Zennopay Docs — Cross-border QR payments, one SDK

Re-mint session token

curl --request POST \
  --url https://api.example.com/v1/payment_intents/{intent_id}/session \
  --header 'Content-Type: application/json' \
  --header 'X-Zennopay-Key-Id: <x-zennopay-key-id>' \
  --header 'X-Zennopay-Nonce: <x-zennopay-nonce>' \
  --header 'X-Zennopay-Signature: <x-zennopay-signature>' \
  --header 'X-Zennopay-Timestamp: <x-zennopay-timestamp>' \
  --data '
{
  "partner_user_id": "<string>",
  "kyc_attestation": {},
  "sanctions_attestation": {}
}
'

import requests

url = "https://api.example.com/v1/payment_intents/{intent_id}/session"

payload = {
    "partner_user_id": "<string>",
    "kyc_attestation": {},
    "sanctions_attestation": {}
}
headers = {
    "X-Zennopay-Key-Id": "<x-zennopay-key-id>",
    "X-Zennopay-Timestamp": "<x-zennopay-timestamp>",
    "X-Zennopay-Nonce": "<x-zennopay-nonce>",
    "X-Zennopay-Signature": "<x-zennopay-signature>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'X-Zennopay-Key-Id': '<x-zennopay-key-id>',
    'X-Zennopay-Timestamp': '<x-zennopay-timestamp>',
    'X-Zennopay-Nonce': '<x-zennopay-nonce>',
    'X-Zennopay-Signature': '<x-zennopay-signature>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({partner_user_id: '<string>', kyc_attestation: {}, sanctions_attestation: {}})
};

fetch('https://api.example.com/v1/payment_intents/{intent_id}/session', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/v1/payment_intents/{intent_id}/session",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'partner_user_id' => '<string>',
    'kyc_attestation' => [
        
    ],
    'sanctions_attestation' => [
        
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "X-Zennopay-Key-Id: <x-zennopay-key-id>",
    "X-Zennopay-Nonce: <x-zennopay-nonce>",
    "X-Zennopay-Signature: <x-zennopay-signature>",
    "X-Zennopay-Timestamp: <x-zennopay-timestamp>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/v1/payment_intents/{intent_id}/session"

	payload := strings.NewReader("{\n  \"partner_user_id\": \"<string>\",\n  \"kyc_attestation\": {},\n  \"sanctions_attestation\": {}\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-Zennopay-Key-Id", "<x-zennopay-key-id>")
	req.Header.Add("X-Zennopay-Timestamp", "<x-zennopay-timestamp>")
	req.Header.Add("X-Zennopay-Nonce", "<x-zennopay-nonce>")
	req.Header.Add("X-Zennopay-Signature", "<x-zennopay-signature>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.example.com/v1/payment_intents/{intent_id}/session")
  .header("X-Zennopay-Key-Id", "<x-zennopay-key-id>")
  .header("X-Zennopay-Timestamp", "<x-zennopay-timestamp>")
  .header("X-Zennopay-Nonce", "<x-zennopay-nonce>")
  .header("X-Zennopay-Signature", "<x-zennopay-signature>")
  .header("Content-Type", "application/json")
  .body("{\n  \"partner_user_id\": \"<string>\",\n  \"kyc_attestation\": {},\n  \"sanctions_attestation\": {}\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.example.com/v1/payment_intents/{intent_id}/session")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-Zennopay-Key-Id"] = '<x-zennopay-key-id>'
request["X-Zennopay-Timestamp"] = '<x-zennopay-timestamp>'
request["X-Zennopay-Nonce"] = '<x-zennopay-nonce>'
request["X-Zennopay-Signature"] = '<x-zennopay-signature>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"partner_user_id\": \"<string>\",\n  \"kyc_attestation\": {},\n  \"sanctions_attestation\": {}\n}"

response = http.request(request)
puts response.read_body

{
  "session_token": "<string>",
  "session_expires_at": 123
}

POST

payment_intents

{intent_id}

session

Re-mint session token

curl --request POST \
  --url https://api.example.com/v1/payment_intents/{intent_id}/session \
  --header 'Content-Type: application/json' \
  --header 'X-Zennopay-Key-Id: <x-zennopay-key-id>' \
  --header 'X-Zennopay-Nonce: <x-zennopay-nonce>' \
  --header 'X-Zennopay-Signature: <x-zennopay-signature>' \
  --header 'X-Zennopay-Timestamp: <x-zennopay-timestamp>' \
  --data '
{
  "partner_user_id": "<string>",
  "kyc_attestation": {},
  "sanctions_attestation": {}
}
'

import requests

url = "https://api.example.com/v1/payment_intents/{intent_id}/session"

payload = {
    "partner_user_id": "<string>",
    "kyc_attestation": {},
    "sanctions_attestation": {}
}
headers = {
    "X-Zennopay-Key-Id": "<x-zennopay-key-id>",
    "X-Zennopay-Timestamp": "<x-zennopay-timestamp>",
    "X-Zennopay-Nonce": "<x-zennopay-nonce>",
    "X-Zennopay-Signature": "<x-zennopay-signature>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'X-Zennopay-Key-Id': '<x-zennopay-key-id>',
    'X-Zennopay-Timestamp': '<x-zennopay-timestamp>',
    'X-Zennopay-Nonce': '<x-zennopay-nonce>',
    'X-Zennopay-Signature': '<x-zennopay-signature>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({partner_user_id: '<string>', kyc_attestation: {}, sanctions_attestation: {}})
};

fetch('https://api.example.com/v1/payment_intents/{intent_id}/session', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/v1/payment_intents/{intent_id}/session",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'partner_user_id' => '<string>',
    'kyc_attestation' => [
        
    ],
    'sanctions_attestation' => [
        
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "X-Zennopay-Key-Id: <x-zennopay-key-id>",
    "X-Zennopay-Nonce: <x-zennopay-nonce>",
    "X-Zennopay-Signature: <x-zennopay-signature>",
    "X-Zennopay-Timestamp: <x-zennopay-timestamp>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/v1/payment_intents/{intent_id}/session"

	payload := strings.NewReader("{\n  \"partner_user_id\": \"<string>\",\n  \"kyc_attestation\": {},\n  \"sanctions_attestation\": {}\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-Zennopay-Key-Id", "<x-zennopay-key-id>")
	req.Header.Add("X-Zennopay-Timestamp", "<x-zennopay-timestamp>")
	req.Header.Add("X-Zennopay-Nonce", "<x-zennopay-nonce>")
	req.Header.Add("X-Zennopay-Signature", "<x-zennopay-signature>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.example.com/v1/payment_intents/{intent_id}/session")
  .header("X-Zennopay-Key-Id", "<x-zennopay-key-id>")
  .header("X-Zennopay-Timestamp", "<x-zennopay-timestamp>")
  .header("X-Zennopay-Nonce", "<x-zennopay-nonce>")
  .header("X-Zennopay-Signature", "<x-zennopay-signature>")
  .header("Content-Type", "application/json")
  .body("{\n  \"partner_user_id\": \"<string>\",\n  \"kyc_attestation\": {},\n  \"sanctions_attestation\": {}\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.example.com/v1/payment_intents/{intent_id}/session")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-Zennopay-Key-Id"] = '<x-zennopay-key-id>'
request["X-Zennopay-Timestamp"] = '<x-zennopay-timestamp>'
request["X-Zennopay-Nonce"] = '<x-zennopay-nonce>'
request["X-Zennopay-Signature"] = '<x-zennopay-signature>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"partner_user_id\": \"<string>\",\n  \"kyc_attestation\": {},\n  \"sanctions_attestation\": {}\n}"

response = http.request(request)
puts response.read_body

{
  "session_token": "<string>",
  "session_expires_at": 123
}

When a session token expires mid-flow, don’t create a new intent — re-mint a token for the same one. Zennopay preserves the intent’s scan / quote / confirm state across the re-mint, so the user’s flow continues uninterrupted. This is exactly what your refreshSession hook calls your backend to do; your backend then makes this HMAC-signed call. See the refresh route in Build your session endpoint.

Headers

Server-to-server only; HMAC-signed. See Authentication.

string

required

Identifies which signing key was used.

string

required

ISO-8601 / RFC 3339 UTC timestamp. ±5 minute skew.

string

required

Random 32-byte hex string (64 chars). Replays within 10 minutes are rejected.

string

required

Base64 HMAC-SHA256 of the canonical request string over the JSON body below.

Path parameters

string

required

The intent to re-mint a session token for, e.g. zp_AbCd1234EfGh5678. The partner identified by the HMAC key must own it, and it must not be in a terminal state (captured, failed, expired, cancelled).

Body

The re-mint carries the same per-payment identity and compliance attestations as the original create call — Zennopay mints the fresh token from them.

string

required

Your opaque user identifier for the paying user. Must match the user the intent was created for.

object

required

Your per-payment KYC attestation, from your real verification system: { verified, method, verified_at, id_type, id_country }.

object

required

Your per-payment sanctions attestation: { clean, screened_at }.

Response

string

A fresh Zennopay-minted session token for the same intent. Return it to your app; the SDK swaps it in and retries the call that 401’d.

integer

Unix epoch seconds at which the new token stops verifying.

Example

Example uses the sandbox host. Swap to https://api.zennopay.com in production. The legacy api.zennopay.in hosts are still served for existing integrations. See Environments.

curl -X POST https://api.sandbox.zennopay.com/v1/payment_intents/zp_AbCd1234EfGh5678/session \
  -H "X-Zennopay-Key-Id: acme_sandbox_2026q2" \
  -H "X-Zennopay-Timestamp: 2026-05-21T14:35:00Z" \
  -H "X-Zennopay-Nonce: b2c3d4e5f6789012345678abcdef00a1b2c3d4e5f6789012345678abcdef0011" \
  -H "X-Zennopay-Signature: <base64_hmac_sha256>" \
  -H "Content-Type: application/json" \
  -d '{
    "partner_user_id": "usr_8f3ka92m",
    "kyc_attestation": { "verified": true, "method": "your_kyc_v2", "verified_at": "2026-05-21T13:30:00Z", "id_type": "passport", "id_country": "IN" },
    "sanctions_attestation": { "clean": true, "screened_at": "2026-05-21T14:25:00Z" }
  }'

curl -X POST https://api.zennopay.com/v1/payment_intents/zp_AbCd1234EfGh5678/session \
  -H "X-Zennopay-Key-Id: acme_prod_2026q2" \
  -H "X-Zennopay-Timestamp: 2026-05-21T14:35:00Z" \
  -H "X-Zennopay-Nonce: b2c3d4e5f6789012345678abcdef00a1b2c3d4e5f6789012345678abcdef0011" \
  -H "X-Zennopay-Signature: <base64_hmac_sha256>" \
  -H "Content-Type: application/json" \
  -d '{
    "partner_user_id": "usr_8f3ka92m",
    "kyc_attestation": { "verified": true, "method": "your_kyc_v2", "verified_at": "2026-05-21T13:30:00Z", "id_type": "passport", "id_country": "IN" },
    "sanctions_attestation": { "clean": true, "screened_at": "2026-05-21T14:25:00Z" }
  }'

Response

{
  "session_token": "zpst_c4a7…",
  "session_expires_at": 1716306000
}

Create payment intent

Get payment intent

⌘I

​Headers

​Path parameters

​Body

​Response

​Example

Headers

Path parameters

Body

Response

Example