Every KODA endpoint, rendered live from the OpenAPI contract. Door 3 (API mode) — create intents, submit codes, receive HMAC-signed webhooks. Works from any website or app: WooCommerce, Flutter, native, Node, PHP.
This page renders the live spec from /v1/openapi.json — the same contract your SDK generators and Postman consume, here made human-readable. Open the raw JSON →
No code — Download the WooCommerce plugin → then in WordPress: Plugins → Add New → Upload Plugin and activate. In WooCommerce → Settings → Payments → KODA, click Connect with KODA — a scoped, revocable key and webhook are provisioned automatically (no secrets to paste). Prefer manual? You can still enter your API key + webhook secret by hand. Works with multivendor stores (Dokan / WCFM).
Base https://kodajnn.com/v1 Auth Authorization: Bearer sk_live_xxx (or) X-API-Key: sk_live_xxx Test use an sk_test_ key — same host, sandbox behaviour Keys KODA dashboard → Developers → Create key
Loading the live API spec…
KODA POSTs a JSON body with header x-koda-signature = HMAC-SHA256(raw_body, your_webhook_secret) (hex). Always verify before acting. On payment.verified, fulfil the order in metadata.order_id.
// Node
const sig = req.headers['x-koda-signature'];
const expected = crypto.createHmac('sha256', SECRET).update(rawBody).digest('hex');
if (!crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))) return res.sendStatus(401);
# PHP
$expected = hash_hmac('sha256', $raw, $secret);
if (!hash_equals($expected, $_SERVER['HTTP_X_KODA_SIGNATURE'])) http_response_code(401);
final res = await http.post(
Uri.parse('https://kodajnn.com/v1/intents'),
headers: {'Authorization': 'Bearer $apiKey', 'Content-Type': 'application/json'},
body: jsonEncode({'amount': 25000, 'currency': 'CDF',
'operators': ['orange_cd','mpesa_cd'],
'metadata': {'order_id': 'CMD-1042'}}),
);
final url = jsonDecode(res.body)['checkout_url']; // open in a WebView