API reference
Every live API request uses the same base URL. Authentication depends on whether the caller is your server, an Android terminal, or the browser.
Base URLs
All live endpoints use https://api.kepapay.co. There is no local terminal HTTP server. Pages marked planned are designs, not callable APIs.
https://api.kepapay.coUses its provisioned device token for in-person payments.
https://api.kepapay.coUses a secret API key for online payments and account operations.
https://api.kepapay.coUses a publishable key and a short-lived checkout client secret.
Authentication
Three credentials, picked by where the code runs. Server-side calls send a secret X-Api-Key; browser calls send a publishable X-Kepa-Publishable-Key; cloud terminal sessions use a bearer JWT. The full rules are on the Authentication page.
Conventions
Send an Idempotency-Key on writes; a repeat returns the original result instead of acting twice.
HTTP status tells you whether the request worked. Payment fields tell you whether the card was approved or declined.
Always minor units — 2500 is $25.00 — paired with an ISO 4217 currency code.
The version is dated. Breaking changes ship under a new date; the changelog tracks them.