Money in, money out.
One powerful platform.

<?php
$body = [
  'amount' => 500,
  'phone' => '254712345678',
  'reference' => 'WD-2026-001',
  'description' => 'Withdrawal',
  'callbackUrl' => 'https://yoursite.com/webhooks/b2c',
];
$ch = curl_init('https://bluepay.co.ke/api/v1/b2c/payouts');
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_HTTPHEADER => [
    'Authorization: Bearer YOUR_API_KEY',
    'Content-Type: application/json',
  ],
  CURLOPT_POSTFIELDS => json_encode($body),
  CURLOPT_RETURNTRANSFER => true,
]);
$response = curl_exec($ch);
curl_close($ch);
// json_decode($response, true)

import requests

r = requests.post(
    "https://bluepay.co.ke/api/v1/b2c/payouts",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    json={
        "amount": 500,
        "phone": "254712345678",
        "reference": "WD-2026-001",
        "description": "Withdrawal",
        "callbackUrl": "https://yoursite.com/webhooks/b2c",
    },
    timeout=60,
)
print(r.status_code, r.json())

// Node 18+ (global fetch)
const res = await fetch("https://bluepay.co.ke/api/v1/b2c/payouts", {
  method: "POST",
  headers: {
    Authorization: "Bearer YOUR_API_KEY",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    amount: 500,
    phone: "254712345678",
    reference: "WD-2026-001",
    description: "Withdrawal",
    callbackUrl: "https://yoursite.com/webhooks/b2c",
  }),
});
console.log(res.status, await res.json());

import java.net.URI;
import java.net.http.*;

String json = "{\"amount\":500,\"phone\":\"254712345678\",\"reference\":\"WD-2026-001\"}";
HttpClient client = HttpClient.newHttpClient();
HttpRequest req = HttpRequest.newBuilder(URI.create(
    "https://bluepay.co.ke/api/v1/b2c/payouts"))
  .header("Authorization", "Bearer YOUR_API_KEY")
  .header("Content-Type", "application/json")
  .POST(HttpRequest.BodyPublishers.ofString(json))
  .build();
var res = client.send(req, HttpResponse.BodyHandlers.ofString());
System.out.println(res.statusCode() + " " + res.body());

import hashlib, hmac, json, re

raw = request.data  # raw bytes — read BEFORE json.loads
sig = request.headers.get("X-BluePay-Signature", "")
secret = b"YOUR_SECRET_KEY"

m = re.fullmatch(r"v1=([a-f0-9]{64})", sig)
if not m:
    abort(400)
expected = hmac.new(secret, raw, hashlib.sha256).hexdigest()
if not hmac.compare_digest(expected, m.group(1)):
    abort(401)
event = json.loads(raw.decode("utf-8"))

import crypto from "crypto";

// Use express.raw({ type: "application/json" }) so req.body is a Buffer
app.post("/webhook", (req, res) => {
  const raw = req.body;
  const sig = req.get("X-BluePay-Signature") || "";
  const m = /^v1=([a-f0-9]{64})$/.exec(sig);
  if (!m) return res.sendStatus(400);
  const expected = crypto.createHmac("sha256", "YOUR_SECRET_KEY")
    .update(raw).digest("hex");
  if (!crypto.timingSafeEqual(
    Buffer.from(expected, "hex"), Buffer.from(m[1], "hex")
  )) return res.sendStatus(401);
  const event = JSON.parse(raw.toString("utf8"));
  res.sendStatus(200);
});

require "openssl"
require "json"

raw = request.body.read
sig = request.get_header("HTTP_X_BLUEPAY_SIGNATURE").to_s
secret = "YOUR_SECRET_KEY"
m = /\Av1=([a-f0-9]{64})\z/.match(sig)
halt 400 unless m
expected = OpenSSL::HMAC.hexdigest("SHA256", secret, raw)
halt 401 unless Rack::Utils.secure_compare(expected, m[1])
event = JSON.parse(raw)