Overview

Kratos Pay API is the payment gateway of Kratos Financials Inc. It lets any application — online store, SaaS platform, mobile app — collect and send Mobile Money payments, accept bank cards and GIMAC QR payments, and track transactions through webhooks.

Live endpoints

Download the guide for offline use

Authentication

Payments are called from your server with an API key (sk_test_… in test, sk_live_… in production) and your application id. Never put the key in a browser or a mobile app.

Authorization: Bearer sk_live_VOTRE_CLE
X-Application-ID: 1
Content-Type: application/json
Accept: application/json

Required fields: type, provider, amount, and phone_number for Mobile Money. For Mastercard and Visa cards, use provider: "mastercard"; no phone number is required. Add a unique idempotency_key per operation.

Open Swagger for API integrations

Collection

Method POSThttps://api.kratospay.com/api/v1/transactions

JSON payload

{
  "type": "collection",
  "provider": "orange_money_cm",
  "amount": 5000,
  "currency": "XAF",
  "phone_number": "696246686",
  "idempotency_key": "commande-1234",
  "metadata": {
    "description": "Commande 1234"
  }
}

HTTP 201 response — request initiated

{
  "success": true,
  "data": {
    "uuid": "018f1a2b-3c4d-7e5f-a6b7-c8d9e0f1a2b3",
    "type": "collection",
    "provider": "orange_money",
    "status": "pending",
    "amount": "5000.00",
    "currency": "XAF",
    "reference": "MP240101.1234.A56789",
    "phone_number": "696246686",
    "created_at": "2026-11-02T08:00:00Z",
    "updated_at": "2026-11-02T08:00:00Z"
  },
  "meta": {
    "request_id": "...",
    "timestamp": "..."
  }
}

Card collection — Mastercard

Method POSThttps://api.kratospay.com/api/v1/transactions

JSON payload

{
  "type": "collection",
  "provider": "mastercard",
  "amount": 25000,
  "currency": "XAF",
  "idempotency_key": "commande-5678",
  "return_url": "https://monsite.com/merci",
  "metadata": {
    "description": "Commande 5678"
  }
}

HTTP 201 response — request initiated

{
  "success": true,
  "data": {
    "uuid": "018f1a2b-3c4d-7e5f-a6b7-c8d9e0f1a2b4",
    "type": "collection",
    "provider": "mastercard",
    "status": "pending",
    "amount": "25000.00",
    "currency": "XAF",
    "reference": "K7H2M9QXP4R8T1W5Z3NB",
    "phone_number": null,
    "checkout_url": "https://master.kratos-travel.com/?sessionId=SESSION0002..."
  },
  "meta": {
    "request_id": "...",
    "timestamp": "..."
  }
}

Visa follows the same flow as Mastercard: keep provider: "mastercard" and handle the checkout_url response in the same way.

Disbursement

Method POSThttps://api.kratospay.com/api/v1/transactions

JSON payload

{
  "type": "disbursement",
  "provider": "mtn_momo_cm",
  "amount": 2000,
  "currency": "XAF",
  "phone_number": "677895412",
  "idempotency_key": "paiement-fournisseur-42",
  "metadata": {
    "description": "Paiement fournisseur"
  }
}

HTTP 201 response — request initiated

{
  "success": true,
  "data": {
    "uuid": "018f1a2b-3c4d-7e5f-a6b7-c8d9e0f1a2b4",
    "type": "disbursement",
    "provider": "mtn_momo",
    "status": "pending",
    "amount": "2000.00",
    "currency": "XAF",
    "reference": "MP240101.1235.B12345",
    "phone_number": "677895412",
    "created_at": "2026-11-02T08:05:00Z",
    "updated_at": "2026-11-02T08:05:00Z"
  },
  "meta": {
    "request_id": "...",
    "timestamp": "..."
  }
}

A disbursement debits the application balance and creates a pending transaction while waiting for the network. Check the balance, wait for the transaction.success or transaction.failed webhook, and use GET /transactions/{uuid} to track it.

HTTP 422 error — invalid data or refused rule

error.details lists the messages of each invalid field. Give the meta.request_id to support if something goes wrong.

{
  "success": false,
  "error": {
    "code": "INSUFFICIENT_BALANCE",
    "message": "Solde insuffisant.",
    "details": {
      "amount": [
        "Le montant dépasse le solde disponible."
      ]
    }
  },
  "meta": {
    "request_id": "...",
    "timestamp": "..."
  }
}

HTTP 401 error — unauthenticated

API key missing, invalid, inactive or expired, or key from another environment (sk_test_ used in production, or the reverse).

Integration checklist

The pending status means the transaction was initiated and is waiting for the customer to confirm on their phone; wait for the webhook or check GET /transactions/{uuid} before confirming the payment.
Use a unique idempotency_key per operation and keep the uuid returned by the API.
The phone number has no country code (696246686) and must belong to the chosen network's country.
With an sk_live_… key, these calls move real funds. Check the number, network, amount and environment before sending.
For card payments, open checkout_url and confirm payment through a webhook or transaction lookup, never from the redirect alone. A received GIMAC QR payment arrives directly as success.

What the API lets you do

Collect through Mobile Money (collection), bank card via a hosted checkout page, or GIMAC QR.
Send funds to a Mobile Money wallet from your balance (disbursement), withdraw your money, schedule withdrawals or pay several beneficiaries at once.
Collect without code thanks to payment links and QR codes.
Be notified in real time of every status change through signed webhooks.
Test the whole journey without real money using an sk_test_… key.

Key vocabulary

Application: an integration (site, app, terminal) with its own keys, webhook and balance. Its id is sent in X-Application-ID.
API key: sk_test_… (test, no real money) or sk_live_… (real payments). It stays on your server.
Transaction: a money movement identified by a uuid, in one of the statuses pending, success, failed, expired, refunded…
Webhook: an HTTP POST notification sent by Kratos Pay to your server every time a transaction's status changes.
Idempotency key: a unique identifier you generate for each operation, so the same transaction is never created twice when a request is retried.

Two merchant profiles

	Individual merchant (developer)	Business merchant
Who	A person collecting for themselves and integrating the API (site, app, bot).	A company collecting for its business.
Sign-in	Phone + WhatsApp code	Email + password + mandatory TOTP
KYC	Not required to collect live	Required before any real payment
Applications	One personal application, created automatically	Several applications (website, mobile app, terminal…)
Reserved features	—	Team, scheduled withdrawals, mass payments

Individual: create the account → sign in → get your application → set up the webhook → generate an API key → collect → track → withdraw your money.
Business: create the account → enable TOTP → submit KYC → create an application → API key → collect → payment links → balance and withdrawals → team.