Developers

Bwiser Tapless Checkout

Add Bwiser to a station website, kiosk, POS web view, or forecourt platform. Start simple with one line of JavaScript, then graduate to signed server-to-server APIs when you need deeper control.

Request Access Back Home

Choose your integration path

One-line checkout

Best for station websites, kiosk pages, or POS browser screens. Paste the script and Bwiser opens a secure checkout panel.

Signed partner API

Best for aggregators and native POS systems that need direct intent creation, authorization, redemption and reconciliation.

Station-scoped order

Every payment intent is tied to one approved station, so Johannesburg and Kroonstad can use the same POS reference without colliding.

Merchant queue

Station staff see incoming checkout requests on their merchant dashboard and process the correct request by reference, pump and amount.

One-line checkout

Use a public checkout key in the browser. Keep secret API credentials on your server only.

<script
  src="https://bwiser.co.za/js/bwiser-checkout.js"
  data-bwiser-public-key="bw_pk_live_xxxxx"
  data-bwiser-station="12"
  data-bwiser-reference="POS-10001"
  data-bwiser-amount="250.00"
  data-bwiser-pump="P3">
</script>

Production rule

Ask Bwiser to add your website or POS domain to the partner allowlist before going live. This prevents another site from reusing your public key.

Signed Partner API

Use this when your server needs to create, authorize, redeem and reconcile tapless payment intents directly.

https://bwiser.co.za/api/v1/partner/tapless

Authentication headers

X-Bwiser-Key your partner public key

X-Bwiser-Timestamp current unix timestamp

X-Bwiser-Signature HMAC_SHA256(timestamp + "." + raw_body, secret)

Credentials are issued by Bwiser

Each partner is mapped to approved stations and can only act within that assigned retail footprint.

Endpoints

GET /health

Confirm partner auth and available capabilities.

GET /stations

List the stations assigned to your partner account.

POST /intents

Create a tapless payment intent with station, reference, and voucher input.

GET /intents/{publicId}

Read the latest payment intent state and voucher payload.

POST /intents/{publicId}/authorize

Run voucher, geofence, and station checks before redemption.

POST /intents/{publicId}/redeem

Complete redemption and return the settled voucher result.

Quick start

1. Bwiser approves the station

A Bwiser admin links your partner account to the exact station or station group that may accept tapless payments.

2. Create an intent

Send station_id, external_reference, and one voucher identifier such as scan_input, code, or voucher_id.

3. Authorize the payment

Bwiser confirms the voucher is valid, belongs to the station, is not expired, and passes any active geofence rule.

4. Redeem and reconcile

Redeem the authorized intent and store the returned voucher payload as your source of truth for completion.

Example request

curl -X POST "https://bwiser.co.za/api/v1/partner/tapless/intents" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "X-Bwiser-Key: YOUR_PUBLIC_KEY" \
-H "X-Bwiser-Timestamp: 1713388800" \
-H "X-Bwiser-Signature: YOUR_HMAC_SIGNATURE" \
-d '{
  "station_id": 12,
  "external_reference": "agg-forecourt-10001",
  "voucher_id": 8451,
  "device_latitude": -26.2041,
  "device_longitude": 28.0473,
  "pump_number": "P3"
}'

Operational notes

Ordering at busy stations

Use a unique external_reference from the POS and include pump_number where possible. The merchant dashboard shows newest open requests first with reference, pump, amount and partner name.

Webhooks

Configure a webhook URL to receive checkout intent events. Verify the X-Bwiser-Signature header with your webhook secret before trusting the payload.

Browser safety

Only public checkout keys belong in JavaScript. Signed API secrets must stay on your backend and should be rotated if exposed.