Accept bKash, Nagad, Rocket and Upay in three steps: create a payment, redirect the buyer to the page we return, then verify. The money lands in your own account — it never passes through us.
Every request carries your key in the api-key header. Keep it on your server — never in browser or mobile app code, where anyone can read it. sk_test_ is sandbox; sk_live_ moves real money.
api-key: sk_test_asolpay_demo
Base URL https://api.asolpay.com · all amounts are in Taka.
POST /v1/payment/create — amounts are in Taka. Returns a payment_url.
curl -X POST https://api.asolpay.com/v1/payment/create \
-H "Content-Type: application/json" \
-H "api-key: sk_test_asolpay_demo" \
-d '{
"amount": 1200,
"tran_id": "ORD-1001",
"cus_name": "Omor",
"cus_email": "Omor@example.com",
"product_name": "Order #1001",
"success_url": "https://yoursite.com/payment/success",
"cancel_url": "https://yoursite.com/payment/cancel",
"webhook_url": "https://yoursite.com/api/asolpay/webhook"
}'Response:
{
"status": true,
"message": "Invoice created successfully.",
"payment_url": "https://pay.asolpay.com/inv_XXXXXXXXXXXX",
"invoice_id": "inv_XXXXXXXXXXXX",
"tran_id": "ORD-1001",
"amount": "1200.00"
}Send the customer to payment_url. They pick bKash / Nagad / Rocket / Upay and pay on pay.asolpay.com, then land back on your success_url (or cancel_url).
Always verify server-side. Never treat the redirect back to your site as proof of payment — anyone can open that URL.
curl -X POST https://api.asolpay.com/v1/payment/verify \
-H "Content-Type: application/json" \
-H "api-key: sk_test_asolpay_demo" \
-d '{ "invoice_id": "inv_XXXXXXXXXXXX" }'Response:
{
"status": true,
"cus_name": "Omor",
"cus_email": "Omor@example.com",
"amount": "1200.00",
"invoice_id": "inv_XXXXXXXXXXXX",
"payment_method": "bkash",
"tran_id": "ORD-1001"
}If you passed a webhook_url, we POST to it the moment the payment is confirmed. Treat it as a nudge to verify — not as proof on its own.
{
"invoice_id": "inv_XXXXXXXXXXXX",
"tran_id": "ORD-1001",
"status": "true"
}