Signed webhooks
Every event signed with HMAC-SHA256 and a timestamp — verify it, no polling.
The same regulated rail behind wallets, cards, payments and payouts, exposed as a REST API — with one error model, one idempotency contract and signed webhooks. Build against a sandbox, follow the documentation, ship.
curl https://binkpay.net/api/v1/developer/ping \
-H "Authorization: Bearer sk_test_51H..."{
"ok": true,
"companyId": "co_4b7e21",
"livemode": false,
"scopes": ["analytics:read", "payments:read"]
}The developer probe — the one endpoint that accepts an API key today. Display and copy only; no live request is sent.
The reference, the tooling and the operational surfaces — each one a real route in the portal.
REST resources and the request/response contract.
Typed clients for the API.
Test keys and simulated events, isolated from production.
Signed event delivery, retries and replay.
Guides, quickstarts and integration patterns.
Live system health.
Release notes and breaking changes.
/api/v1Create sandbox keys to build against, with no production data at risk.
Send your key as a Bearer token. Every response carries a requestId.
Call the developer probe to confirm the key and see your environment.
Verify the signature on each webhook and react — no polling required.
Promote from test to live when your integration is ready.
REST over HTTPS, JSON in and out, one prefix. Every resource shares the same request shape, the same error envelope and the same idempotency contract — learn it once.
BINK authorises by session + API key. An sk_ key works on the developer probe today; the resource endpoints authorise by your dashboard session. Send the key as a Bearer token — full detail in Authentication.
Create, list, retrieve and cancel payments.
ReferenceAvailable balance and off-cycle payouts.
ReferenceIssue and list refunds against paid payments.
ReferenceIssue, list, fund, freeze and control cards.
ReferenceRecords derived from payment activity.
ReferenceLine-itemized bills for out-of-band payment.
ReferenceSigned event delivery and the event catalog.
ReferenceThe shared error envelope and status codes.
ReferenceRequest limits, Idempotency-Key and 429s.
ReferenceNot promises — the contract. These are engineering behaviours the API documents, so an integration behaves the same on the day you ship and every day after.
Every event signed with HMAC-SHA256 and a timestamp — verify it, no polling.
Pass Idempotency-Key on POST /merchant/payments to make retries safe.
Every response — success or error — carries a requestId to reference in support.
{ ok, statusCode, message } across validation, auth and server faults alike.
A 600 req/min default per-user ceiling, tighter on sensitive endpoints.
Session + API key. An sk_ key works on the developer probe today.
Read the reference, test against a sandbox, and put the same regulated rail under your own product.