Qora API

Accept Fonepay dynamic-QR payments that settle into your own bank account. One POST creates a payment and returns a scannable QR; a signed webhook tells you when it is paid.

How it works

You connect your own Fonepay merchant account to Qora once. After that a single API call mints a dynamic QR against that account, and Qora handles everything between the customer scanning it and your server hearing about it.

On your own Fonepay account the money never touches Qora: Fonepay settles each payment into the bank account registered on your merchant record, on Fonepay's own cycle, with nothing for us to hold or release. If you don't have a Fonepay account, Collect with Qora lets you take payments anyway — we collect on your behalf and hold the balance until you withdraw it. The API is identical either way.

Two ways to be paid. On your own Fonepay account, your customers' money moves between their bank and yours. On Collect with Qora, it is collected into Qora's account and held for you, under a signed agreement, until you withdraw it.

The lifecycle of a payment

Create. You POST an amount in paisa. Qora mints a QR on your Fonepay account and returns the payload.
Display. You render the payload as a QR code. The customer scans it with any Fonepay-enabled bank or wallet app.
Confirm. Qora watches the payment from the moment the QR exists, verifies it independently, and marks it succeeded. You do not have to watch anything.
Notify. Qora posts a signed payment.succeeded webhook to your endpoint.
Settle. Fonepay pays your bank directly. Qora is not involved.

Try it now

Paste your own secret key and take a payment from this page. It is the same POST /v1/payments call described below, run against your own Fonepay account — not a simulation, and the response you get back is the real one.

POST /v1/payments No key yet

Your secret key

Used for this one request and then forgotten — never saved in this browser, never stored on our servers. Yours is under Developers → API keys.

Amount · paisa

Reference · optional Your own order number. Comes back on the payment and the webhook.

curl

Response

Your key makes one request and is then forgotten. It is not saved in this browser and not stored on our servers. Everywhere else, keep secret keys on your server — Authentication explains why.

Base URL

https://qora.laayo.com.np/v1

Every endpoint is HTTPS-only and returns JSON. The API version is 2026-09-06; see the changelog for what has changed.

Conventions worth knowing up front

Convention	Detail
Amounts	Always an integer number of paisa. `25000` is रु 250.00. There are no decimals anywhere in the API.
IDs	Prefixed and opaque: `pay_…`, `evt_…`. Do not parse them; do store them.
Mode	Decided entirely by your key. `sk_test_…` sees only test data, `sk_live_…` only live data.
Times	ISO 8601 with offset, in Asia/Kathmandu (`+05:45`).
Errors	Always `{"error": {...}}` with a stable `code`. See Errors.

Start here

The quickstart takes a payment end to end in about ten minutes, using test keys that work the moment you sign up — no verification needed to build the integration.