API Documentation - SecurePay BD

Getting started

Introduction

SecurePay BD is a simple and secure payment automation tool that acts as a payment gateway, letting you accept payments from your customers through your website. This guide explains how SecurePay BD works and how to integrate its API.

Merchants receive funds by temporarily redirecting customers to a hosted SecurePay BD checkout, which connects multiple payment terminals — card systems, mobile financial services, and local or international wallets. After payment, the customer is returned to your site and you receive a callback with the full transaction details.

Intended for technical personnel supporting an online merchant's website. Working knowledge of cURL, HTML forms or your platform's HTTP client is required.

API reference

Overview

SecurePay BD exposes a small, focused REST API over a single base URL. Two operations cover the whole payment lifecycle: create a payment to obtain a checkout link, then verify a transaction before fulfilling the order. All requests are authenticated with your API key and exchange JSON.

Create payment

Initialize a payment and get the hosted checkout URL to redirect the customer to.

Verify payment

Confirm a transaction's final state before releasing goods or services.

Security first. Every request is checked for a valid API key. Amounts are limited to 1,000,000, and callback URLs must be valid HTTP(S) addresses.

API reference

Endpoints

All requests are keyed with your API key (via the API-KEY header or an api_key JSON field) and exchange JSON.

Create payment

Initializes a payment and returns a checkout link.

POST https://pay.securepaybd.xyz/api/create

Verify payment

Confirms the state of a transaction.

POST https://pay.securepaybd.xyz/api/verify

Both endpoints also accept GET. While integrating, use a low value such as 10 and switch to real amounts once your checkout is verified end to end.

API reference

Request parameters

Variables POSTed to the gateway to initialize a payment.

Field	Description	Required	Example
`amount`	Total amount payable. Must be numeric and ≤ 1,000,000.	Required	`10`, `10.50`
`success_url`	Customer return URL on success. Must be a valid HTTP(S) URL.	Required	`https://yoursite.com/success`
`cancel_url`	Customer return URL on failure/cancel. Must be a valid HTTP(S) URL.	Required	`https://yoursite.com/cancel`
`cus_name`	Customer full name.	Optional	`John Doe`
`cus_email`	Customer email.	Optional	`john@gmail.com`
`cus_phone`	Customer phone.	Optional	`01612345678`
`currency`	Three-letter currency code. Defaults to `BDT`.	Optional	`BDT`
`metadata`	Optional JSON object returned on verification. Must be a JSON object.	Optional	`{"order_id":123}`
`webhook_url`	Server-to-server callback URL, POSTed on confirmed payment. Must be a valid HTTP(S) URL.	Optional	`https://yoursite.com/webhook`
`return_type`	Redirect method for callback URLs. Defaults to `GET`.	Optional	`GET`

Verify parameters

Field	Description	Required	Example
`transaction_id`	Transaction id received as a query parameter from your success URL.	Required	`OVKPXW165414`

API reference

Authentication

Authenticate every request with your API key. You can send it either as an API-KEY header or as an api_key field in the JSON body — both work the same way. Only this single key is required; there is no separate secret or brand key.

Header	Value
`Content-Type`	`application/json`
`API-KEY`	Your API key from the dashboard (Websites → API Key)

Generate your API key by creating a Website from your merchant dashboard at Websites / Brands → API Key.

Integration

How it works

The flow is identical for every platform and only requires a server able to send an HTTP POST request.

Step	Action	Where
`1`	Create a Website from your dashboard — this generates your API key.	SecurePay BD dashboard → My Websites
`2`	POST the order data to Create Payment and receive the checkout URL.	Your server
`3`	Redirect the customer to the returned `payment_url`.	Your checkout
`4`	Confirm the payment server-side with Verify API, then fulfill.	Your success page

Never trust the browser alone. The customer returns to your success_url with query parameters, but you must always confirm the final state with the Verify API before delivering goods or services.

Integration

Create payment

Send a JSON payload to the Create endpoint with your credentials. On success you receive a payment_url to redirect the customer to.

bash

curl -X POST https://pay.securepaybd.xyz/api/create \
  -H "Content-Type: application/json" \
  -H "API-KEY: YOUR_API_KEY" \
  -d '{
    "amount": "10",
    "currency": "BDT",
    "success_url": "https://yourdomain.com/success",
    "cancel_url": "https://yourdomain.com/cancel",
    "cus_name": "John Doe",
    "cus_email": "john@gmail.com",
    "cus_phone": "01612345678",
    "metadata": {"phone": "016****"},
    "webhook_url": "https://yourdomain.com/webhook"
  }'

php

<?php
$curl = curl_init();
curl_setopt_array($curl, array(
  CURLOPT_URL => 'https://pay.securepaybd.xyz/api/create',
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_CUSTOMREQUEST => 'POST',
  CURLOPT_POSTFIELDS => json_encode([
    "amount" => "10",
    "currency" => "BDT",
    "success_url" => "https://yourdomain.com/success",
    "cancel_url" => "https://yourdomain.com/cancel",
    "cus_name" => "John Doe",
    "cus_email" => "john@gmail.com",
    "cus_phone" => "01612345678",
    "metadata" => ["phone" => "016****"],
    "webhook_url" => "https://yourdomain.com/webhook",
  ]),
  CURLOPT_HTTPHEADER => array('API-KEY: YOUR_API_KEY','Content-Type: application/json'),
));
$response = curl_exec($curl);
curl_close($curl);
echo $response;
?>

laravel

use Illuminate\Support\Facades\Http;

$response = Http::withHeaders([
    'API-KEY' => 'YOUR_API_KEY',
    'Content-Type' => 'application/json',
])->post('https://pay.securepaybd.xyz/api/create', [
    'amount'      => '10',
    'currency'    => 'BDT',
    'success_url' => 'https://yourdomain.com/success',
    'cancel_url'  => 'https://yourdomain.com/cancel',
    'cus_name'    => 'John Doe',
    'cus_email'   => 'john@gmail.com',
    'cus_phone'   => '01612345678',
    'metadata'    => ['phone' => '016****'],
    'webhook_url' => 'https://yourdomain.com/webhook',
]);

$payment = $response->json();

if (isset($payment['payment_url'])) {
    return redirect()->away($payment['payment_url']);
}

javascript

const res = await fetch('https://pay.securepaybd.xyz/api/create', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'API-KEY': 'YOUR_API_KEY',
  },
  body: JSON.stringify({
    amount: "10",
    currency: "BDT",
    success_url: "https://yourdomain.com/success",
    cancel_url: "https://yourdomain.com/cancel",
    cus_name: "John Doe",
    cus_email: "john@gmail.com",
    cus_phone: "01612345678",
    metadata: { phone: "016****" },
    webhook_url: "https://yourdomain.com/webhook"
  }),
});

const data = await res.json();
console.log(data);

node

const axios = require('axios');

let data = JSON.stringify({
  amount: "10", currency: "BDT",
  success_url: "https://yourdomain.com/success",
  cancel_url: "https://yourdomain.com/cancel",
  cus_name: "John Doe", cus_email: "john@gmail.com",
  cus_phone: "01612345678",
  metadata: { phone: "016****" },
  webhook_url: "https://yourdomain.com/webhook"
});

let config = {
  method: 'post',
  url: 'https://pay.securepaybd.xyz/api/create',
  headers: { 'API-KEY': 'YOUR_API_KEY', 'Content-Type': 'application/json' },
  data: data
};

axios.request(config)
  .then((res) => console.log(res.data))
  .catch((err) => console.log(err));

python

import requests
import json

url = "https://pay.securepaybd.xyz/api/create"
payload = json.dumps({
  "amount": "10", "currency": "BDT",
  "success_url": "https://yourdomain.com/success",
  "cancel_url": "https://yourdomain.com/cancel",
  "cus_name": "John Doe", "cus_email": "john@gmail.com",
  "cus_phone": "01612345678",
  "metadata": {"phone": "016****"},
  "webhook_url": "https://yourdomain.com/webhook"
})
headers = { 'API-KEY': 'YOUR_API_KEY', 'Content-Type': 'application/json' }
response = requests.post(url, headers=headers, data=payload)
print(response.text)

Response

json

{
  "status": 1,
  "message": "Payment Link",
  "payment_url": "https://pay.securepaybd.xyz/api/execute/ab12cd34..."
}

Field	Type	Description
Success
`status`	int	1 — payment created
`message`	String	`"Payment Link"`
`payment_url`	String	Checkout link, e.g. `https://pay.securepaybd.xyz/api/execute/{id}`
Error
`status`	int	0
`message`	String	Reason the request was rejected

After payment the customer is redirected to your success or cancel page with: ?transactionId=****&paymentMethod=***&paymentAmount=**&paymentFee=**&status=completed|pending|failed. Always confirm with the Verify API — never trust the redirect alone.

Integration

Verify payment

Call the Verify API from your server with the transaction_id received on your success URL. Only trust a transaction once it returns COMPLETED.

bash

curl -X POST https://pay.securepaybd.xyz/api/verify \
  -H "Content-Type: application/json" \
  -H "API-KEY: YOUR_API_KEY" \
  -d '{"transaction_id":"OVKPXW165414"}'

php

<?php
$curl = curl_init();
curl_setopt_array($curl, array(
  CURLOPT_URL => 'https://pay.securepaybd.xyz/api/verify',
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_CUSTOMREQUEST => 'POST',
  CURLOPT_POSTFIELDS => '{"transaction_id":"OVKPXW165414"}',
  CURLOPT_HTTPHEADER => array('API-KEY: YOUR_API_KEY','Content-Type: application/json'),
));
$response = curl_exec($curl);
curl_close($curl);
echo $response;
?>

laravel

use Illuminate\Support\Facades\Http;

$response = Http::withHeaders([
    'API-KEY' => 'YOUR_API_KEY',
])->post('https://pay.securepaybd.xyz/api/verify', [
    'transaction_id' => request('transactionId'),
]);

$payment = $response->json();

if (($payment['status'] ?? '') === 'COMPLETED') {
    // fulfill the order
}

javascript

const res = await fetch('https://pay.securepaybd.xyz/api/verify', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'API-KEY': 'YOUR_API_KEY',
  },
  body: JSON.stringify({ transaction_id: "OVKPXW165414" }),
});

const data = await res.json();
console.log(data);

node

const axios = require('axios');

let data = JSON.stringify({ transaction_id: "OVKPXW165414" });

let config = {
  method: 'post',
  url: 'https://pay.securepaybd.xyz/api/verify',
  headers: { 'API-KEY': 'YOUR_API_KEY', 'Content-Type': 'application/json' },
  data: data
};

axios.request(config)
  .then((res) => console.log(res.data))
  .catch((err) => console.log(err));

python

import requests
import json

url = "https://pay.securepaybd.xyz/api/verify"
payload = json.dumps({"transaction_id": "OVKPXW165414"})
headers = { 'API-KEY': 'YOUR_API_KEY', 'Content-Type': 'application/json' }
response = requests.post(url, headers=headers, data=payload)
print(response.text)

Sample response

json

{
  "status": "COMPLETED",
  "cus_name": "John Doe",
  "cus_email": "john@gmail.com",
  "amount": "900.000",
  "transaction_id": "OVKPXW165414",
  "metadata": {"phone": "015****"},
  "payment_method": "bkash"
}

Field	Type	Description
`status`	String	`COMPLETED` or `PENDING`. A failed/unknown transaction returns `{"status":0,"message":"failed"}`.
`cus_name`	String	Customer name
`cus_email`	String	Customer email
`amount`	String	Paid amount
`transaction_id`	String	Transaction id generated by the system
`metadata`	JSON	Metadata used during payment creation
`payment_method`	String	Method used by the customer (e.g. `bkash`)

Integration

Webhooks

If you supply a webhook_url when creating a payment, SecurePay BD sends a server-to-server POST automatically once the payment is confirmed (completed payments only). Because it comes straight from our server, the webhook is the most reliable way to be notified of a successful payment.

Payload

json

{
  "paymentMethod": "bkash",
  "transactionId": "OVKPXW165414",
  "paymentAmount": "900.000",
  "paymentFee": "10",
  "status": "completed"
}

Field	Description
`paymentMethod`	Gateway used by the customer (e.g. `bkash`)
`transactionId`	Transaction id generated by the system
`paymentAmount`	Paid amount (excluding fees)
`paymentFee`	Fee charged on the transaction
`status`	`completed`, `pending` or `failed`

Your webhook endpoint should respond with a 2xx status. The gateway sends the webhook only after a payment is confirmed and does not retry failed deliveries.

Downloads

Plugins & Apps

Ready-made modules let you start accepting payments in minutes — no API coding required. Install, enter your API key and go live.

WordPress PluginWordPress 5.8+ · WooCommerce ready Download

WHMCS ModuleWHMCS 8.x · Server provisioning Download

SMM Panel ModuleAuto top-up & balance verification Download

Laravel SDKLaravel 8–12 · composer package Download

Node.js SDKNode 18+ · zero dependencies Download

Python SDKPython 3.8+ · stdlib only Download

Mobile AppAndroid APK · live transaction alerts Download

Always download from this page. Every module is built and tested against the current SecurePay BD API — install it, enter your API key and go live. The cURL / PHP / Laravel / JavaScript / Node.js / Python samples above cover custom integrations.