Quick answers to the questions we hear most while merchants integrate the gateway. If yours isn’t here, see Support.
A hosted checkout that sits between your website or application and QRPay’s payment network. Your server creates a payment session over the API, redirects the customer to the hosted payment_url, and QRPay collects the payment and sends the customer back to your return_url with the result.
In your merchant panel, under Developer. Each key pair consists of a Client/Primary key (client_id) and a Secret key (secret_id). New keys always start in SANDBOX mode and can be switched to PRODUCTION from the same page.
No. Both use the same base URL — https://{your-qrpay-domain}/pay/api/v1. The environment is decided by the mode of the API key you authenticate with, not by the URL. A SANDBOX key never moves real money; switch the key to PRODUCTION in the merchant panel when you go live. See Environments & base URL.
600 seconds. The token response includes "expire_time": 600. Request a fresh token at the start of each checkout session rather than caching one — an expired or invalid token makes /payment/create respond with 403 · Requested with invalid token!
You sent amount as a number. The API requires it as a string rounded to 2 decimal places — "100.00", not 100. Anything else returns 400 · The amount must be a string.
Any currency enabled on your merchant account, passed as an upper-case ISO-4217 alpha-3 code (e.g. "USD"). Check your merchant panel to see which currencies are active for your account before hard-coding one.
Initiate payments and verify their outcome. Your server creates a payment session, redirects the customer to the hosted checkout, and verifies the result when QRPay redirects them back to your return_url with the payment token, trx_id and payer details.
Fees depend on your merchant account’s pricing plan, not on the API — there is no extra charge for using the developer API itself. Your current rates are shown in your merchant panel.
Start with Response codes and Error handling— most integration issues are identified by the response envelope. If you’re still stuck, contact the team via the channels on the Support page, including the full response envelope (never your secret key).