Developer ke taur par shuruaat

Mini App mein ek app banayein, uska API token ek baar copy karein, aur API call karna shuru karein. Poora setup More → Merchant API ke neeche hai.

Steps

1. More → Merchant API kholein.
2. App name daalein (misaal ke liye “My Store”) aur, agar chahein to, ek Webhook URL.
3. App banayein dabayein.
4. API token turant copy karein. Yeh sirf ek baar dikhta hai, dobara kabhi nahi — app uska sirf ek hash rakhta hai.
5. Apni pehli request bhejein, token TgPayCrypto-API-Token header mein rakh kar.

Aapki pehli call

Apne client ko API base https://app.tgpaycrypto.com/pay/api par point karein aur getMe call karke pakka karein ki token kaam kar raha hai. getBalance aapke app ke balances deta hai, getCurrencies wo assets jo aap use kar sakte hain.

Read methods GET hain. Jo methods paisa move karte hain — createInvoice, transfer, createCheck aur unke delete counterparts — wo jaan-boojh kar sirf POST hain: amounts aur idempotency keys ki jagah access logs mein nahi hai. Parameters JSON body, form-urlencoded, ya query params ki tarah bheje ja sakte hain.

App manage karna

Merchant API mein har app card uska app ID aur balance dikhata hai, aur aapko yeh karne deta hai:

• Webhook URL set ya change karein aur use save karein.
• Extra webhook events chunein — webhook URL set hote hi Extra webhook events ke toggles se aap invoice_paid ke alawa doosre event types opt-in kar sakte hain (dekhein webhooks reference).
• Restricted tokens banayein — Restricted tokens ke neeche extra API tokens, har ek sirf un scopes tak limited jo aap chunein (dekhein API reference).
• Token rotate karein — naya token issue hota hai aur purana turant invalid ho jaata hai. Agar koi token leak ho gaya ho to yeh use karein; naya token ek hi baar dikhta hai, waise hi jaise banate waqt.
• Delete — app authenticate karna band kar deta hai, lekin uska balance aur payment history bane rehte hain. App delete karne se uska paisa kabhi gayab nahi hota.

Webhooks

Agar aap webhook URL set karte hain, to app uspar ek signed JSON body POST karta hai:

{ "update_id": …, "update_type": "invoice_paid", "request_date": …, "payload": { … } }

Signature TgPayCrypto-API-Signature header mein hoti hai (Crypto-Pay-API-Signature compat alias ke saath): raw body par HMAC-SHA256, jiski key aapke API token ka SHA-256 hai. Payload mein kisi bhi cheez par bharosa karne se pehle ise verify karein.

Deliveries lambe waqt tak exponential backoff ke saath retry hoti hain, aur update_id har retry par wahi rehta hai — apni deduplication usi par karein aur apna handler idempotent rakhein.

invoice_paid hamesha deliver hota hai. Baaki event types — expire ho chuke invoices, claim ho chuke checks, refunds, subscription events — Extra webhook events toggles se opt-in hote hain. Poori list, payload shapes aur retry schedule webhooks reference mein hain.

⚠️ Token ko private key ki tarah sambhalein

Yeh aapke app balance se payouts authorize karta hai. Ise apne server par rakhein, kabhi kisi mobile app, front-end bundle ya commit ki gayi config mein nahi. Agar shak ho ki wo leak ho gaya hai, to rotate kar dein — rotation turant hota hai aur uska koi kharcha nahi. Aur har server ko sirf utna hi dein jitna use chahiye: payouts scope ke bina bana restricted token invoices bana sakta hai, lekin aapka balance kabhi bahar nahi le ja sakta.