Merchant API
The Merchant API is how a merchant calls paymentSystem directly — no gateway, no encryption envelope. Log in once, get a JWT, and call every service (AEPS, DMT, UPI) with a plain Authorization: Bearer <token> header and unencrypted JSON.
If you're building or operating on behalf of multiple merchants under one account instead — the Partner API is the one you want; it covers the same services through a different transport (API key + AES-256-GCM), since a shared account has no single merchant's JWT to use.
What's here
| Page | Covers |
|---|---|
| Authentication | POST /login, session semantics, OTP flows |
| AEPS | Aadhaar-enabled banking — cash withdrawal, balance, mini statement, Aadhaar Pay |
| DMT | Domestic money transfer — customer onboarding, remitter/beneficiary management, IMPS/NEFT transfers |
| UPI / QR | Static & dynamic UPI QR generation |
| UPI Collections | Collect requests, SMS Pay, status polling, refunds, VPA verification |
Typical integration order
1. Authentication → POST /login, capture the JWT
2. AEPS/DMT onboarding (if this merchant hasn't been onboarded to NSDL yet)
3. Day-to-day: AEPS transactions / DMT transfers / UPI QR & Collections
Every response on every route below shares one envelope:
{ "statusCode": "00", "message": "...", "data": { ... } }
statusCode: "00" means success; anything else is a failure or a service-specific pending/ambiguous state — see each page's own status-code notes, and Error Handling for the shared HTTP-level codes.