Z-Pay Swift

Z-Pay Swift API & Service Links

Clean public links for user services, tracking, partner access, and app setup. Internal operations and secret values are intentionally hidden.

Developer View JSON

Security-first docs

No passwords, PINs, tokens, hashes, private keys, bot tokens, SMS keys, or server paths are shown here.

Main Links

User Panel

Customer dashboard, wallet, topup, send money, bundle, and history.

https://zpayswift.com/user

Track Request

Open a token-based request tracking link.

https://zpayswift.com/track

Download APK

Download the Android app when available.

https://zpayswift.com/download-apk

Apply as Partner

Apply for partner access through the public partner form.

https://zpayswift.com/apply-subadmin

API Base

Clean public API base for app integrations.

https://zpayswift.com/api

Public Tracking

Tracking links are token-based. Paste a valid token or Z-Pay Swift tracking link on the public tracking page.

Receipt Page

https://zpayswift.com/track/TRACKING_TOKEN

API Base

https://zpayswift.com/api

Services

Login

Secure OTP/session based login for users.

/user

Register

Customer registration and OTP verification.

/user

Dashboard

Wallet balance, request summaries, and quick services.

/user

Topup

Create and track mobile topup requests.

/user

bKash/Nagad Send Money

Create MFS send money requests and track status with receipt links.

/user

Bundle

Browse and request available bundle offers.

/user

History

View current and previous request history where available.

/user

Tracking

Open token-based receipt/tracking links.

/track

Partner Apply

Apply for partner access without sharing any secret key.

/apply-subadmin

App / Developer Access

Developer and app access requires valid credentials. Secret values are never displayed on this page.

X-APP-KEY

Required by app endpoints where configured.

Value: Hidden

X-SESSION-TOKEN

User session token where applicable.

Value: Hidden

Authorization: Bearer

Bearer session token where supported.

Value: Hidden

X-API-KEY

Partner public API integration key.

Value: Hidden

X-WORKER-KEY

Worker app access only.

Value: Hidden

Security Notice

Password, PIN, token, hash, private keys, bot tokens, SMS keys, and Firebase credentials are never shown here.
Internal endpoints are protected by app keys, sessions, roles, worker keys, API keys, or webhook secrets.
Public receipt pages require a non-guessable tracking token.

User APIs

Method	Route Name	Access	Description
POST	`user.login.start`	Protected app access	Start user login.
POST	`user.login.verify`	Protected app access	Verify login and create a session.
POST	`user.register.start`	Protected app access	Start registration.
POST	`user.register.confirm`	Protected app access	Confirm registration.
GET/POST	`user.dashboard`	Protected user session	User dashboard actions.
POST	`topup.create`	Protected user session	Create a topup request.
POST	`send_money.create`	Protected user session	Create a bKash/Nagad send money request.
GET	`request.tracking`	Public token	Open public tracking page.

Subadmin Public APIs

Method	Route Name	Access	Description
POST	`partner.topup.create`	Protected API key	Create topup request.
GET	`partner.bundle.offers`	Protected API key	List available bundle offers.
POST	`partner.bundle.create`	Protected API key	Create bundle request.

Worker App

Method	Route Name	Access	Description
POST	`worker.heartbeat`	Protected worker key	Worker heartbeat.
POST	`worker.claim`	Protected worker key	Claim pending topup.
POST	`worker.result`	Protected worker key	Submit topup result.

Telegram Webhook

Method	Route Name	Access	Description
POST	`telegram.webhook`	Protected webhook secret	Unified Telegram webhook route.
POST	`telegram.bundle_callback`	Protected webhook secret	Bundle callback route.
POST	`telegram.mfs_callback`	Protected webhook secret	MFS callback route.
POST	`telegram.topup_callback`	Protected webhook secret	Topup callback route.