Payments API
Global conventions
- JSON request/response; send
Content-Type: application/jsonfor JSON bodies. currency: ISO 4217 (GHS,NGN, ...).mobile: digits only, country code first, no+and no spaces (example:233544338841).amount: non-negative string decimal; up to 4 dp internally, displayed/settled at 2 dp (ceil).merchant_reference: merchant-generated reference; echoed in responses and webhooks.Authorization: Bearer <access_token>on every protected endpoint.Idempotency-Key: required on POST endpoints that move money or create sessions/mandates, and on mandate cancellation (state-changing).- Public IDs — uppercase prefixes such as
CL_,CS_,PO_,MD_(lookups are case-insensitive). request_id(errors) —REQ_+ 12 uppercase alphanumeric characters (example:REQ_8F3A2C1B9D0E).- Webhook event
id—EVT_+ 24 uppercase alphanumeric characters. - Flat request bodies (collections, checkout, payouts, mandates): use top-level
mobileandproviderfor wallet rails instead of nestedcustomer/beneficiaryobjects. This reduces nesting and copy-paste mistakes. - Sub-accounts (only when enabled for your merchant): send
X-Mojo-Account-Refon every bearer-authenticated request to scope it to a specific sub-account (usemainfor the primary account). Metadata endpoints (/v1/metadata/*) ignore the header. Idempotency keys andmerchant_referencelookups are scoped per resolved account. CallGET /v1/accountto confirm the account a request resolves to. When sub-accounts are not enabled, omit the header.