Developers

Three ways to accept payments — from a ready-made link with no code at all to a full API integration with webhooks.

01

Payment link

Created in the dashboard. Good for messengers, invoices and a QR code at the counter.

No code
02

Ready-made module

Integration with InSales and other platforms: the payment method appears right in the shop basket.

Set up in an hour
03

REST API

Create a payment from your server, use a ready payment page on our domain or a form right on your site, and get the result as a webhook signed with HMAC-SHA256.

Full control

What the integration looks like

Your server creates a payment and gets a link to send the buyer to. When the payment finishes, we call your webhook URL and sign the call. Keys are issued in the merchant cabinet, section “API and webhooks”.

Creating a paymentPOST /api/v2/payments
curl -X POST https://exezine.az/api/v2/payments \
  -H "Authorization: Bearer <API_KEY>" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: order-1024-try-1" \
  -d '{
    "amount": 4990,
    "currency": "AZN",
    "order_id": "1024",
    "description": "Order #1024",
    "customer": { "email": "client@example.com" },
    "return_url": "https://your-site.az/thanks"
  }'
Response201 Created
{
  "id": "EXZ-20260922-1FA5E8A416",
  "object": "payment",
  "status": "pending",
  "amount": 4990,
  "currency": "AZN",
  "order_id": "1024",
  "checkout_url": "https://exezine.az/checkout/EXZ-20260922-1FA5E8A416",
  "created_at": "2026-09-22T20:15:00+04:00"
}
Result notificationPOST /your-webhook
X-Exezine-Event: payment.succeeded
X-Exezine-Event-Id: evt_9f1c2b3a4d5e
X-Exezine-Signature: t=1758560100,v1=<HMAC-SHA256>

{
  "id": "evt_9f1c2b3a4d5e",
  "type": "payment.succeeded",
  "livemode": true,
  "data": { "object": {
    "id": "EXZ-20260922-1FA5E8A416",
    "status": "succeeded",
    "amount": 4990,
    "currency": "AZN",
    "order_id": "1024"
  } }
}
Verifying the webhook signaturePHP
$body = file_get_contents('php://input');
[$t, $v1] = sscanf($_SERVER['HTTP_X_EXEZINE_SIGNATURE'], 't=%d,v1=%s');
$ok = hash_equals(hash_hmac('sha256', $t . '.' . $body, $secret), $v1)
      && abs(time() - $t) < 300;   // the signature is valid for 5 minutes
Payment form on your siteHTML
<div id="pay"></div>
<script src="https://exezine.az/assets/js/exezine-checkout.js"></script>
<script>
  ExezineCheckout.mount('#pay', {
    url: payment.checkout_url,
    onSuccess: function (p) { location.href = '/thanks'; }
  });
</script>

The full specification is available as OpenAPI 3.1 — import it into Postman or Insomnia.

Full documentation

A reference for every endpoint: creating payments, statuses, refunds, payment links, webhooks with signature verification and the embedded form. You can send the link to your developer — no account is needed for it.

Open the documentation Interactive reference →

Integration security

  • The API key is sent in the Authorization header only — never in the page URL.
  • Every webhook is signed with HMAC-SHA256: verify the signature before changing an order status.
  • Treat a webhook as a possible duplicate: process it idempotently by order_id.
  • Card data never passes through your server — it is captured on the bank page.

Need the full specification or sandbox access? Write to support@exezine.az and we will send the documentation and test keys.