Temporary accounts
Create a bank account number that only works for a limited time, for example one number per order. Your customer transfers money to it, and you're notified when the payment arrives.
How it works
-
Create the account
Call the endpoint below with your customer's name, email and one ID number (BVN, NIN or CAC number).
-
Show it to your customer
Display the account number, bank name and account name from the response.
-
Your customer pays before it expires
The account stays open for 40 minutes unless you choose a different time.
-
You get notified
The payment is added to your balance and a webhook is sent to your server. See Payment notifications.
Late payments are returned
If a customer pays after the account has expired, Gafiapay sends the money back to them automatically.
Need a number that never expires?
Use a permanent virtual account instead.
Create a temporary account
POST /account/generate/temporary
Your business must be verified to use this endpoint. Sign the request like any other call; see Authentication.
What to send
name string required Your customer's name. It becomes the account name.
email string required Your customer's email.
bvn string one ID number Your customer's 11-digit BVN.
nin string one ID number Your customer's 11-digit NIN.
businessNumber string one ID number CAC registration number, for example
RC1234567, when the customer is a business.duration number optional Default 40 How many minutes the account stays open.
Send one ID number. If you send more than one, businessNumber is used first, then bvn, then nin. If you send none, your own business's verified ID is used. These are the same rules as permanent accounts.
What you get back
accountNumber string The 10-digit number your customer pays into.
bankName string The bank to show your customer.
accountName string The name on the account.
expiresAt string When the account stops accepting payments.
expiresInMinutes number How long the account is open for.
isTemporary boolean Always
true for these accounts.curl -X POST 'https://api.gafiapay.com/api/v1/external/account/generate/temporary' \
-H 'Content-Type: application/json' \
-H 'x-api-key: your_api_key' \
-H 'x-timestamp: 1678901234567' \
-H 'x-signature: generated_signature' \
-d '{
"name": "Jane Customer",
"email": "jane@example.com",
"nin": "12345678901",
"duration": 60
}'const crypto = require('crypto');
const body = JSON.stringify({
name: 'Jane Customer',
email: 'jane@example.com',
nin: '12345678901',
duration: 60
});
const timestamp = Date.now().toString();
const signature = crypto
.createHmac('sha256', process.env.GAFIAPAY_SECRET_KEY)
.update(body + timestamp)
.digest('hex');
const res = await fetch('https://api.gafiapay.com/api/v1/external/account/generate/temporary', {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'x-api-key': process.env.GAFIAPAY_API_KEY,
'x-timestamp': timestamp,
'x-signature': signature,
},
body, // send the exact string you signed
});
const data = await res.json();import hashlib, hmac, json, os, time, requests
body = json.dumps({
"name": "Jane Customer",
"email": "jane@example.com",
"nin": "12345678901",
"duration": 60
}, separators=(",", ":")) # compact, no spaces
timestamp = str(int(time.time() * 1000))
signature = hmac.new(
os.environ["GAFIAPAY_SECRET_KEY"].encode(),
(body + timestamp).encode(),
hashlib.sha256,
).hexdigest()
res = requests.post(
"https://api.gafiapay.com/api/v1/external/account/generate/temporary",
data=body, # data=, not json=, so the signed string is sent as is
headers={
"Content-Type": "application/json",
"x-api-key": os.environ["GAFIAPAY_API_KEY"],
"x-timestamp": timestamp,
"x-signature": signature,
},
)
data = res.json()<?php
$body = json_encode([
'name' => 'Jane Customer',
'email' => 'jane@example.com',
'nin' => '12345678901',
'duration' => 60
], JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
$timestamp = (string) round(microtime(true) * 1000);
$signature = hash_hmac('sha256', $body . $timestamp, getenv('GAFIAPAY_SECRET_KEY'));
$ch = curl_init('https://api.gafiapay.com/api/v1/external/account/generate/temporary');
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_CUSTOMREQUEST => 'POST',
CURLOPT_POSTFIELDS => $body,
CURLOPT_HTTPHEADER => [
'Content-Type: application/json',
'x-api-key: ' . getenv('GAFIAPAY_API_KEY'),
'x-timestamp: ' . $timestamp,
'x-signature: ' . $signature,
],
]);
$data = json_decode(curl_exec($ch), true);require 'net/http'
require 'openssl'
require 'json'
body = {
name: 'Jane Customer',
email: 'jane@example.com',
nin: '12345678901',
duration: 60
}.to_json
timestamp = (Time.now.to_f * 1000).to_i.to_s
signature = OpenSSL::HMAC.hexdigest('sha256', ENV['GAFIAPAY_SECRET_KEY'], body + timestamp)
uri = URI('https://api.gafiapay.com/api/v1/external/account/generate/temporary')
req = Net::HTTP::Post.new(uri)
req['Content-Type'] = 'application/json'
req['x-api-key'] = ENV['GAFIAPAY_API_KEY']
req['x-timestamp'] = timestamp
req['x-signature'] = signature
req.body = body
res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |http| http.request(req) }
data = JSON.parse(res.body)import java.net.URI;
import java.net.http.*;
import java.nio.charset.StandardCharsets;
import java.util.HexFormat;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
// Compact JSON, sent exactly as signed
String body = "{\"name\":\"Jane Customer\",\"email\":\"jane@example.com\",\"nin\":\"12345678901\",\"duration\":60}";
String timestamp = String.valueOf(System.currentTimeMillis());
Mac mac = Mac.getInstance("HmacSHA256");
mac.init(new SecretKeySpec(System.getenv("GAFIAPAY_SECRET_KEY").getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
String signature = HexFormat.of().formatHex(mac.doFinal((body + timestamp).getBytes(StandardCharsets.UTF_8)));
HttpRequest request = HttpRequest.newBuilder()
.uri(URI.create("https://api.gafiapay.com/api/v1/external/account/generate/temporary"))
.header("Content-Type", "application/json")
.header("x-api-key", System.getenv("GAFIAPAY_API_KEY"))
.header("x-timestamp", timestamp)
.header("x-signature", signature)
.POST(HttpRequest.BodyPublishers.ofString(body))
.build();
HttpResponse<String> response = HttpClient.newHttpClient()
.send(request, HttpResponse.BodyHandlers.ofString()); Response
{
"status": "success",
"data": {
"accountNumber": "1234567890",
"accountName": "Jane Customer",
"bankName": "Palmpay",
"isTemporary": true,
"expiresAt": "2024-01-01T00:40:00.000Z",
"expiresInMinutes": 60
}
}