By EcoCash

Authorization

Identify your application and the channel making the transaction.

Overview

Every request carries two credentials. They are different things and they are not related to each other.

The two credentials every request carries
Credential	Where it goes	What it identifies	Format
Client credentials	Headers: X-Client-Id, X-Client-Secret	Your application	epg_ then a string of characters
Channel API user	Request body: username, password	The channel making the transaction	epg-sandbox-user-v1

Transaction Lookup is the exception. It needs client credentials only, because it does not move funds.

How to get your credentials

Create a developer account and request sandbox access. Your credentials are issued to you and are on your credentials page once you sign in.

Never commit them to source control.

The password field

The channel API user password is never sent in clear. It is encrypted against your encryption key and sent as the password field in the request body.

The encrypted value looks different every time you encrypt it. This is expected. Any correctly encrypted value is accepted.

The encryption method and a reference implementation are on your credentials page once you sign in. The API Console can also generate the value for you while you are testing.

Sending a request

bash

curl -X POST 'https://developers.ecocash.co.zw/api/serviceRequest' \
  -H 'X-Client-Id: <your-client-id>' \
  -H 'X-Client-Secret: <your-client-secret>' \
  -H 'Content-Type: application/json' \
  -d '{
        "serviceType": "ENTERPRISECASHINV2",
        "username": "epg-sandbox-user-v1",
        "password": "<encrypted>",
        "...": "..."
     }'

Error codes

SBX40100 and TP40101 are returned when authorization fails. Both are on the Errors page.