Quick start: create your first payment link

This guide takes you from zero to a working payment link, a test payment, and a webhook notification in about 10 minutes.

📘

Before you start: get a sandbox account and API key

• Your business is verified — self-serve. On your dashboard's Developer page, click Get sandbox access; your sandbox API keys are then available under Developer → API Keys in the sandbox dashboard.
• Not yet verified — sandbox access is provisioned manually. Request it via live chat or at [email protected].

See Authentication → Sandbox for details. Sandbox keys start with sk-. Keep yours secret.

Base URLs

Start with sandbox. Switch to production only after your flows are fully tested.

Step 1 — Confirm your API key works

Call the Business Details endpoint to check your key and connection:

curl -X GET https://sandbox.dev.business.mamopay.com/manage_api/v1/me \
  -H "Authorization: Bearer YOUR_SANDBOX_KEY"

Expected response (200 OK):

{
  "business_name": "Your Business Name",
  "business_tag": "your-business",
  "website": "https://yourbusiness.example.com"
}

A 403 means the key is wrong, or you're pointing a sandbox key at the production URL (or vice versa).

Step 2 — Create a payment link

curl -X POST https://sandbox.dev.business.mamopay.com/manage_api/v1/links \
  -H "Authorization: Bearer YOUR_SANDBOX_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Test order",
    "amount": 10.00,
    "amount_currency": "AED",
    "first_name": "Test",
    "last_name": "Customer",
    "email": "[email protected]"
  }'

The response includes a payment_url. Open it in a browser to see the hosted checkout page. See Create Payment Link for every available field.

Step 3 — Complete a test payment

On the sandbox checkout, pay with a Success card from the test-card table, using the CVV, expiry, and 3DS password listed there. Repeat with a Fail card to see a declined payment.

Step 4 — Receive a webhook when payment lands

Register an endpoint to receive real-time events:

curl -X POST https://sandbox.dev.business.mamopay.com/manage_api/v1/webhooks \
  -H "Authorization: Bearer YOUR_SANDBOX_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://your-server.example.com/mamo/webhook",
    "enabled_events": ["payment.succeeded", "payment.failed"],
    "auth_header": "Bearer my-random-secret"
  }'

🚧

Save the signing_secret now

The response includes a signing_secret. It is returned only once; if you lose it, you have to delete and re-create the webhook.

Mamo POSTs the payment object to your URL. Each event delivery carries a Mamo-Signature header (an HMAC-SHA256 of the raw body, keyed with your signing_secret) and an Authorization header set to your auth_header value. Verify the signature in your handler (see Webhook delivery & retries), return 200 immediately, and process the event asynchronously. See Create Webhook for the full event list.

What's next

• Authentication — API keys, sandbox vs production
• Sandbox Testing — test cards, per-environment webhooks, settlement timing
• Errors — error codes and how to handle each one
• Pagination — fetching every page of a list endpoint
• Idempotency — safely retrying requests
• Create Webhook — the full event-type reference and the signing_secret
• Webhook delivery & retries — verifying Mamo-Signature, retries and idempotency