Documentation API IberionPay

Authorization: Bearer sk_live_xxxxxxxxxxxxxxxxxxxx
Content-Type: application/json

curl -X POST https://iberionpay.com/api/public/v1/charges \
  -H "Authorization: Bearer sk_live_..." \
  -H "Idempotency-Key: CMD-1024" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 10000,
    "customerPhone": "6XXXXXXXX",
    "customerOperator": "MTN_MOMO_CMR",
    "customerName": "Jean Mbarga",
    "metadata": { "orderId": "1024" }
  }'

{
  "data": {
    "id": "6f0d6e2c-6a1e-4f3f-9d0b-2c9a1f7b1234",
    "reference": "IBP-7K3M9Q",
    "status": "collecting",
    "amount": 10000,
    "fee": 450,
    "net": 9550
  }
}

curl https://iberionpay.com/api/public/v1/charges/IBP-7K3M9Q \
  -H "Authorization: Bearer sk_live_..."

{
  "data": {
    "currency": "XAF",
    "settled": 1250000,   // net déjà reversé
    "pending": 35000,     // encaissements en cours
    "fees": 56250,        // frais prélevés
    "count": 143          // nombre de transactions terminées
  }
}

x-iberionpay-timestamp: 1735689600
x-iberionpay-signature: sha256=<hmac>
x-iberionpay-delivery: <identifiant de livraison>

import crypto from "crypto";

app.post("/iberionpay/callback", express.raw({ type: "*/*" }), (req, res) => {
  const timestamp = req.header("x-iberionpay-timestamp") || "";
  const received = (req.header("x-iberionpay-signature") || "").replace("sha256=", "");
  const raw = req.body.toString("utf8");

  const expected = crypto
    .createHmac("sha256", process.env.IBERIONPAY_WEBHOOK_SECRET)
    .update(timestamp + "." + raw)
    .digest("hex");

  const a = Buffer.from(received);
  const b = Buffer.from(expected);
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
    return res.status(401).send("invalid signature");
  }
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) {
    return res.status(401).send("stale timestamp");
  }

  const { event, data } = JSON.parse(raw);
  if (event === "charge.completed") {
    // marquez la commande data.metadata.orderId comme payée (idempotent)
  }
  res.sendStatus(200);   // répondez 2xx sous 10 s
});

{
  "event": "charge.completed",
  "createdAt": "2026-08-25T18:20:31.000Z",
  "data": {
    "id": "6f0d6e2c-6a1e-4f3f-9d0b-2c9a1f7b1234",
    "reference": "IBP-7K3M9Q",
    "status": "completed",
    "amount": 10000,
    "fee": 450,
    "net": 9550,
    "currency": "XAF",
    "customerPhone": "2376XXXXXXXX",
    "customerOperator": "MTN_MOMO_CMR",
    "customerName": "Jean Mbarga",
    "source": "api",
    "metadata": { "orderId": "1024" },
    "createdAt": "2026-08-25T18:19:58.000Z"
  }
}

const res = await fetch("https://iberionpay.com/api/public/v1/charges", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.IBERIONPAY_SECRET_KEY}`,
    "Idempotency-Key": order.id,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    amount: order.total,
    customerPhone: order.phone,
    customerOperator: order.operator,   // "MTN_MOMO_CMR" | "ORANGE_CMR"
    metadata: { orderId: order.id },
  }),
});
const { data, error } = await res.json();
if (!res.ok) throw new Error(error);
// data.reference : affichez-la au client, attendez le callback

$response = Http::withToken(env('IBERIONPAY_SECRET_KEY'))
    ->withHeaders(['Idempotency-Key' => $order->id])
    ->post('https://iberionpay.com/api/public/v1/charges', [
        'amount' => $order->total,
        'customerPhone' => $order->phone,
        'customerOperator' => $order->operator,
        'metadata' => ['orderId' => $order->id],
    ]);

if ($response->failed()) {
    report($response->json('error'));
}
$charge = $response->json('data');

import os, requests

r = requests.post(
    "https://iberionpay.com/api/public/v1/charges",
    headers={
        "Authorization": f"Bearer {os.environ['IBERIONPAY_SECRET_KEY']}",
        "Idempotency-Key": str(order_id),
    },
    json={
        "amount": total,
        "customerPhone": phone,
        "customerOperator": operator,
        "metadata": {"orderId": str(order_id)},
    },
    timeout=30,
)
r.raise_for_status()
charge = r.json()["data"]

$timestamp = $request->header('x-iberionpay-timestamp');
$received = str_replace('sha256=', '', $request->header('x-iberionpay-signature'));
$expected = hash_hmac('sha256', $timestamp . '.' . $request->getContent(), env('IBERIONPAY_WEBHOOK_SECRET'));

if (!hash_equals($expected, $received)) {
    abort(401);
}