Products

Customers

Developers

Contact Sales

See Their Success Stories

Discover how businesses are growing with HitPay, through real stories, results, and experiences from our merchants.

Ecommerce

Food & Beverage

Retail

Fitness & Gym

Health, Beauty & Spa

Educational Services

Non-Profit & Donations

Travel & Tour Operators

See How Merchants Use HitPay

Hear from HitPay Merchant

Developer Resources

Explore our comprehensive developer resources designed to enhance your experience. From detailed API documentation to interactive tutorials.

Docs

HitPay Agents

API

HitPay Plugins

HitPay CLI

API Status

HitPay MCP

Sandbox signs you into a separate test environment

Read HitPay Docs

Create a Sandbox Account

Get started for free

Developers

Custom API

Developers

Custom API

Developers

Custom API

One payment API for Malaysia

Accept FPX, DuitNow, Touch ’n Go and cards in Malaysia. When you expand, the same integration takes PayNow, GCash and QR Ph. Hosted checkout, Drop-in UI or an embedded QR.

Read the API docs

→

Create a sandbox account

→

Read the API docs

→

Create a sandbox account

→

Need a custom setup? Talk to sales →

MAS · PS20200643

BNM

BSP · OPSCOR-2023-0006

PCI DSS

No monthly fees

cURL

Node.js

PHP

curl --request POST \
  --url https://api.sandbox.hit-pay.com/v1/payment-requests \
  --header 'X-BUSINESS-API-KEY: your_api_key_here' \
  --header 'X-Requested-With: XMLHttpRequest' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'amount=100.00' \
  --data-urlencode 'currency=SGD' \
  --data-urlencode 'email=buyer@example.com' \
  --data-urlencode 'reference_number=ORDER123' \
  --data-urlencode 'redirect_url=https://yoursite.com/success' \
  --data-urlencode 'payment_methods[]=paynow_online' \
  --data-urlencode 'payment_methods[]=card'

cURL

Node.js

PHP

curl --request POST \
  --url https://api.sandbox.hit-pay.com/v1/payment-requests \
  --header 'X-BUSINESS-API-KEY: your_api_key_here' \
  --header 'X-Requested-With: XMLHttpRequest' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'amount=100.00' \
  --data-urlencode 'currency=SGD' \
  --data-urlencode 'email=buyer@example.com' \
  --data-urlencode 'reference_number=ORDER123' \
  --data-urlencode 'redirect_url=https://yoursite.com/success' \
  --data-urlencode 'payment_methods[]=paynow_online' \
  --data-urlencode 'payment_methods[]=card'

cURL

Node.js

PHP

curl --request POST \
  --url https://api.sandbox.hit-pay.com/v1/payment-requests \
  --header 'X-BUSINESS-API-KEY: your_api_key_here' \
  --header 'X-Requested-With: XMLHttpRequest' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'amount=100.00' \
  --data-urlencode 'currency=SGD' \
  --data-urlencode 'email=buyer@example.com' \
  --data-urlencode 'reference_number=ORDER123' \
  --data-urlencode 'redirect_url=https://yoursite.com/success' \
  --data-urlencode 'payment_methods[]=paynow_online' \
  --data-urlencode 'payment_methods[]=card'

cURL

Node.js

PHP

curl --request POST \
  --url https://api.sandbox.hit-pay.com/v1/payment-requests \
  --header 'X-BUSINESS-API-KEY: your_api_key_here' \
  --header 'X-Requested-With: XMLHttpRequest' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'amount=100.00' \
  --data-urlencode 'currency=SGD' \
  --data-urlencode 'email=buyer@example.com' \
  --data-urlencode 'reference_number=ORDER123' \
  --data-urlencode 'redirect_url=https://yoursite.com/success' \
  --data-urlencode 'payment_methods[]=paynow_online' \
  --data-urlencode 'payment_methods[]=card'

QUICK ANSWER

HitPay’s Payment API lets Malaysian businesses accept FPX (1.8% + RM 0.40), DuitNow (1.2%), Touch ’n Go (1.9%) and cards (domestic 1.2% + RM1) with one POST /v1/payment-requests call, through hosted checkout, the Drop-in UI or an embedded QR. The same integration also covers Singapore and the Philippines, with 40+ methods in total. There’s no setup fee, no monthly fee and no separate API subscription. Check rates on /my/pricing. Send X-BUSINESS-API-KEY and X-Requested-With: XMLHttpRequest with every request. Start in sandbox, then switch the base URL and key for production.

Pay per transaction.
Never for the API.

Using the API costs nothing on top of your processing fees. There’s no setup fee, no monthly fee and no API subscription. These are the published online rates in each market.

Malaysia

Domestic cards

1.2% + RM1

International cards

3% + RM1 (+2% on foreign-currency card txns)

FPX

1.8% + RM 0.40

DuitNow

1.2%

Touch ’n Go

1.9%

Monthly / setup / API fee

None

Source

/my/pricing

Singapore

Domestic cards

2.8% + S$0.50

International cards

3.65% + S$0.50 (+2% on foreign-currency card txns)

PayNow (≥ S$100)

0.65% + S$0.30

PayNow (< S$100)

0.9% (min S$0.20)

Monthly / setup / API fee

None

Source

/sg/pricing

Philippines

Local cards

3% + ₱15

GCash

2.3%

QR Ph

1% or ₱20 (whichever is higher)

Monthly / setup / API fee

None

Source

/ph/pricing

Building in the Philippines? HitPay gives you one integration for Singapore, Malaysia and the Philippines, plus Borderless QR and AI tooling. Some providers quote PH rates before VAT, so compare like for like. Our PH rates are on /ph/pricing.

The local methods your
customers already use

Add a method’s enum to payment_methods[] and it shows up at checkout. Here’s what each one supports in Singapore, Malaysia and the Philippines. The full list is in the payment methods reference.

Malaysia

FPX

fpx

✓ Online

✕ Recurring

✓ Refunds

✕ Sandbox

DuitNow

duitnow

✓ Online

✕ Recurring

✕ Refunds

✕ Sandbox

Touch ’n Go

touch_n_go

✓ Online

✓ Recurring

✓ Refunds

✕ Sandbox

Cards (+ Apple Pay)

card

✓ Online

✓ Recurring

✓ Refunds

✕ Sandbox

Singapore

PayNow

paynow_online

✓ Online

✕ Recurring

✓ Refunds

✓ Sandbox

Cards (Visa, Mastercard, Amex)

card

✓ Online

✓ Recurring

✓ Refunds

✓ Sandbox

GrabPay

grabpay_direct

✓ Online

✓ Recurring

✓ Refunds

✓ Sandbox (QR simulation)

ShopeePay

shopee_pay

✓ Online

✓ Recurring

✓ Refunds

✓ Sandbox (QR simulation)

Philippines

GCash

gcash

✓ Online

✕ Recurring

✓ Refunds

✕ Sandbox

QR Ph / InstaPay

qrph_netbank

✓ Online

✕ Recurring

✓ Refunds

✕ Sandbox

Cards

card_cybersource

✓ Online

✓ Recurring

✓ Refunds

✕ Sandbox

GrabPay

grabpay_direct

✓ Online

✓ Recurring

✓ Refunds

✕ Sandbox

You can test PayNow and cards in the sandbox (api.sandbox.hit-pay.com). FPX, DuitNow, Touch ’n Go, GCash and QR Ph have no sandbox, so check them in production once your account is verified. Full list: payment methods reference · sandbox guide.

Step-by-step API guides for PayNow, FPX, DuitNow, GCash and QR Ph are on the way. For other markets, check availability in the docs.

All payment methods.

Just one API.

All payment methods.

Just one API.

All payment methods.

Just one API.

Cards, e-wallets, bank transfers and over-the-counter payments, all through a single integration.

See every payment method

→

Built for AI agents, too

Coding agents can read the docs, call the API and test webhooks without scraping a web page.

llms.txt

A plain-text index of the docs for agents at docs.hitpayapp.com/llms.txt, plus availability by market.

Hosted MCP server

Connect Claude, Cursor or any MCP client at mcp.hit-pay.com. Sign in with your HitPay login instead of an API key. MCP server guide

Agent Skills and Claude Code plugin

Ready-made skills and MCP tools for Claude Code, Cursor and Copilot. AI Agent Skills · Claude Code plugin

HitPay CLI

Forward webhooks to localhost and fire test events with @hit-pay/cli. CLI guide

OpenAPI

Generate a client from the full spec at docs.hitpayapp.com/openapi.json.

Meta Muse connector

Create payment links and Southeast Asia checkouts from Meta Muse. Meta Muse guide

Our official server SDK is PHP (hit-pay/php-sdk). The cURL and Node samples on this page use plain HTTP, so you can start without an SDK.

Your first charge in three steps

01 · Create a payment request

Send POST /v1/payment-requests with an amount and currency. Add payment_methods[] to choose which methods appear.

02 · Send your customer to checkout

Redirect to the returned url, embed the Drop-in UI, or show an embedded QR.

03 · Confirm with a webhook

Register an endpoint in your dashboard and check the Hitpay-Signature header (HMAC-SHA256). Don’t rely on redirect_url alone, and skip the old per-request webhook field. Webhooks guide

Rate limits: 400 requests a minute overall and 70 a minute for creating payment requests. Use webhooks instead of polling.

Why developers choose HitPay

Local rails, one integration

PayNow, FPX, DuitNow, Touch ’n Go, GCash, QR Ph and cards from a single API.

Licensed where you sell

We hold licences in Singapore, Malaysia and the Philippines, the three markets this API covers.

No fee for the API

You pay the published per-transaction rate. There’s no setup, monthly or API subscription fee.

Ready for AI agents

llms.txt, an MCP server, a CLI and agent skills, so AI coding tools can read the docs and call the API.

Platform APIs

Run a marketplace with sub-merchants using X-PLATFORM-KEY or OAuth. Support turns it on for you. Platform pricing isn’t published.

PCI DSS and signed webhooks

HitPay is PCI DSS certified, and every webhook carries an HMAC signature you can check.

HitPay vs Stripe, Xendit and PayMongo

vs Stripe (Singapore and Malaysia)

Our pricing pages list lower rates for domestic cards and local rails, such as PayNow in Singapore and 1.2% + RM1 for Malaysian domestic cards. Stripe publishes its own Singapore and Malaysia rates, so check them on Stripe. In Malaysia we also support DuitNow and Touch ’n Go, and Stripe’s payment-method table shows what it covers. HitPay vs Stripe (Singapore) · Malaysia comparison coming soon

vs PayMongo and Xendit (Philippines)

PayMongo is a strong Philippine choice and may list lower GCash and QR Ph rates, often before VAT. HitPay’s case in the Philippines is one stack across all three markets, plus Borderless QR and AI tooling. If the lowest PH rate is all you need, compare carefully. A Philippines comparison page is coming soon.

Keep reading: PayNow API guide · Malaysia payment API · GCash API · Payment gateways: Singapore · Malaysia · Philippines

Frequently Asked Questions

What is the HitPay Payment API?

It is HitPay’s REST API for creating payment requests (POST /v1/payment-requests), presenting hosted or embedded checkout, and confirming payments with dashboard-registered webhooks. One integration covers cards and local methods across Singapore, Malaysia, and the Philippines (40+ methods overall). See the online payments guide.

Which headers are required?

Send your business API key as X-BUSINESS-API-KEY. Also send X-Requested-With: XMLHttpRequest and Content-Type: application/x-www-form-urlencoded as shown in the guide. Missing X-Requested-With or the wrong environment key is a common cause of “invalid business API key” errors.

Is there a separate fee for using the API?

No. There is no setup fee, monthly fee, or separate API subscription. You pay the published per-transaction processing fees for the method and market. Confirm on /sg/pricing, /my/pricing, or /ph/pricing. Sandbox transactions are not charged.

How much are Malaysia cards, FPX, and DuitNow via API?

Domestic cards are 1.2% + RM1; international cards 3% + RM1. FPX is 1.8% + RM 0.40. DuitNow is 1.2%. Touch ’n Go online is 1.9%. Source: /my/pricing.

How much are Singapore cards and PayNow via API?

Online domestic cards are 2.8% + S$0.50; international cards 3.65% + S$0.50 (plus 2% on foreign-currency card transactions). Online PayNow is 0.65% + S$0.30 for S$100 and above, and 0.9% (minimum S$0.20) below S$100. Source: /sg/pricing.

How much are Philippines GCash, QR Ph, and cards via API?

GCash online is 2.3%. QR Ph is 1% or ₱20 (whichever is higher). Local cards are 3% + ₱15. Confirm on /ph/pricing. For PH comparisons, weigh multi-market coverage as well as list rates.

Which local methods can I pass in payment_methods[]?

Common enums include paynow_online (SG), fpx / duitnow / touch_n_go (MY), gcash / qrph_netbank (PH), plus card / card_cybersource by market. Full enums, currencies, refunds, and sandbox flags: payment methods reference.

Does HitPay have a sandbox?

Yes. The sandbox is a separate account at https://api.sandbox.hit-pay.com. PayNow and cards are listed with Sandbox Yes. FPX, DuitNow, Touch ’n Go, GCash, and QR Ph are No on the methods reference today. Guide: sandbox. Looking for the live dashboard login? Use your production HitPay dashboard, not the sandbox signup page.

How do webhooks work?

Register webhook URLs under Developers → Webhook Endpoints and subscribe to events such as payment_request.completed. Validate the Hitpay-Signature header with HMAC-SHA256 and your salt. The webhook field on create-payment-request is deprecated, so don’t rely on it. Guide: events / webhooks.

Can AI coding agents use HitPay?

Yes. Start from llms.txt, the MCP / Claude Code plugin, Agent Skills, and the HitPay CLI for local webhook forwarding.

Is there an official SDK?

HitPay publishes an official PHP SDK. Most languages integrate with plain HTTP against the OpenAPI spec (docs.hitpayapp.com/openapi.json). Samples on this page use cURL / Node / PHP without inventing unofficial packages.

HitPay vs Stripe or PayMongo for developers?

Choose HitPay when you need SEA local rails (PayNow, FPX, DuitNow, TnG, GCash, QR Ph) on one licensed SG/MY/PH stack, published no-monthly pricing, and agent tooling (MCP / llms.txt). Stripe may fit if you already run Stripe globally and only need the methods Stripe lists for your business country. PayMongo may fit PH-only teams optimising for PH list rates and PH test-mode depth. See /sg/hitpay-vs-stripe and the planned PH comparison page, and always verify rival fees on their sites.

Still have questions?

Contact our team.

Get in touch

Help center