Onboard Merchant

POST https://payonclick.in/ext/v1/aeps/merchants

Requires aeps Signed request Counts toward your 60 req/min

Body Params

Name	Type	Description
merchant_ref required	string	Your id for the outlet. 1–48 chars: letters, digits, hyphen, underscore. Unique per account
first_name required	string	Owner’s first name as on Aadhaar. Letters only
middle_name optional	string	Letters only
last_name required	string	Letters only; must differ from first_name
mobile required	string	Owner’s 10-digit mobile — linked to their Aadhaar (eKYC OTP goes here)
email optional	string	Owner’s email
pan required	string	Owner’s PAN, e.g. ABCDE1234F
aadhaar required	string	Owner’s 12-digit Aadhaar. Only the last 4 digits are stored
shop_name required	string	Outlet / business name
address_line1 required	string	Owner’s address, line 1
address_line2 required	string	Address, line 2 (locality / landmark)
city required	string	City
district optional	string	Defaults to city
state_code required	int	From GET /states
pincode required	string	6-digit PIN code
shop_address optional	string	Outlet address, if different. Also shop_city, shop_district, shop_state_code, shop_pincode
bank_account_number required	string	Owner’s settlement bank account (6–20 digits)
bank_ifsc required	string	IFSC, e.g. SBIN0001234
bank_name required	string	Bank name (special characters are removed)
bank_account_name required	string	Account holder name
gstin optional	string	15 characters, if registered
latitude required	number	Outlet GPS latitude
longitude required	number	Outlet GPS longitude
pan_image optional	string	Base64 JPEG/PNG of the PAN card, under 500 KB. Also aadhaar_image, shop_image

Responses

Status	Description
201 Created	Register one of your outlets as an AEPS merchant (step 1) — see the example on the right.
422 · not accepted	Alternate outcome for the same call — the second Response tab.
4xx / 5xx	`{ "success": false, "error": { "code": "…", "message": "…" } }` — every code is listed under Error Codes.

🔏

This call must be signed

POST carries an X-Signature header over POST\n/ext/v1/aeps/merchants\n{TIMESTAMP}\n{BODY_SHA256}. The samples on the right compute it for you; the rules are in Request Signing.

📘

Good to know

Onboarding is synchronous: 201 means the outlet is registered and next_step is EKYC. Sending the same merchant_ref again for a registered outlet returns it with duplicate: true and changes nothing. After ONBOARDING_FAILED, or when a later step answers REONBOARD_REQUIRED (the bank account could not be verified), fix the details and send POST /merchants again with the same merchant_ref. Use the owner’s own Aadhaar-linked mobile and own bank account: eKYC verifies both against Aadhaar.

API_KEY="poc_live_your_key_here" TS=$(date +%s) BODY='{ "merchant_ref": "OUTLET-1001", "first_name": "Ramesh", "last_name": "Kumar", "mobile": "9876543210", "email": "ramesh@example.com", "pan": "ABCDE1234F", "aadhaar": "234123412346", "shop_name": "Ramesh Telecom", "address_line1": "12 Main Road", "address_line2": "Near Bus Stand", "city": "Patna", "state_code": 4, "pincode": "800001", "bank_account_number": "12345678906789", "bank_ifsc": "SBIN0001234", "bank_name": "State Bank of India", "bank_account_name": "Ramesh Kumar", "latitude": 25.5941, "longitude": 85.1376 }' HASH=$(printf %s "$BODY" | openssl dgst -sha256 | awk '{print $NF}') SIG=$(printf '%s\n%s\n%s\n%s' 'POST' '/ext/v1/aeps/merchants' "$TS" "$HASH" \ | openssl dgst -sha256 -hmac "$API_KEY" | awk '{print $NF}') curl -X POST 'https://payonclick.in/ext/v1/aeps/merchants' \ -H "Authorization: Bearer $API_KEY" \ -H "X-Timestamp: $TS" \ -H "X-Signature: $SIG" \ -H 'Content-Type: application/json' \ -d "$BODY"

import hashlib, hmac, json, time, requests API_KEY = "poc_live_your_key_here" PATH = "/ext/v1/aeps/merchants" BODY = json.dumps({ "merchant_ref": "OUTLET-1001", "first_name": "Ramesh", "last_name": "Kumar", "mobile": "9876543210", "email": "ramesh@example.com", "pan": "ABCDE1234F", "aadhaar": "234123412346", "shop_name": "Ramesh Telecom", "address_line1": "12 Main Road", "address_line2": "Near Bus Stand", "city": "Patna", "state_code": 4, "pincode": "800001", "bank_account_number": "12345678906789", "bank_ifsc": "SBIN0001234", "bank_name": "State Bank of India", "bank_account_name": "Ramesh Kumar", "latitude": 25.5941, "longitude": 85.1376 }).encode() ts = str(int(time.time())) msg = f"POST\n{PATH}\n{ts}\n{hashlib.sha256(BODY).hexdigest()}" sig = hmac.new(API_KEY.encode(), msg.encode(), hashlib.sha256).hexdigest() r = requests.request( "POST", "https://payonclick.in" + PATH + "", data=BODY, headers={ "Authorization": f"Bearer {API_KEY}", "X-Timestamp": ts, "X-Signature": sig, "Content-Type": "application/json", }, timeout=90) print(r.json())

<?php $apiKey = 'poc_live_your_key_here'; $path = '/ext/v1/aeps/merchants'; $body = '{ "merchant_ref": "OUTLET-1001", "first_name": "Ramesh", "last_name": "Kumar", "mobile": "9876543210", "email": "ramesh@example.com", "pan": "ABCDE1234F", "aadhaar": "234123412346", "shop_name": "Ramesh Telecom", "address_line1": "12 Main Road", "address_line2": "Near Bus Stand", "city": "Patna", "state_code": 4, "pincode": "800001", "bank_account_number": "12345678906789", "bank_ifsc": "SBIN0001234", "bank_name": "State Bank of India", "bank_account_name": "Ramesh Kumar", "latitude": 25.5941, "longitude": 85.1376 }'; $ts = (string) time(); $msg = "POST\n{$path}\n{$ts}\n" . hash('sha256', $body); $sig = hash_hmac('sha256', $msg, $apiKey); $headers = [ "Authorization: Bearer {$apiKey}", "X-Timestamp: {$ts}", "X-Signature: {$sig}", 'Content-Type: application/json', ]; $ch = curl_init('https://payonclick.in' . $path . ''); curl_setopt_array($ch, [ CURLOPT_RETURNTRANSFER => true, CURLOPT_TIMEOUT => 90, CURLOPT_CUSTOMREQUEST => 'POST', CURLOPT_POSTFIELDS => $body, CURLOPT_HTTPHEADER => $headers, ]); echo curl_exec($ch);

import java.net.URI; import java.net.http.*; import java.nio.charset.StandardCharsets; import java.security.MessageDigest; import javax.crypto.Mac; import javax.crypto.spec.SecretKeySpec; public class PayonclickExample { static final String HOST = "https://payonclick.in"; static final String API_KEY = "poc_live_your_key_here"; public static void main(String[] args) throws Exception { String path = "/ext/v1/aeps/merchants"; String body = "{ \"merchant_ref\": \"OUTLET-1001\", \"first_name\": \"Ramesh\", \"last_name\": \"Kumar\", \"mobile\": \"9876543210\", \"email\": \"ramesh@example.com\", \"pan\": \"ABCDE1234F\", \"aadhaar\": \"234123412346\", \"shop_name\": \"Ramesh Telecom\", \"address_line1\": \"12 Main Road\", \"address_line2\": \"Near Bus Stand\", \"city\": \"Patna\", \"state_code\": 4, \"pincode\": \"800001\", \"bank_account_number\": \"12345678906789\", \"bank_ifsc\": \"SBIN0001234\", \"bank_name\": \"State Bank of India\", \"bank_account_name\": \"Ramesh Kumar\", \"latitude\": 25.5941, \"longitude\": 85.1376 }"; String ts = String.valueOf(System.currentTimeMillis() / 1000); HttpRequest.Builder req = HttpRequest.newBuilder(URI.create(HOST + path + "")) .timeout(java.time.Duration.ofSeconds(90)) .header("Authorization", "Bearer " + API_KEY) .header("X-Timestamp", ts); String hash = hex(MessageDigest.getInstance("SHA-256") .digest(body.getBytes(StandardCharsets.UTF_8))); String msg = "POST\n" + path + "\n" + ts + "\n" + hash; Mac mac = Mac.getInstance("HmacSHA256"); mac.init(new SecretKeySpec( API_KEY.getBytes(StandardCharsets.UTF_8), "HmacSHA256")); req.header("X-Signature", hex(mac.doFinal(msg.getBytes(StandardCharsets.UTF_8)))); req.header("Content-Type", "application/json") .method("POST", HttpRequest.BodyPublishers.ofString( body, StandardCharsets.UTF_8)); HttpResponse<String> res = HttpClient.newHttpClient() .send(req.build(), HttpResponse.BodyHandlers.ofString()); System.out.println(res.body()); } static String hex(byte[] bytes) { StringBuilder sb = new StringBuilder(); for (byte b : bytes) sb.append(String.format("%02x", b)); return sb.toString(); } }

{ "success": true, "data": { "merchant_ref": "OUTLET-1001", "merchant_code": "POCAP1001M27", "name": "Ramesh Kumar", "shop_name": "Ramesh Telecom", "mobile": "9876543210", "aadhaar": "XXXXXXXX2346", "bank_account": "XXXX6789", "bank_ifsc": "SBIN0001234", "status": "EKYC_PENDING", "status_message": null, "ekyc": { "status": "PENDING", "completed_at": null }, "bank_ekyc": { "status": "PENDING", "completed_at": null }, "otp_pending": null, "daily_auth": { "AEPS": { "done_today": false, "authenticated_at": null }, "AP": { "done_today": false, "authenticated_at": null } }, "next_step": "EKYC", "created_at": "2026-10-08T11:02:10", "updated_at": "2026-10-08T11:02:14", "duplicate": false } }

{ "success": false, "error": { "code": "ONBOARDING_FAILED", "message": "Invalid IFSC code", "merchant": { "merchant_ref": "OUTLET-1001", "status": "ONBOARDING_FAILED", "next_step": "ONBOARD" /* ... */ } } }