kuickpayDeveloper Portal

Kuickpay Checkout

Embed a hosted payment page into your e-commerce flow. Create a session with your order details, redirect the consumer to Kuickpay, and handle the return after payment.

Generated October 20, 2026 — see the live docs for the full interactive reference.

Sandbox Base URL

https://sandbox-api.kuickpay.com

Authentication: HTTP Basic — base64(CompanyID:SecuredKey) in the Authorization header.

1. Create Session

POST/api/session

Create Payment Session

Initiates a new checkout session for an order. Returns a redirectURL — send your user there immediately to complete payment on the Kuickpay hosted page.

Field	Type	Req	Description
companyid	string	Yes	Your Company ID provided by Kuickpay.
orderid	string	Yes	Unique order identifier from your system. Used for reconciliation.
amount	string	Yes	Order amount (e.g. "1250.00").
amountPayable	string	Yes	Total amount the user should pay. Usually equal to amount.
timestamp	string	Yes	ISO 8601 timestamp of the request (e.g. "2025-05-06T10:00:00Z").
transactiondescription	string	No	Brief description shown on the payment page. Optional — not included in the signature.
returnurl	string	No	URL to redirect the user after payment. Must be HTTPS. Optional — not included in the signature.
signature	string	Yes	HMAC-SHA256 signature computed from only the 5 fields above — see the Signature Guide below.

Response

{
  "responseData": {
    "responseCode": "00",
    "responseDescription": "Session started successfully",
    "status": "success",
    "checkoutToken": "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9...<truncated>",
    "companyID": "01234",
    "countryCode": "92",
    "defaultGateway": "APPSCARD",
    "sessionID": "cacaa5d8-f4d7-4ee9-8674-19673618492b",
    "redirectURL": "https://uatpayments.kuickpay.com/cardinfo/cacaa5d8-f4d7-4ee9-8674-19673618492b"
  }
}

2. Signature Guide

Every Create Session request must include an HMAC-SHA256 signature computed from your order fields. Kuickpay verifies this signature to confirm the request is authentic and untampered.

Concatenate the 5 required fields as strings in this exact order, separated by a pipe (|) character — no extra spaces.
Apply HMAC-SHA256 using your SecuredKey (from the Business Portal) as the key and the concatenated string as the message.
Hex-encode the result and include it as the signature field in the request body.

Field Order

Field	Type	Req	Description
companyid	string	No	Your Company ID.
orderid	string	No	Your unique order reference.
amount	string	No	Total order amount.
amountPayable	string	No	Amount the consumer will pay (same as amount or discounted).
timestamp	string	No	ISO 8601 timestamp of the request.

Concatenation result (before HMAC)

COMP001|ORDER-20250506-001|1250.00|1250.00|2025-05-06T10:00:00Z

Common mistakes: using the wrong field order, omitting the pipe separator or adding spaces around it, using a different encoding (e.g. base64 instead of hex), or including extra fields (such as transactiondescription or returnurl) in the concatenation — all produce an invalid signature.

3. Handle Return

After the consumer completes (or cancels) payment on Kuickpay's hosted page, they are redirected back to your returnurl with the transaction result in the query string.

Always verify the return signature before marking an order as paid. Query strings can be tampered with — the signature is the only trust anchor.

Field	Type	Req	Description
orderid	string	No	Your original order reference.
transactionid	string	No	Kuickpay's internal transaction ID.
amount	string	No	Amount paid.
status	string	No	SUCCESS, FAILED, or CANCELLED.
responsecode	string	No	00 = success. Other values indicate failure.
signature	string	No	HMAC-SHA256 signature from Kuickpay. Always verify this.

Example return URL

https://yoursite.com/payment/return?orderid=ORDER-001&transactionid=KP20250506001&amount=1250.00&status=SUCCESS&responsecode=00&signature=abc123...

Handling All Outcomes

Code	Meaning
SUCCESS	Payment successful. Verify signature, then fulfill the order.
FAILED	Payment failed. Show an error and allow retry — do not mark as paid.
CANCELLED	Consumer cancelled. Return them to cart — order is unchanged.

Best practices: verify the signature before reading any other parameter; use Kuickpay's transactionid as your primary reconciliation key, not your own orderid; make your return handler idempotent — the consumer may land on it multiple times; log the full return payload for every transaction, including failures.