Create your first payment link

This guide takes you from zero to a working payment link, a test payment, and a webhook notification in about 10 minutes.

Prerequisites: a Mamo Business sandbox account and sandbox API key. Sandbox accounts aren't self-serve — request one from us via the chat bubble 💬 (bottom-right of the docs) or at [email protected]. Once your sandbox account is ready, log in to the sandbox dashboard and copy your API key from the Developer settings. Sandbox keys start with sk-. Keep it secret.

Base URLs

Start with sandbox. Switch to production only after your flows are fully tested.

Step 1 — Confirm your API key works

Call the Business Details endpoint to check your key and connection:

curl -X GET https://sandbox.dev.business.mamopay.com/manage_api/v1/me \
  -H "Authorization: Bearer YOUR_SANDBOX_KEY"

Expected response (200 OK):

{
  "business_name": "Your Business Name",
  "business_tag": "your-business",
  "website": "https://yourbusiness.com"
}

A 403 means the key is wrong, or you're pointing a sandbox key at the production URL (or vice versa).

Step 2 — Create a payment link

curl -X POST https://sandbox.dev.business.mamopay.com/manage_api/v1/links \
  -H "Authorization: Bearer YOUR_SANDBOX_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Test order",
    "amount": 10.00,
    "amount_currency": "AED",
    "first_name": "Test",
    "last_name": "Customer",
    "email": "[email protected]"
  }'

The response includes a payment_url. Open it in a browser to see the hosted checkout page. See Create Payment Link for every available field.

Step 3 — Complete a test payment

On the sandbox checkout, use a test card with CVV 123 and expiry 01/28:

For 3DS and address-required variants, see the full test-card table on the Create Payment Link page. If prompted for a 3DS password, enter Checkout1!.

Step 4 — Receive a webhook when payment lands

Register an endpoint to receive real-time events:

curl -X POST https://sandbox.dev.business.mamopay.com/manage_api/v1/webhooks \
  -H "Authorization: Bearer YOUR_SANDBOX_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://your-server.example.com/mamo/webhook",
    "enabled_events": ["payment.succeeded", "payment.failed"],
    "auth_header": "Bearer my-random-secret"
  }'

The response includes a signing_secret. Save it now: it is returned only once, and if you lose it you have to delete and re-create the webhook.

Mamo POSTs the payment object to your URL. Each event delivery carries a Mamo-Signature header (an HMAC-SHA256 of the raw body, keyed with your signing_secret) and an Authorization header set to your auth_header value. Verify the signature in your handler (see Webhook delivery & retries), return 200 immediately, and process the event asynchronously. See Create Webhook for the full event list.

What's next

• Authentication — API keys, sandbox vs production, test cards
• Errors — error codes and how to handle each one
• Pagination — fetching every page of a list endpoint
• Idempotency — safely retrying requests
• Create Webhook — the full event-type reference and the signing_secret
• Webhook delivery & retries — verifying Mamo-Signature, retries and idempotency