Developer platform

Build on a clean JSON API.

The platform exposes a JSON HTTP API at /api/v1 with bearer-token auth, an OpenAPI contract, and HMAC-signed webhooks with timestamped, replay-safe signatures. Create and list payment links and read your payments programmatically; the API surface is growing.

Clean JSON API

A JSON HTTP API at /api/v1. Authenticate with bearer API tokens — issued through our early-access program while dashboard self-serve key management rolls out. The contract is defined in OpenAPI; typed clients are available on request.

Signed webhooks

Outbound events are signed with HMAC-SHA256 using a per-endpoint secret. Replay protection is enforced via a signed timestamp and a per-delivery nonce, both authenticated inside the signature; failed deliveries retry with exponential backoff, capped at 24 hours between attempts.

Versioned & idempotent

Every delivery carries Zoyn-Event-Id, Zoyn-Event-Type, and a pinned Zoyn-API-Version header, so you can de-duplicate events and upgrade on your own schedule.

Observable

A public health endpoint at /healthz reports liveness. Dashboard management of endpoints, secrets, and per-event delivery logs is rolling out with the developer program.

Verify every webhook before trusting it

The Zoyn-Signature header is t=<unix>,d=<delivery_id>,v1=<hmac>. Recompute the HMAC-SHA256 over `${t}.${d}.${rawBody}` with your endpoint secret and compare in constant time. The d= field is a per-delivery replay nonce, authenticated inside the signature — track recently seen values to reject replayed payloads — and reject any delivery whose timestamp is more than 5 minutes from your clock.

import crypto from "node:crypto";

// Zoyn-Signature: "t=<unix>,d=<delivery_id>,v1=<hex hmac-sha256>"
export function verifyZoynWebhook(rawBody, header, secret) {
  const parts = Object.fromEntries(
    header.split(",").map((kv) => kv.split("=")),
  );
  // Replay window: reject timestamps older than 5 minutes.
  const ageSec = Math.abs(Date.now() / 1000 - Number(parts.t));
  if (!parts.t || !parts.d || !parts.v1 || ageSec > 300) return false;
  const expected = crypto
    .createHmac("sha256", secret)          // secret = whsec_...
    .update(`${parts.t}.${parts.d}.${rawBody}`)
    .digest("hex");
  const a = Buffer.from(parts.v1, "hex");
  const b = Buffer.from(expected, "hex");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

Request early access Download the OpenAPI spec

Developer pages in the dashboard — API keys, webhooks, and the reference — are rolling out to merchant workspaces in stages. If yours still shows a coming-soon screen there, contact us for early access.