Welcome to Mamo

The Mamo Business API lets you take payments, bill subscriptions, pay out recipients and issue cards from your own product. It's a REST API: requests and responses are JSON, it uses standard HTTP verbs and status codes, and every request is authenticated with your API key.

📘
New here?
Follow the Quick start to create a payment link, pay it with a test card and receive the webhook, in about 10 minutes.

Base URLs

Environment	Base URL
Sandbox	`https://sandbox.dev.business.mamopay.com/manage_api/v1`
Production	`https://business.mamopay.com/manage_api/v1`

Sandbox and production are separate environments with separate API keys and data. Build and test in the sandbox, then switch the base URL and key at go-live. See Sandbox testing.

Authentication

Send your API key as a Bearer token in the Authorization header of every request:

Authorization: Bearer sk-...

Get your keys from the Developer page of your dashboard; see Authentication.

🚧
Keep your key secret
Your API key can move money. Call the API from your server only, never from a browser or mobile app.

Your first request

Fetch the business that owns your API key:

curl https://sandbox.dev.business.mamopay.com/manage_api/v1/me \
  -H "Authorization: Bearer $MAMO_API_KEY"

{
  "business_name": "Mamo",
  "business_tag": "mamo",
  "website": "https://mamopay.com",
  "account_status": "Verified"
}

Conventions

JSON in, JSON out. Send request bodies as JSON with Content-Type: application/json.
Amounts are decimals in the currency's main unit: 119.99 means AED 119.99, not fils. The currency is a three-letter code such as AED, in amount_currency or currency. A few fields, such as payout amount, are sent as strings; each endpoint's schema shows the type.
Dates and timestamps are strings, and the format differs between resources (for example created_date: "2026-07-20-10-35-00" on payments and created_at: "04/12/2025" on payouts). Parse the format shown in each endpoint's example.
IDs are strings with a prefix that tells you the object type:

Prefix	Object
`MB-LINK-`	Payment link
`PAY-`	Payment
`MPB-SUB-`	Subscription
`INV-`	Invoice
`REP-`	Recipient
`PYT-`	Payout
`MPB-WH-`	Webhook
`CRD-`	Card

Good to know

Idempotency: send an Idempotency-Key header on write requests so a retry after a timeout never runs twice.
Pagination: list endpoints take page and per_page and return a pagination_meta object.
Errors: 2xx is success, 4xx means the request needs fixing, 5xx is on our side; error bodies carry messages, error_code and, for validation errors, errors. Why a card payment was declined is listed in Failure messages.
Rate limits: 100 requests per 30 seconds per IP address; over the limit you get 429 Too Many Requests.
Versioning: v1 is the only version, and changes to it are additive.