Introduction

This Back-Office API is intended to be used by merchants or partners that wish to integrate their own platform with CURO.

The API interface is implemented as RESTful; please see Overview below for details and available formats.

If you would like to propose new functionality or add new features, feel free to contact us at [email protected].

Overview

Character Set and Encoding

The API uses the character set UTF-8 exclusively, please make sure any conversion is done before encoded data is send to the API.

⚠️
Important
Every request message send to the API must be UTF-8 encoded. Any other encoding may result in system errors or unexpected behavior.

Security

Connection to the API is only possible using HTTPS (HTTP over SSL) Internet connection, encrypted with 2048-bit encryption.

API URL's

There are multiple entry-point URL's for this API, one for each of the platforms:

Alpha is a testing platform using the latest master development branch on a separate Test database.
Staging is the testing platform using the latest stable branch on the Test database.
Live is a the production/stable API entry-point on the Live database.

📘
ALPHA: https://api-alpha.curopayments.net/rest/v1/curo/
STAGING:https://api-staging.curopayments.net/rest/v1/curo/
LIVE: https://api.curopayments.net/rest/v1/curo/

📘
Note

Don't forget to switch from the test API end-point to live one in your production mode.

Live and Test are two completely separate platforms; by default the authentication info, your merchant id and site ids will be shared for both environments.

NB site- or user information changed on the Live backoffice will automatically overwrite the corresponding setting on the test backoffice!

API Authentication

Access to the API is granted via HTTP Basic access authentication over SSL protocol. The "username" and "password" are your merchant_id and a User API key respectively. The User Api Key must be assigned to an existing user account, or a separate API user can be created.

This authorisation info needs to be supplied in the request header for with each request to the API.

$sMerchant  = 'your-account-id';
$sAPI_Key  = 'API-key-for-a-user';

Using CURL in PHP you can set the authentication information like this:

// set HTTP Basic Authentication
curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
curl_setopt($ch, CURLOPT_USERPWD, $sMerchant . ':' . $sAPI_Key);

Passing authentication information in the request header:

header('WWW-Authenticate: Basic' . base64_encode($sMerchant . ':' . $sAPI_Key));

⚠️
Important

Please contact us for a personal API Key to access the API

Resellers/partners can optionally use their credentials to submit requests on behalf of their merchants; this option must be enabled by CURO

❗️
Warning

Don't ever share these credentials - if someone else gets a hold of it, they'll be able to access anything within given privileges.

CURO won't indemnify you or your clients for any (ab)use of this API.

Supported formats

The API is able to process request and response in different formats. This gives you a great flexibility in usage of the API.

You can either pass the desired format in a variable, or using the HTTP Accept: header. The default format for the CURO protocol is JSON.

Name	format value	Accept header	Remarks
JSON	`format=json` (default)	`Accept: application/json`	JavaScript Object Notation, is a simple machine-readable data-interchange format, which makes constructing API applications in JavaScript easy (though it can be used from other languages too). For more information about JSON, visit json.org.
XML	`format=xml`	`Accept: application/xml`	(Extensible Markup Language) is a set of rules for encoding the documents in machine-readable form. It is defined in the XML 1.0 Specification produced by the W3C, and several other related specifications, all free open standards.
Serialize	`format=serialize`	`Accept: application/php`	PHP serialised value.