .header("Content-Type", "application/json")
  .body("{\n  \"partner_user_id\": \"<string>\",\n  \"amount_usd_cents\": 123,\n  \"corridor\": \"<string>\",\n  \"kyc_attestation\": {},\n  \"sanctions_attestation\": {}\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.example.com/v1/payment_intents")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-Zennopay-Key-Id"] = '<x-zennopay-key-id>'
request["X-Zennopay-Timestamp"] = '<x-zennopay-timestamp>'
request["X-Zennopay-Nonce"] = '<x-zennopay-nonce>'
request["X-Zennopay-Signature"] = '<x-zennopay-signature>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"partner_user_id\": \"<string>\",\n  \"amount_usd_cents\": 123,\n  \"corridor\": \"<string>\",\n  \"kyc_attestation\": {},\n  \"sanctions_attestation\": {}\n}"

response = http.request(request)
puts response.read_body

{
  "intent_id": "<string>",
  "status": "<string>",
  "amount_usd_cents": 123,
  "corridor": "<string>",
  "session_token": "<string>",
  "session_expires_at": 123,
  "created_at": "<string>"
}

POST

payment_intents

Create payment intent

curl --request POST \
  --url https://api.example.com/v1/payment_intents \
  --header 'Content-Type: application/json' \
  --header 'X-Zennopay-Key-Id: <x-zennopay-key-id>' \
  --header 'X-Zennopay-Nonce: <x-zennopay-nonce>' \
  --header 'X-Zennopay-Signature: <x-zennopay-signature>' \
  --header 'X-Zennopay-Timestamp: <x-zennopay-timestamp>' \
  --data '
{
  "partner_user_id": "<string>",
  "amount_usd_cents": 123,
  "corridor": "<string>",
  "kyc_attestation": {},
  "sanctions_attestation": {}
}
'

import requests

url = "https://api.example.com/v1/payment_intents"

payload = {
    "partner_user_id": "<string>",
    "amount_usd_cents": 123,
    "corridor": "<string>",
    "kyc_attestation": {},
    "sanctions_attestation": {}
}
headers = {
    "X-Zennopay-Key-Id": "<x-zennopay-key-id>",
    "X-Zennopay-Timestamp": "<x-zennopay-timestamp>",
    "X-Zennopay-Nonce": "<x-zennopay-nonce>",
    "X-Zennopay-Signature": "<x-zennopay-signature>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'X-Zennopay-Key-Id': '<x-zennopay-key-id>',
    'X-Zennopay-Timestamp': '<x-zennopay-timestamp>',
    'X-Zennopay-Nonce': '<x-zennopay-nonce>',
    'X-Zennopay-Signature': '<x-zennopay-signature>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    partner_user_id: '<string>',
    amount_usd_cents: 123,
    corridor: '<string>',
    kyc_attestation: {},
    sanctions_attestation: {}
  })
};

fetch('https://api.example.com/v1/payment_intents', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/v1/payment_intents",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'partner_user_id' => '<string>',
    'amount_usd_cents' => 123,
    'corridor' => '<string>',
    'kyc_attestation' => [
        
    ],
    'sanctions_attestation' => [
        
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "X-Zennopay-Key-Id: <x-zennopay-key-id>",
    "X-Zennopay-Nonce: <x-zennopay-nonce>",
    "X-Zennopay-Signature: <x-zennopay-signature>",
    "X-Zennopay-Timestamp: <x-zennopay-timestamp>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/v1/payment_intents"

	payload := strings.NewReader("{\n  \"partner_user_id\": \"<string>\",\n  \"amount_usd_cents\": 123,\n  \"corridor\": \"<string>\",\n  \"kyc_attestation\": {},\n  \"sanctions_attestation\": {}\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-Zennopay-Key-Id", "<x-zennopay-key-id>")
	req.Header.Add("X-Zennopay-Timestamp", "<x-zennopay-timestamp>")
	req.Header.Add("X-Zennopay-Nonce", "<x-zennopay-nonce>")
	req.Header.Add("X-Zennopay-Signature", "<x-zennopay-signature>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.example.com/v1/payment_intents")
  .header("X-Zennopay-Key-Id", "<x-zennopay-key-id>")
  .header("X-Zennopay-Timestamp", "<x-zennopay-timestamp>")
  .header("X-Zennopay-Nonce", "<x-zennopay-nonce>")
  .header("X-Zennopay-Signature", "<x-zennopay-signature>")
  .header("Content-Type", "application/json")
  .body("{\n  \"partner_user_id\": \"<string>\",\n  \"amount_usd_cents\": 123,\n  \"corridor\": \"<string>\",\n  \"kyc_attestation\": {},\n  \"sanctions_attestation\": {}\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.example.com/v1/payment_intents")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-Zennopay-Key-Id"] = '<x-zennopay-key-id>'
request["X-Zennopay-Timestamp"] = '<x-zennopay-timestamp>'
request["X-Zennopay-Nonce"] = '<x-zennopay-nonce>'
request["X-Zennopay-Signature"] = '<x-zennopay-signature>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"partner_user_id\": \"<string>\",\n  \"amount_usd_cents\": 123,\n  \"corridor\": \"<string>\",\n  \"kyc_attestation\": {},\n  \"sanctions_attestation\": {}\n}"

response = http.request(request)
puts response.read_body

{
  "intent_id": "<string>",
  "status": "<string>",
  "amount_usd_cents": 123,
  "corridor": "<string>",
  "session_token": "<string>",
  "session_expires_at": 123,
  "created_at": "<string>"
}

Headers

All requests must be HMAC-signed. See Authentication.

string

required

Identifies which signing key was used (e.g. acme_prod_2026q1).

string

required

ISO-8601 / RFC 3339 UTC timestamp. Requests more than 5 minutes off server time are rejected.

string

required

Random 32-byte hex string (64 chars). Replays within 10 minutes are rejected.

string

required

Base64 HMAC-SHA256 of the canonical request string.

string

Recommended. A UUID so a network retry can’t create two intents. Replaying the same key returns the original response (and its original session_token).

Body

string

required

Your opaque, stable user identifier. Never a raw government ID. Per-user regulatory limits are enforced against this value.

integer

required

The amount the user has authorized, in USD cents. Minimum is corridor-dependent.

string

required

One of th_promptpay (Thailand PromptPay) or vn_vietqr (Vietnam VietQR).

object

required

Your per-payment KYC attestation, from your real KYC system: { verified, method, verified_at, id_type, id_country }. id_type / id_country declare which government ID the user was KYC’d on; the raw ID number never crosses.

object

required

Your per-payment sanctions attestation, from your real screening system: { clean, screened_at }.

The KYC and sanctions attestations travel in this body: Zennopay mints the session token from the intent and will not move money on an intent that doesn’t carry them.

Response

string

Zennopay intent ID, format zp_.... Use this for subsequent SDK and webhook correlation.

string

Initial state. Always created on a successful POST.

integer

Echoes the request.

string

Echoes the request.

string

The Zennopay-minted session token for this intent. Return it to your app; the SDK sends it as Authorization: Bearer on scan/confirm/status. Opaque — treat it as a bearer secret and don’t parse it.

integer

Unix epoch seconds at which session_token stops verifying. Re-mint for the same intent with POST /v1/payment_intents/{intent_id}/session.

string

RFC 3339 UTC timestamp.

Example

Examples use the sandbox host. Swap to https://api.zennopay.com in production. The legacy api.zennopay.in hosts are still served for existing integrations. See Environments.

curl -X POST https://api.sandbox.zennopay.com/v1/payment_intents \
  -H "X-Zennopay-Key-Id: acme_sandbox_2026q2" \
  -H "X-Zennopay-Timestamp: 2026-05-21T14:30:00Z" \
  -H "X-Zennopay-Nonce: a1b2c3d4e5f6789012345678abcdef00a1b2c3d4e5f6789012345678abcdef00" \
  -H "X-Zennopay-Signature: <base64_hmac_sha256>" \
  -H "Idempotency-Key: 6f1c2b3a-..." \
  -H "Content-Type: application/json" \
  -d '{
    "partner_user_id": "usr_8f3ka92m",
    "amount_usd_cents": 345,
    "corridor": "th_promptpay",
    "kyc_attestation": { "verified": true, "method": "your_kyc_v2", "verified_at": "2026-05-21T13:30:00Z", "id_type": "passport", "id_country": "IN" },
    "sanctions_attestation": { "clean": true, "screened_at": "2026-05-21T14:25:00Z" }
  }'

curl -X POST https://api.zennopay.com/v1/payment_intents \
  -H "X-Zennopay-Key-Id: acme_prod_2026q2" \
  -H "X-Zennopay-Timestamp: 2026-05-21T14:30:00Z" \
  -H "X-Zennopay-Nonce: a1b2c3d4e5f6789012345678abcdef00a1b2c3d4e5f6789012345678abcdef00" \
  -H "X-Zennopay-Signature: <base64_hmac_sha256>" \
  -H "Idempotency-Key: 6f1c2b3a-..." \
  -H "Content-Type: application/json" \
  -d '{
    "partner_user_id": "usr_8f3ka92m",
    "amount_usd_cents": 345,
    "corridor": "th_promptpay",
    "kyc_attestation": { "verified": true, "method": "your_kyc_v2", "verified_at": "2026-05-21T13:30:00Z", "id_type": "passport", "id_country": "IN" },
    "sanctions_attestation": { "clean": true, "screened_at": "2026-05-21T14:25:00Z" }
  }'

Response

{
  "intent_id": "zp_AbCd1234EfGh5678",
  "status": "created",
  "amount_usd_cents": 345,
  "corridor": "th_promptpay",
  "session_token": "zpst_9b1f…",
  "session_expires_at": 1716305700,
  "created_at": "2026-05-21T14:30:00Z"
}

API playground

Re-mint session token

⌘I

​Headers

​Body

​Response

​Example

Headers

Body

Response

Example