Gambia payment gateway API, integrate in minutes
One REST API to accept Visa, Mastercard, Afrimoney, QMoney, Wave, Yonna, APS, and Ecobank in The Gambia. Drop-in payment links, hosted payment pages, and signed webhooks.
Prerequisites
Merchant Account
You must have a Waychit merchant account in good standing to issue live keys.
API Key & Signing Secret
Generate your API key and Webhook Signing Secret from the Merchant Dashboard.
Process Flow
When a customer chooses "Pay with Waychit" on your platform:
Authentication
Authentication is done via API keys, tied to your merchant account. Every request must be sent over HTTPS and include the key in the Bearer header.
Authorization: Bearer waychit_sk_prod_VAdFkXwYPL0ApUvJY9eBJPY7kWYAK58yBgWeAUjStpJ6TDHHYxaEHtjWHHdqHdDHImportant: Your key should not be shared, used from client-side code, or stored anywhere but your own servers.
API Endpoints
/v1/payment-requestsCreate a payment request and redirect the customer to the waychitLaunchUrl payment page.
Save the returned paymentRequest.id so you can retrieve the payment status later.
curl --location 'https://api.waychit.com/v1/payment-requests' \
--header 'Authorization: Bearer {{api_key}}' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--data '{
"amount": 200,
"description": "benachin",
"clientReference": "4c8e2b9f5d7a1e3c6b0f8a2d9e4b7c1f",
"successRedirectUrl": "https://example.com/",
"failureRedirectUrl": "https://example.com/"
}'Try It Console
Run live calls against the Waychit API with your own key and inspect the exact response. Requests are proxied through our server so no browser CORS setup is needed, and your key is never stored.
POST https://api.waychit.com/v1/payment-requests
Use a test key. Your key is sent once with this request and is never stored or logged.
Webhooks
Webhooks notify your application when a payment status changes (e.g. from "active" to "closed"). Provide Waychit with a URL and you'll receive a signing secret for signature verification.
Signing Secret
The signing-secret strategy uses the webhook secret to sign the hashed body, including it in the Waychit-Signature header. This verifies both origin and integrity.
Sample Signature
Waychit-Signature:
t=1639082943,
v1=932112aedf9fa377844cf010785fe14ef8478c72af0b73d62ea3941335b526a8,
v1=f0312658e485a20af77bee4ecfec77a900ee14380f9f4894e5e11e33c465c32eStructure: t=timestamp,v1=signature1,v1=signature2
1. Parse Header
Split by comma to get elements. Split each element by = to get prefix and value.
2. Create Payload
Concatenate timestamp and request body using a dot (.) separator.
3. Compute HMAC
HMAC SHA256 of the payload using your webhook secret.
4. Verify
Match computed HMAC against header signatures. Check timestamp isn't older than 5 minutes.
Signature Verification Implementation
const crypto = require('crypto');
const validateWaychitSignature = (waychitSignature, rawBody, webhookSecret) => {
const parts = waychitSignature.split(',');
// Extract timestamp
const timestampPart = parts.find((part) => part.startsWith('t='));
if (!timestampPart) return false;
const timestamp = timestampPart.split('=')[1];
// Extract signatures
const signatures = parts
.filter((part) => part.startsWith('v1='))
.map((part) => part.split('=')[1]);
if (signatures.length === 0) return false;
// Create payload and calculate expected signature
const payload = `${timestamp}.${rawBody}`;
const expectedSignature = crypto
.createHmac('sha256', webhookSecret)
.update(payload)
.digest('hex');
// Verify signature match
return signatures.includes(expectedSignature);
};Note: Multiple signatures exist during secret rotation periods.
Webhook Payload Events
The events you can receive are payment.request.completed and payment.session.completed.
Retries
Waychit will retry webhook notifications for up to 24 hours if your server does not respond with an HTTP 2xx status code.
Note: Always respond with HTTP 2xx before processing business logic to prevent retries.
Note: Webhooks may be missing or duplicated. Make sure your system handles these scenarios.
Error Handling
Payment Request API errors
Minimum amount error Status: 400
{
"success": false,
"message": "Minimum amount to purchase is 5.",
"paymentRequest": null
}Internal server error Status: 500
{
"success": false,
"message": "Internal Server Error: The server encountered an unexpected condition that prevented it from fulfilling the request.",
"paymentRequest": null
}Payment Session API errors
Minimum amount error Status: 400
{
"success": false,
"message": "Minimum amount to purchase is 5.",
"paymentSession": null
}Maximum amount error Status: 400
{
"success": false,
"message": "Total sum of transactions should be less than or equal to D300,000.",
"paymentSession": null
}Developer FAQ
Changelog
2026-07-30
- The customerEmail and metadata parameters of the Payment Session request body are now optional.
- failureRedirectUrl added to the Payment Session request and response bodies.
- Added the retrieve endpoints for Payment Requests and Payment Sessions.
- Created the Payment Session API errors section.
2026-01-16
- Payment Session feature for merchants with non-Waychit customers wishing to pay with cards.
- Renamed the document from Waychit Payment Request API to Waychit Payment API.
2025-09-18
- Added note to keep API key secrets server-only to the authentication section.
2025-09-10
- Initial release of Payment Request API.
- Updated request signing logic: The timestamp and request body are now concatenated with a dot (.).
- Updated waychitLaunchUrl to now use dynamic paths instead of query parameters.
- Payment request URLs updated from /payment-requests to /v1/payment-requests.
- Added retries to the webhook section.