Guides
Getting started
Klustar Payment APIs let you collect payments (payins) and track them. Payouts are sent from the dashboard, not the API, and are not working on production at the moment: no payout gateway is configured. API pay-ins do not credit your dashboard wallet or appear in dashboard Transactions: agree how they are settled with Klustar before you go live. Every sensitive payment request is signed with HMAC-SHA256 using credentials from your merchant dashboard.
- 1
Create a merchant account
Sign up on the merchant portal and verify your email with the one-time code. Sandbox is available straight away. Live needs your business documents approved.
Create account → - 2
Generate API credentials
Open Profile & Settings → API Keys. Copy your API key, secret key, and App ID into environment variables — never hard-code secrets in apps or public docs. The same keys serve sandbox and live. Save your webhook URL here too, before your first pay-in.
Open API settings → - 3
Sign your first request
Follow the Authentication guide to build the canonical body, HMAC signature, and required headers, then call Create a payin with X-Tenant-ID: test.
Read authentication →
Popular endpoints
Base URLs
| Service | URL |
|---|---|
| Payment API | https://payment.klustar.io |
| Merchant portal API | https://merchant.klustar.io |
Glossary
- appId
- Unique identifier of your business profile, shown as App ID on Profile & Settings → API Keys.
- merchantId
- Alias of appId, sent as the X-Merchant-ID header.
- apiKey / secretKey
- Public/private credential pair, the same for test and live. The secret signs requests and must never appear in clients or public docs. Regenerating replaces both at once, for both environments.
- reference
- Your reference for one pay-in attempt, new every time. Echoed back in webhooks and status queries.
- gatewayReference
- The provider's reference when Klustar has one. Korapay pay-ins have none: null on status queries and empty in webhooks. Quote your own reference to support.
- tenant / environment
- test or live, chosen for each call by X-Tenant-ID. Webhooks report it in their environment field.
- notifyUrl
- A pay-in request field that does not set your webhook. Leave it out, and save your webhook URL in Profile & Settings → API Keys.
Need a Postman collection? Email support@klustar.io.