Developer API Manage API keys →

Developer API

Integrate ZarixPay APIs to power VTU, SMM, and SMS activation flows from your platform.

API secrets
API secrets are shown only once when generated. Copy and store them securely. Login to generate keys.

Authentication (HMAC)

Every request must be signed with your API secret and include these headers:

  • X-Api-Key (public key)
  • X-Timestamp (unix seconds)
  • X-Nonce (random 8–64 chars)
  • X-Signature (HMAC-SHA256 hex signature)

Canonical string

Canonical
{METHOD}
{PATH_WITH_QUERY}
{TIMESTAMP}
{NONCE}
{SHA256_HEX_OF_BODY}

Query parameters are sorted (recursively) and RFC3986-encoded before signing.

Idempotency

For all create-order endpoints, send Idempotency-Key. Retrying with the same key and the same body returns the original response.

Wallet

GET
/api/v1/wallet
Developer wallet balance.
GET
/api/v1/transactions
Developer transaction history (cursor pagination).

VTU

GET
/api/v1/vtu/operators?country_code=NG
List operators for a country.
POST
/api/v1/vtu/quote
Get charge amount (markup included).
POST
/api/v1/vtu/orders
Create VTU order (requires Idempotency-Key).
GET
/api/v1/vtu/orders/{id}
Fetch order status and provider response.

SMM

GET
/api/v1/smm/services
List provider services (cached on provider timeouts).
POST
/api/v1/smm/quote
Compute charge for a service/quantity.
POST
/api/v1/smm/orders
Create SMM order (requires Idempotency-Key).
POST
/api/v1/smm/orders/{id}/refresh
Refresh order status from provider.

SMS (Activations)

/sms/* is an alias of /virtual-numbers/* (Tiger SMS provider).

GET
/api/v1/sms/catalog
Supported services and country list.
GET
/api/v1/sms/provider/balance
Provider balance (for monitoring).
POST
/api/v1/sms/orders
Buy a number activation (requires Idempotency-Key).
POST
/api/v1/sms/orders/{id}/refresh
Fetch OTP/SMS code when available.

Errors

Errors are returned as JSON using this envelope:

Error example
{
  "ok": false,
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Missing required auth headers."
  }
}

Example: signing in PHP

PHP
<?php
$method = 'GET';
$pathWithQuery = '/api/v1/wallet';
$timestamp = time();
$nonce = bin2hex(random_bytes(16));
$body = '';
$bodyHash = hash('sha256', $body);
$canonical = implode(\"\\n\", [$method, $pathWithQuery, $timestamp, $nonce, $bodyHash]);
$signature = hash_hmac('sha256', $canonical, $apiSecret);

// Headers:
// X-Api-Key: $apiKey
// X-Timestamp: $timestamp
// X-Nonce: $nonce
// X-Signature: $signature