📖 API Documentation
Complete REST API reference for PayAutoPay v5.0. All endpoints return JSON.
Introduction
Base URL: https://autopay.mnhost.top/api/router.php
All requests must use HTTPS. The API uses JWT Bearer tokens for authentication.
Authentication
Include your JWT token in the Authorization header:
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
For device endpoints, use the device token:
Authorization: Bearer {device_token}
# or
X-Device-Token: {device_token}
Error Codes
| Code | Meaning |
|---|---|
| 200 | Success |
| 201 | Created |
| 400 | Bad Request — missing or invalid parameters |
| 401 | Unauthorized — invalid or missing token |
| 403 | Forbidden — insufficient permissions |
| 404 | Not Found |
| 409 | Conflict — duplicate resource |
| 429 | Rate Limited — max 60 requests/minute |
| 503 | Service Unavailable |
Login
POST/auth/login
Authenticate and receive a JWT token.
Request Body
{
"email": "merchant@example.com",
"password": "yourpassword",
"type": "merchant" // "merchant" or "admin"
}
Response
{
"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"type": "merchant",
"merchant": {
"id": 1,
"name": "My Shop",
"email": "merchant@example.com"
}
}
Create Invoice
POST/v1/invoice/create
Create a new payment invoice. Requires merchant JWT.
Request Body
{
"amount": 500.00,
"method": "bkash", // bkash | nagad | rocket | upay | any
"expire_minutes": 30, // default: 30
"callback_url": "https://yoursite.com/callback",
"webhook_url": "https://yoursite.com/webhook"
}
Response (201)
{
"invoice_id": "INV_A1B2C3D4E5F6G7H8",
"amount": 500.00,
"currency": "BDT",
"method": "bkash",
"status": "pending",
"expires_at": "2026-08-01T11:00:00+06:00",
"payment_url": "https://autopay.mnhost.top/pay/INV_A1B2C3D4E5F6G7H8",
"qr_data": "https://autopay.mnhost.top/pay/INV_A1B2C3D4E5F6G7H8"
}
Invoice Status
GET/v1/invoice/status/{invoice_id}
Check the status of an invoice.
Response
{
"invoice_id": "INV_A1B2C3D4E5F6G7H8",
"amount": 500.00,
"status": "paid", // pending | paid | failed | expired | refunded
"expires_at": "2026-08-01T11:00:00+06:00",
"paid_at": "2026-08-01T10:32:15+06:00"
}
Register Device
POST/v1/device/register
Register an Android device. Requires merchant JWT.
Request Body
{
"device_name": "My Phone",
"device_model": "Samsung Galaxy A54",
"android_version": "13"
}
Response (201)
{
"device_id": 1,
"device_token": "a1b2c3d4e5f6...",
"status": "registered"
}
Upload Notification
POST/v1/device/notification
Upload a parsed payment notification. Requires device token.
Request Body
{
"amount": 500.00,
"txn_id": "TXN123456789",
"sender": "01712345678",
"method": "bkash",
"received_at": "2026-08-01T10:32:00+06:00",
"raw_text": "You have received BDT 500.00 from 01712345678..."
}
Response
{
"status": "matched",
"invoice_id": "INV_A1B2C3D4E5F6G7H8",
"message": "Payment verified and invoice marked as paid"
}
Webhook Events
Configure your webhook URL in the merchant dashboard. We'll POST these events:
| Event | Description |
|---|---|
| payment.success | Invoice paid successfully |
| payment.failed | Payment failed |
| payment.refunded | Payment refunded |
| invoice.expired | Invoice expired without payment |
| device.offline | Device went offline |
| device.online | Device came online |
Signature Verification
// PHP example
$signature = hash_hmac('sha256', $raw_body, $your_webhook_secret);
if (!hash_equals($signature, $_SERVER['HTTP_X_PAYAUTOPAY_SIGNATURE'])) {
// Invalid signature — reject
}