Idempotent by request ID
Send a fresh UUID v4 as X-Request-ID per logical request. A replay inside 10 minutes returns HTTP 409 instead of moving money twice.
API families
Every family shares the same authentication, envelope and webhook model — learn it once, use it everywhere.
From keys to first payout in four steps
The same four steps work for every family. Pick your language once; every sample on this page follows it.
Request signing
Every call is signed with HMAC-SHA256 using your secret. The server rebuilds the same string and rejects anything that does not match.
|
|
|
Select a field to see exactly what goes into it.
Required headers
X-Client-ID | Your client identifier, issued from the dashboard. |
X-Timestamp | Unix epoch seconds. Rejected outside a 300 second window. |
X-Request-ID | UUID v4, unique per request. A repeat within 10 minutes returns HTTP 409. |
X-Signature | Lowercase hex HMAC-SHA256 of the canonical string, keyed with your secret. |
The rules
- 300s clock window — requests with an older or future
X-Timestampare rejected. - 10 min replay memory — a repeated
X-Request-IDreturns HTTP 409. - Signature is lowercase hex.
- PATH excludes the query string.
- BODY is the raw request body, or an empty string when there is none.
- Line endings in the body are normalised to \n before signing.
Signature lab
Paste a request and watch the canonical string and signature build live. Everything runs in your browser — your secret never leaves this page.
Timestamp
—Canonical string
—X-Signature
—API reference
109 endpoints across 12 families. Pick a family, then open any endpoint for its headers, parameters and example payloads.
Guides
Long-form walkthroughs for each family, from sandbox to go-live. Opens in a reader without leaving the page.
Webhooks
Status changes are pushed to your endpoint as signed JSON. Treat the webhook as the source of truth, and make your handler idempotent.
Delivery headers
X-Webhook-Signature | Lowercase hex HMAC-SHA256 of the JSON body, keyed with your webhook secret. |
X-Webhook-Event | The event name, e.g. payout.success. |
X-Webhook-Delivery-ID | Unique per delivery — use it to de-duplicate retries. |
Verify before you trust
$expected = hash_hmac('sha256', $rawBody, $webhookSecret);
if (! hash_equals($expected, $request->header('X-Webhook-Signature'))) {
abort(401);
}
// respond 2xx fast, process asynchronouslyErrors
Every failure returns success: false with a stable error.code. Branch on the code, never on the message text.
Retries, idempotency & limits
Money-moving calls must be safe to retry. These are the guarantees to build on.
Pending is a real state
Bank rails settle asynchronously. Treat pending as in-flight, wait for the webhook, and poll the status endpoint only as a fallback.
Rate limits
Limits are applied per client. When exceeded you receive HTTP 429 with a Retry-After header — back off, do not hammer.
Clock discipline
Keep servers NTP-synced. X-Timestamp outside the 300-second window is rejected before the signature is checked.
Changelog
What changed in the API contract, newest first.
Tools & specs
Machine-readable contracts for code generation, testing and monitoring.
OpenAPI 3 · JSONFull contract for code generators
OpenAPI 3 · YAMLDownload the spec
Postman collectionEvery endpoint, pre-wired
AePS capability matrixLive support per bank rail
AePS response codesSearchable explainer
System statusLive rail health
Generate a typed client
Point any OpenAPI generator at the spec to get a client in your language.
npx @openapitools/openapi-generator-cli generate \
-i https://litebanking.com/developer/openapi.yaml \
-g php -o ./litebanking-clientReady for production?
Create a partner account, finish KYC once, and request production keys from your dashboard.