Zennopay Docs — Cross-border QR payments, one SDK

Mint receipt token

curl --request POST \
  --url https://api.example.com/v1/payment_intents/{intent_id}/receipt_token \
  --header 'X-Zennopay-Key-Id: <x-zennopay-key-id>' \
  --header 'X-Zennopay-Nonce: <x-zennopay-nonce>' \
  --header 'X-Zennopay-Signature: <x-zennopay-signature>' \
  --header 'X-Zennopay-Timestamp: <x-zennopay-timestamp>'

import requests

url = "https://api.example.com/v1/payment_intents/{intent_id}/receipt_token"

headers = {
    "X-Zennopay-Key-Id": "<x-zennopay-key-id>",
    "X-Zennopay-Timestamp": "<x-zennopay-timestamp>",
    "X-Zennopay-Nonce": "<x-zennopay-nonce>",
    "X-Zennopay-Signature": "<x-zennopay-signature>"
}

response = requests.post(url, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'X-Zennopay-Key-Id': '<x-zennopay-key-id>',
    'X-Zennopay-Timestamp': '<x-zennopay-timestamp>',
    'X-Zennopay-Nonce': '<x-zennopay-nonce>',
    'X-Zennopay-Signature': '<x-zennopay-signature>'
  }
};

fetch('https://api.example.com/v1/payment_intents/{intent_id}/receipt_token', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/v1/payment_intents/{intent_id}/receipt_token",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_HTTPHEADER => [
    "X-Zennopay-Key-Id: <x-zennopay-key-id>",
    "X-Zennopay-Nonce: <x-zennopay-nonce>",
    "X-Zennopay-Signature: <x-zennopay-signature>",
    "X-Zennopay-Timestamp: <x-zennopay-timestamp>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/v1/payment_intents/{intent_id}/receipt_token"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("X-Zennopay-Key-Id", "<x-zennopay-key-id>")
	req.Header.Add("X-Zennopay-Timestamp", "<x-zennopay-timestamp>")
	req.Header.Add("X-Zennopay-Nonce", "<x-zennopay-nonce>")
	req.Header.Add("X-Zennopay-Signature", "<x-zennopay-signature>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.example.com/v1/payment_intents/{intent_id}/receipt_token")
  .header("X-Zennopay-Key-Id", "<x-zennopay-key-id>")
  .header("X-Zennopay-Timestamp", "<x-zennopay-timestamp>")
  .header("X-Zennopay-Nonce", "<x-zennopay-nonce>")
  .header("X-Zennopay-Signature", "<x-zennopay-signature>")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.example.com/v1/payment_intents/{intent_id}/receipt_token")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-Zennopay-Key-Id"] = '<x-zennopay-key-id>'
request["X-Zennopay-Timestamp"] = '<x-zennopay-timestamp>'
request["X-Zennopay-Nonce"] = '<x-zennopay-nonce>'
request["X-Zennopay-Signature"] = '<x-zennopay-signature>'

response = http.request(request)
puts response.read_body

{
  "receipt_token": "<string>",
  "receipt_token_expires_at": 123
}

POST

payment_intents

{intent_id}

receipt_token

Mint receipt token

curl --request POST \
  --url https://api.example.com/v1/payment_intents/{intent_id}/receipt_token \
  --header 'X-Zennopay-Key-Id: <x-zennopay-key-id>' \
  --header 'X-Zennopay-Nonce: <x-zennopay-nonce>' \
  --header 'X-Zennopay-Signature: <x-zennopay-signature>' \
  --header 'X-Zennopay-Timestamp: <x-zennopay-timestamp>'

import requests

url = "https://api.example.com/v1/payment_intents/{intent_id}/receipt_token"

headers = {
    "X-Zennopay-Key-Id": "<x-zennopay-key-id>",
    "X-Zennopay-Timestamp": "<x-zennopay-timestamp>",
    "X-Zennopay-Nonce": "<x-zennopay-nonce>",
    "X-Zennopay-Signature": "<x-zennopay-signature>"
}

response = requests.post(url, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'X-Zennopay-Key-Id': '<x-zennopay-key-id>',
    'X-Zennopay-Timestamp': '<x-zennopay-timestamp>',
    'X-Zennopay-Nonce': '<x-zennopay-nonce>',
    'X-Zennopay-Signature': '<x-zennopay-signature>'
  }
};

fetch('https://api.example.com/v1/payment_intents/{intent_id}/receipt_token', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/v1/payment_intents/{intent_id}/receipt_token",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_HTTPHEADER => [
    "X-Zennopay-Key-Id: <x-zennopay-key-id>",
    "X-Zennopay-Nonce: <x-zennopay-nonce>",
    "X-Zennopay-Signature: <x-zennopay-signature>",
    "X-Zennopay-Timestamp: <x-zennopay-timestamp>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/v1/payment_intents/{intent_id}/receipt_token"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("X-Zennopay-Key-Id", "<x-zennopay-key-id>")
	req.Header.Add("X-Zennopay-Timestamp", "<x-zennopay-timestamp>")
	req.Header.Add("X-Zennopay-Nonce", "<x-zennopay-nonce>")
	req.Header.Add("X-Zennopay-Signature", "<x-zennopay-signature>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.example.com/v1/payment_intents/{intent_id}/receipt_token")
  .header("X-Zennopay-Key-Id", "<x-zennopay-key-id>")
  .header("X-Zennopay-Timestamp", "<x-zennopay-timestamp>")
  .header("X-Zennopay-Nonce", "<x-zennopay-nonce>")
  .header("X-Zennopay-Signature", "<x-zennopay-signature>")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.example.com/v1/payment_intents/{intent_id}/receipt_token")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-Zennopay-Key-Id"] = '<x-zennopay-key-id>'
request["X-Zennopay-Timestamp"] = '<x-zennopay-timestamp>'
request["X-Zennopay-Nonce"] = '<x-zennopay-nonce>'
request["X-Zennopay-Signature"] = '<x-zennopay-signature>'

response = http.request(request)
puts response.read_body

{
  "receipt_token": "<string>",
  "receipt_token_expires_at": 123
}

Reopening the authoritative receipt for a past payment needs a receipt token — a read-only credential the SDK sends as Authorization: Bearer on GET /receipt. Like the session token, Zennopay mints it; you request one with a single HMAC-signed call for an intent you own. There is no request body. The token’s sub is derived from the stored intent’s partner_user_id — you don’t supply it. That makes the token user-scoped: it can open any of that user’s receipts within its window, but no one else’s. See Reopen a receipt for the full SDK flow.

Headers

Server-to-server only; HMAC-signed. See Authentication.

string

required

Identifies which signing key was used.

string

required

ISO-8601 / RFC 3339 UTC timestamp. ±5 minute skew.

string

required

Random 32-byte hex string (64 chars). Replays within 10 minutes are rejected.

string

required

Base64 HMAC-SHA256 of the canonical request string. The body is empty, so the body-hash line of the canonical request is the empty string.

Path parameters

string

required

The intent whose user should be able to reopen receipts, e.g. zp_AbCd1234EfGh5678. The partner identified by the HMAC key must own it.

No existence leak. If the intent isn’t yours — a cross-partner id or an unknown id — the response is an identical 404. It does not distinguish “doesn’t exist” from “not yours”.

Response

string

A Zennopay-minted, read-only receipt token (aud: zennopay-receipt). Return it to your app; the SDK sends it as Authorization: Bearer on GET /receipt. Reusable — the SDK reuses it to poll a pending receipt to a terminal state.

integer

Unix epoch seconds at which the token stops verifying (TTL 300s).

Example

Example uses the sandbox host. Swap to https://api.zennopay.com in production. The legacy api.zennopay.in hosts are still served for existing integrations. See Environments.

curl -X POST https://api.sandbox.zennopay.com/v1/payment_intents/zp_AbCd1234EfGh5678/receipt_token \
  -H "X-Zennopay-Key-Id: acme_sandbox_2026q2" \
  -H "X-Zennopay-Timestamp: 2026-05-21T15:02:00Z" \
  -H "X-Zennopay-Nonce: c3d4e5f6789012345678abcdef00a1b2c3d4e5f6789012345678abcdef001122" \
  -H "X-Zennopay-Signature: <base64_hmac_sha256>"

curl -X POST https://api.zennopay.com/v1/payment_intents/zp_AbCd1234EfGh5678/receipt_token \
  -H "X-Zennopay-Key-Id: acme_prod_2026q2" \
  -H "X-Zennopay-Timestamp: 2026-05-21T15:02:00Z" \
  -H "X-Zennopay-Nonce: c3d4e5f6789012345678abcdef00a1b2c3d4e5f6789012345678abcdef001122" \
  -H "X-Zennopay-Signature: <base64_hmac_sha256>"

Response

{
  "receipt_token": "zprt_2f9c…",
  "receipt_token_expires_at": 1716306300
}

Get payment intent

Get receipt

⌘I

​Headers

​Path parameters

​Response

​Example

Headers

Path parameters

Response

Example