Malipo

Connect payments in four steps

Public API reference for mobile money. Create a charge, check status, and verify webhooks — nothing else.

Base URL

All API requests go to this host.

Base
https://lipa.justsmmpro.com

1. Authentication

Send your API key on every request. After login, copy it from Settings → Integration.

Header
X-API-Key: YOUR_API_KEY

2. Create payment

POST https://lipa.justsmmpro.com/api/v1/payments

JSON body
{
  "order_id": "ORD-1001",
  "amount": 5000,
  "currency": "TZS",
  "customer_phone": "0712345678",
  "customer_name": "John Doe",
  "callback_url": "https://yoursite.com/payment-callback"
}
  • Requiredorder_id, amount, customer_phone
  • Phone07XXXXXXXX or 255XXXXXXXXX
  • Callback — HTTPS on your registered website domain

Success returns a 10-character reference and optional payment_url. Status is always pending until the customer pays — poll status or use webhook; do not show failure immediately after initiate.

cURL
curl -X POST "https://lipa.justsmmpro.com/api/v1/payments" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: YOUR_API_KEY" \
  -d '{"order_id":"ORD-1001","amount":5000,"customer_phone":"0712345678"}'

3. Check status

GET https://lipa.justsmmpro.com/api/v1/payments/{reference}

cURL
curl "https://lipa.justsmmpro.com/api/v1/payments/K7M2P9X4Q1" \
  -H "X-API-Key: YOUR_API_KEY"

Statuses: pending, completed, failed. Mark an order paid only when Malipo returns completed.

4. Webhook

When a payment finishes, Malipo POSTs to your callback_url.

Payload
{
  "event": "payment.completed",
  "reference": "K7M2P9X4Q1",
  "order_id": "ORD-1001",
  "status": "completed",
  "amount": 5000,
  "currency": "TZS"
}

Security rules

01
Verify signature

Header X-Malipo-Signature = HMAC-SHA256 of the raw body using your API key.

02
Trust completed only

Fulfill orders only when status is completed.

03
Match the order

Check order_id, reference, and amount against your records.

04
Ignore the browser alone

Never mark paid from a customer redirect without webhook or status API.