Checkout with Cenoa allows you to track each transfers your customers have made.
\nYou can use the REST APIs to integrate Checkout with Cenoa into your platform.
Complete the integration by following the Step By Step Guide below.
Map Cenoa user to your internal customer ID
\nBy using REST APIs, track each transfer transaction your customers have made to your Cenoa account
\nValidate a user's order for checkout, or top up your internally managed wallet/account
\n\n\nBefore you begin, please get in touch with us on partnerships@cenoa.com for enabling Checkout with Cenoa for your platform.
\n
1- On your checkout experience, display Cenoa as a payment option to the user. e.g;
\n2- Ask the user if they already have an existing Cenoa account.
\n3- If the answer is yes, then collect the phone number that is registered with their Cenoa account.
\n\n\nOptional: Some developers who integrated Checkout with Cenoa into their platform, have implemented an extra validation step by sending an OTP SMS to ensure the added Cenoa account is authorized by the user. It is up to you to mimic the same approach or skip OTP SMS validation.
\n
4- Call Get User Account REST API to check if the phone number was already registered with a Cenoa user. See details.
4a- If an existing Cenoa User; then store the Cenoa userId with your platform's user identifier.
4b- If NOT an existing Cenoa User; then display the following QR code or a link in order for user to download Cenoa mobile app and create a new Cenoa user account.
\n\n\nTips
\n
For Step 4a. Response body also has masked email address of the user. You may display the masked email and have the user recognize and verify it before completing the step.
\nFor Step 4b. Once the new Cenoa user account creation is completed, the user may be prompted to restart from the beginning step.
\nEach transfer can be retrieved by using Get All Transactions REST API. See details.
We haven't implemented webhook functionality yet for Checkout with Cenoa, but you can call the Get All Transactions REST API as required.
Note that the REST APIs' rate limiting adequately meet your requirements regarding both frequency and delivery time.
\nPlease set up your environment with following variables:
\nurl=https://api.cenoa.com
apikey=[YOUR API KEY]
apisecret=[YOUR API SECRET]
Check out Scripts tab in each folder to learn how to send your apikey and sign each REST API request with your apisecret.
Each request must include apikey, payload, and signature headers. The payload is a base64-encoded JSON string, and that JSON must contain a timestamp field in milliseconds. The signature is the HMAC-SHA512 hex digest of the base64 payload, signed with the API secret.
The server validates requests in this order:
\nIt finds the matching key pair using apikey.
It recalculates the HMAC signature from the raw payload header and compares it with signature.
It decodes payload, parses the JSON, and reads timestamp.
It rejects the request unless the timestamp is no older than 5 minutes and not in the future.
\nconst obj = { timestamp: Date.now().toString()};\nconst payload = CryptoJS.enc.Base64.stringify(CryptoJS.enc.Utf8.parse(JSON.stringify(obj)));\nconst signature = CryptoJS.enc.Hex.stringify( CryptoJS.HmacSHA512(payload, apisecret));\n\napikey: <api-key>\npayload: <base64-encoded-json>\nsignature: <hmac-sha512-hex>\n\nImportant note: if the client machine clock is too far behind or ahead, the request will be rejected with 401, so client/server time should be reasonably in sync.