Zennopay Docs — QR Payments and Platform Payouts

POST

payment_intents

{intent_id}

session

Re-mint session token

curl --request POST \
  --url https://api.example.com/v1/payment_intents/{intent_id}/session \
  --header 'Content-Type: application/json' \
  --header 'X-Zennopay-Key-Id: <x-zennopay-key-id>' \
  --header 'X-Zennopay-Nonce: <x-zennopay-nonce>' \
  --header 'X-Zennopay-Signature: <x-zennopay-signature>' \
  --header 'X-Zennopay-Timestamp: <x-zennopay-timestamp>' \
  --data '
{
  "partner_user_id": "<string>",
  "kyc_attestation": {},
  "sanctions_attestation": {}
}
'

import requests

url = "https://api.example.com/v1/payment_intents/{intent_id}/session"

payload = {
    "partner_user_id": "<string>",
    "kyc_attestation": {},
    "sanctions_attestation": {}
}
headers = {
    "X-Zennopay-Key-Id": "<x-zennopay-key-id>",
    "X-Zennopay-Timestamp": "<x-zennopay-timestamp>",
    "X-Zennopay-Nonce": "<x-zennopay-nonce>",
    "X-Zennopay-Signature": "<x-zennopay-signature>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'X-Zennopay-Key-Id': '<x-zennopay-key-id>',
    'X-Zennopay-Timestamp': '<x-zennopay-timestamp>',
    'X-Zennopay-Nonce': '<x-zennopay-nonce>',
    'X-Zennopay-Signature': '<x-zennopay-signature>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({partner_user_id: '<string>', kyc_attestation: {}, sanctions_attestation: {}})
};

fetch('https://api.example.com/v1/payment_intents/{intent_id}/session', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/v1/payment_intents/{intent_id}/session",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'partner_user_id' => '<string>',
    'kyc_attestation' => [
        
    ],
    'sanctions_attestation' => [
        
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "X-Zennopay-Key-Id: <x-zennopay-key-id>",
    "X-Zennopay-Nonce: <x-zennopay-nonce>",
    "X-Zennopay-Signature: <x-zennopay-signature>",
    "X-Zennopay-Timestamp: <x-zennopay-timestamp>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/v1/payment_intents/{intent_id}/session"

	payload := strings.NewReader("{\n  \"partner_user_id\": \"<string>\",\n  \"kyc_attestation\": {},\n  \"sanctions_attestation\": {}\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-Zennopay-Key-Id", "<x-zennopay-key-id>")
	req.Header.Add("X-Zennopay-Timestamp", "<x-zennopay-timestamp>")
	req.Header.Add("X-Zennopay-Nonce", "<x-zennopay-nonce>")
	req.Header.Add("X-Zennopay-Signature", "<x-zennopay-signature>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.example.com/v1/payment_intents/{intent_id}/session")
  .header("X-Zennopay-Key-Id", "<x-zennopay-key-id>")
  .header("X-Zennopay-Timestamp", "<x-zennopay-timestamp>")
  .header("X-Zennopay-Nonce", "<x-zennopay-nonce>")
  .header("X-Zennopay-Signature", "<x-zennopay-signature>")
  .header("Content-Type", "application/json")
  .body("{\n  \"partner_user_id\": \"<string>\",\n  \"kyc_attestation\": {},\n  \"sanctions_attestation\": {}\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.example.com/v1/payment_intents/{intent_id}/session")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-Zennopay-Key-Id"] = '<x-zennopay-key-id>'
request["X-Zennopay-Timestamp"] = '<x-zennopay-timestamp>'
request["X-Zennopay-Nonce"] = '<x-zennopay-nonce>'
request["X-Zennopay-Signature"] = '<x-zennopay-signature>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"partner_user_id\": \"<string>\",\n  \"kyc_attestation\": {},\n  \"sanctions_attestation\": {}\n}"

response = http.request(request)
puts response.read_body

{
  "session_token": "<string>",
  "session_expires_at": 123
}

When a session token expires mid-flow, don’t create a new intent — re-mint a token for the same one. Zennopay preserves the intent’s scan / quote / confirm state across the re-mint, so the user’s flow continues uninterrupted. This is exactly what your refreshSession hook calls your backend to do; your backend then makes this HMAC-signed call. See the refresh route in Build your session endpoint.

Headers

Server-to-server only; HMAC-signed. See Authentication.

string

required

Identifies which signing key was used.

string

required

ISO-8601 / RFC 3339 UTC timestamp. ±5 minute skew.

string

required

Random 32-byte hex string (64 chars). Replays within 10 minutes are rejected.

string

required

Base64 HMAC-SHA256 of the canonical request string over the JSON body below.

Path parameters

string

required

The intent to re-mint a session token for, e.g. 0198f31a-7c2b-7d91-9fa2-112233445566. The partner identified by the HMAC key must own it. Refreshing a token does not reset the intent or start another payment. For a completed payment, use a receipt token to reopen its receipt.

Body

The re-mint carries the same per-payment identity and compliance attestations as the original create call — Zennopay mints the fresh token from them.

string

required

Your opaque user identifier for the paying user. Must match the user the intent was created for.

object

required

Your per-payment KYC attestation, from your real verification system: { verified, method, verified_at, id_type, id_country }.

object

required

Your per-payment sanctions attestation: { clean, screened_at }.

Response

string

A fresh Zennopay-minted session token for the same intent. Return it to your app; the SDK swaps it in and retries the call that 401’d.

integer

Unix epoch seconds at which the new token stops verifying.

Example

curl -X POST https://api.sandbox.zennopay.com/v1/payment_intents/0198f31a-7c2b-7d91-9fa2-112233445566/session \
  -H "X-Zennopay-Key-Id: acme_sandbox_2026q2" \
  -H "X-Zennopay-Timestamp: 2026-05-21T14:35:00Z" \
  -H "X-Zennopay-Nonce: b2c3d4e5f6789012345678abcdef00a1b2c3d4e5f6789012345678abcdef0011" \
  -H "X-Zennopay-Signature: <base64_hmac_sha256>" \
  -H "Content-Type: application/json" \
  -d '{
    "partner_user_id": "usr_8f3ka92m",
    "kyc_attestation": { "verified": true, "method": "your_kyc_v2", "verified_at": "2026-05-21T13:30:00Z", "id_type": "passport", "id_country": "IN" },
    "sanctions_attestation": { "clean": true, "screened_at": "2026-05-21T14:25:00Z" }
  }'

curl -X POST https://api.zennopay.com/v1/payment_intents/0198f31a-7c2b-7d91-9fa2-112233445566/session \
  -H "X-Zennopay-Key-Id: acme_prod_2026q2" \
  -H "X-Zennopay-Timestamp: 2026-05-21T14:35:00Z" \
  -H "X-Zennopay-Nonce: b2c3d4e5f6789012345678abcdef00a1b2c3d4e5f6789012345678abcdef0011" \
  -H "X-Zennopay-Signature: <base64_hmac_sha256>" \
  -H "Content-Type: application/json" \
  -d '{
    "partner_user_id": "usr_8f3ka92m",
    "kyc_attestation": { "verified": true, "method": "your_kyc_v2", "verified_at": "2026-05-21T13:30:00Z", "id_type": "passport", "id_country": "IN" },
    "sanctions_attestation": { "clean": true, "screened_at": "2026-05-21T14:25:00Z" }
  }'

Response

{
  "session_token": "zpst_c4a7…",
  "session_expires_at": 1716306000
}

⌘I

Re-mint session token

curl --request POST \
  --url https://api.example.com/v1/payment_intents/{intent_id}/session \
  --header 'Content-Type: application/json' \
  --header 'X-Zennopay-Key-Id: <x-zennopay-key-id>' \
  --header 'X-Zennopay-Nonce: <x-zennopay-nonce>' \
  --header 'X-Zennopay-Signature: <x-zennopay-signature>' \
  --header 'X-Zennopay-Timestamp: <x-zennopay-timestamp>' \
  --data '
{
  "partner_user_id": "<string>",
  "kyc_attestation": {},
  "sanctions_attestation": {}
}
'

import requests

url = "https://api.example.com/v1/payment_intents/{intent_id}/session"

payload = {
    "partner_user_id": "<string>",
    "kyc_attestation": {},
    "sanctions_attestation": {}
}
headers = {
    "X-Zennopay-Key-Id": "<x-zennopay-key-id>",
    "X-Zennopay-Timestamp": "<x-zennopay-timestamp>",
    "X-Zennopay-Nonce": "<x-zennopay-nonce>",
    "X-Zennopay-Signature": "<x-zennopay-signature>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'X-Zennopay-Key-Id': '<x-zennopay-key-id>',
    'X-Zennopay-Timestamp': '<x-zennopay-timestamp>',
    'X-Zennopay-Nonce': '<x-zennopay-nonce>',
    'X-Zennopay-Signature': '<x-zennopay-signature>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({partner_user_id: '<string>', kyc_attestation: {}, sanctions_attestation: {}})
};

fetch('https://api.example.com/v1/payment_intents/{intent_id}/session', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/v1/payment_intents/{intent_id}/session",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'partner_user_id' => '<string>',
    'kyc_attestation' => [
        
    ],
    'sanctions_attestation' => [
        
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "X-Zennopay-Key-Id: <x-zennopay-key-id>",
    "X-Zennopay-Nonce: <x-zennopay-nonce>",
    "X-Zennopay-Signature: <x-zennopay-signature>",
    "X-Zennopay-Timestamp: <x-zennopay-timestamp>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/v1/payment_intents/{intent_id}/session"

	payload := strings.NewReader("{\n  \"partner_user_id\": \"<string>\",\n  \"kyc_attestation\": {},\n  \"sanctions_attestation\": {}\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-Zennopay-Key-Id", "<x-zennopay-key-id>")
	req.Header.Add("X-Zennopay-Timestamp", "<x-zennopay-timestamp>")
	req.Header.Add("X-Zennopay-Nonce", "<x-zennopay-nonce>")
	req.Header.Add("X-Zennopay-Signature", "<x-zennopay-signature>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.example.com/v1/payment_intents/{intent_id}/session")
  .header("X-Zennopay-Key-Id", "<x-zennopay-key-id>")
  .header("X-Zennopay-Timestamp", "<x-zennopay-timestamp>")
  .header("X-Zennopay-Nonce", "<x-zennopay-nonce>")
  .header("X-Zennopay-Signature", "<x-zennopay-signature>")
  .header("Content-Type", "application/json")
  .body("{\n  \"partner_user_id\": \"<string>\",\n  \"kyc_attestation\": {},\n  \"sanctions_attestation\": {}\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.example.com/v1/payment_intents/{intent_id}/session")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-Zennopay-Key-Id"] = '<x-zennopay-key-id>'
request["X-Zennopay-Timestamp"] = '<x-zennopay-timestamp>'
request["X-Zennopay-Nonce"] = '<x-zennopay-nonce>'
request["X-Zennopay-Signature"] = '<x-zennopay-signature>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"partner_user_id\": \"<string>\",\n  \"kyc_attestation\": {},\n  \"sanctions_attestation\": {}\n}"

response = http.request(request)
puts response.read_body

{
  "session_token": "<string>",
  "session_expires_at": 123
}

Get started

Guides

QR Payments

Platform Payouts

API reference

Resources

Re-mint session token

Headers

Path parameters

Body

Response

Example

​Headers

​Path parameters

​Body

​Response

​Example

Headers

Path parameters

Body

Response

Example