Mavunta Developers · API v1

Cards, M-Pesa, crypto. One API.

Accept the rails your customers actually pay with and settle into Mavunta balances, USDT, or USDC. Start in sandbox; go live after verification.

Start in sandbox Read the docs

Cards · PayPal · M-Pesa · Airtel Money · USDT · USDC · On-chain

Mavunta Pay · wire tapeSANDBOX

09:41:07.212POST /v1/payment-intents201
09:41:07.298checkout_url issued/pay/pi_9f3k…
09:41:31.054customer paidM-PESA · KES 1,500
09:41:31.220settledUSDT 11.42 → your balance
09:41:31.371⇒ webhook payment_intent.paidsigned
09:41:31.902⇐ 200 your-serverorder #1001 paid

No real money moves with test keys.

Start here

PAYAccept paymentsPayment intents, hosted checkout, and payment links. Cards, PayPal, mobile money, and crypto through one integration.SETTLESettle in stablecoinsReceive USDT or USDC into your Mavunta balance. Read balances and settlements, then reconcile against your own ledger.EVENTSListen to webhooksSigned, retried events: paid, refunded, failed. Verify the HMAC signature and mark orders in real time.PLATFORMBuild advanced flowsMarket data, trading endpoints, and wallet operations for treasury and execution, on least-privilege scoped keys.

First request

Sandbox keys are instant.

Test keys (cwk_test_) simulate successful payments, cancellations, timeouts, refunds, webhook retries, and checkout expiry. You only request live access once a test payment and webhook are working.

Open the sandbox Sandbox vs live

curl https://sandbox-api.mavunta.com/v1/payment-intents \
  -H "Authorization: Bearer cwk_test_sk_..." \
  -H "Idempotency-Key: order-1001" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": "1500",
    "currency": "KES",
    "settlement_currency": "USDT",
    "payment_methods": ["mavunta_balance", "card", "mpesa"]
  }'

{
  "id": "pi_...",
  "status": "awaiting_payment",
  "checkout_url": "https://www.mavunta.com/pay/pi_...",
  "request_id": "req_test_...",
  "environment": "test",
  "livemode": false
}

Guarantees

Money-moving keys are least-privilege by default. These hold on every request.

KEYS: Scoped: publishable, restricted, secret. Creating one takes 2FA; each key carries only the permissions it needs.
IP: Allowlists per key. A leaked secret is useless from an unknown network.
WEBHOOKS: HMAC-signed and retried until your server answers 200. The event, not the redirect, is the truth.
IDEMPOTENCY: Idempotency keys on every create. Retry a timeout without charging twice.
LOGS: Request logs and audit trails for every key, in the console.
LIVE MODE: Earned, not instant. Live keys unlock after business verification.
LIMITS: Rate limits with response headers, so your client can back off before we do.

SDKs and tooling

Official libraries that match the webhook signature scheme byte for byte, plus a CLI for local webhook forwarding.

Node.js · PHP · Python · Go · Java · Laravel · WooCommerce · CLI

Browse SDKs and examples →

Build your first payment today.

Sandbox keys are instant. Live access is earned.

Start in sandbox Read the quickstart