Charge a credit card using a saved payment token

POST

/senangpay/apiv1/pay_cc

Charges the customer's credit card using a token previously generated via the Get Token (3D) flow. The card holder does not need to re-enter their card details.
Authentication: HTTP Basic Auth — use your merchant ID as the username and leave the password empty.
Hash generation (HMAC-SHA256): ``` string_to_hash = merchant_id + name + email + phone

detail + order_id + amount
hash = HMAC-SHA256(string_to_hash, secret_key) ```
Amount format: Integer only. Convert decimals by multiplying by 100. e.g. RM 2.00 → 200.

Request

Authorization

Basic Auth

Send your HTTP requests with an

Authorization

header that contains the word Basic followed by a space and a base64-encoded string username:password

Example:

Authorization: Basic *****************

Body Params application/x-www-form-urlencodedRequired

Request Code Samples

Shell

JavaScript

Java

Swift

PHP

Python

HTTP

Objective-C

Ruby

OCaml

Dart

curl --location '/senangpay/apiv1/pay_cc' \
--header 'Authorization: Basic <encoded-value>' \
--data-urlencode 'name=Abu Bin Ali' \
--data-urlencode 'email=ahmad@google.com' \
--data-urlencode 'detail=Order for product id #4' \
--data-urlencode 'phone=0109876543' \
--data-urlencode 'order_id=123' \
--data-urlencode 'amount=200' \
--data-urlencode 'token=tok_a1b2c3d4e5f6' \
--data-urlencode 'hash=a3f5c9e1b2d4f87a93c61e4d2b7a0f559d3e8c21f6b4a07d'

Responses

🟢200

application/json

Payment processed. Check status field for success or failure.

Bodyapplication/json

Example

{
    "status": 0,
    "transaction_id": "14951544812820",
    "order_id": "123",
    "amount_paid": 200,
    "msg": "Payment was successful",
    "hash": "99b6e99bb0aa663101b1e4f6f8d69c2efb41ef81a5a7aa030bf76a098a03d233"
}

Modified at 2026-06-10 03:59:46

Get Initiate Checkout by Session ID

Initiate 3D card tokenisation (web view / iframe)