ShopeePay API integration services (PromptPay / SPayLater / OpenFinance)

Deliverables checklist

• OpenAPI 3.1 / Swagger spec with example payloads for every endpoint we ship
• Protocol and auth flow report (OAuth 2.0, HMAC signing, token refresh, certificate pinning notes)
• Runnable source for login, balance, statement and SPayLater query APIs (Python and Node.js)
• Postman collection plus automated pytest / Jest suites against sandbox
• PDPA / Bank of Thailand compliance guidance, consent record templates, retention policy
• Optional hosted gateway: pay-per-call billing, no upfront fee

Engagement model

We offer two engagement tracks. Source-code delivery from $300 hands over runnable API source plus documentation, with payment after delivery upon satisfaction. Pay-per-call hosted API gives access to our managed ShopeePay endpoints with usage-based pricing and zero upfront. Most clients combine the two: prototype with our hosted endpoints, then take over the source for production.

Typical first delivery is 5 to 15 business days. Sandbox approvals from third-party processors (DOKU, Antom, Airwallex, iPay88, Paymentwall) may extend timelines, and we can escalate where existing relationships exist.

1. Cross-wallet finance dashboard

A regional retailer accepts ShopeePay, TrueMoney Wallet and Rabbit LINE Pay across 200+ stores. We expose /v1/shopeepay/statement and merge it with parallel TrueMoney and LINE Pay endpoints into a unified ledger keyed on PromptPay reference IDs. The CFO sees one Power BI view; reconciliation that took two days now runs in under five minutes.

2. SPayLater BNPL credit dashboard

A Thai e-commerce brand uses SPayLater for high-AOV electronics. Through the /v1/spaylater/installments endpoint we surface tenure (3, 6, 12 months), outstanding principal, next-due date and customer eligibility tier. Risk operates an early-warning rule: if > 1 missed installment, suppress further SPayLater offers in checkout.

3. Real-time PromptPay QR settlement

A Bangkok F&B chain replaces paper sales books with dynamic QR via ShopeePay's Merchant Presented Mode. Each generated QR carries an order_ref; ShopeePay posts a payment.completed webhook within seconds, our middleware emits a Soundbox-style audio confirmation and writes the row to MySQL — fully aligned with the Bangkok Bank PromptPay sponsorship rails.

4. Accounting & tax export

A SaaS client needs monthly Excel exports for VAT filing. We schedule a job that pulls statements via OAuth, redacts PII according to PDPA, and uploads encrypted CSVs to S3. The flow demonstrates how OpenFinance principles — explicit user consent, narrow scope, time-bound tokens — apply outside the EU PSD2 context.

5. Compliance & audit log

A licensed e-money operator must retain transaction logs for the Bank of Thailand. We build an append-only event store keyed on txn_id and signed hourly with a Merkle root, so any later reversal stays auditable. The same store doubles as evidence for AML / CFT screening required of payment licensees.

1. OAuth login & token refresh

POST /v1/shopeepay/oauth/token
Content-Type: application/x-www-form-urlencoded
X-Signature: hmac-sha256=<sig>

grant_type=authorization_code
&code=<auth_code>
&client_id=<partner_id>
&redirect_uri=https://example.com/cb

200 OK
{
  "access_token": "eyJhbGciOi...",
  "refresh_token": "rt_9f2c...",
  "expires_in": 3600,
  "scope": "wallet.read statement.read spaylater.read"
}

2. Statement query (paged, filterable)

POST /v1/shopeepay/statement
Authorization: Bearer <ACCESS_TOKEN>
X-Signature: hmac-sha256=<sig>
Content-Type: application/json

{
  "account_id": "u_8810233",
  "from_date": "2026-04-01",
  "to_date":   "2026-04-30",
  "channels":  ["WALLET", "PROMPTPAY", "SPAYLATER"],
  "page":      1,
  "page_size": 100
}

200 OK
{
  "items": [
    {
      "txn_id": "TX2026043011872",
      "amount": 459.00,
      "currency": "THB",
      "channel": "PROMPTPAY",
      "merchant": "STARBUCKS THONGLOR",
      "ref":      "ppr-7f1e9c",
      "created":  "2026-04-30T08:14:22+07:00"
    }
  ],
  "page": 1,
  "total": 4123
}

3. Dynamic QR & settlement webhook

POST /v1/shopeepay/qr/dynamic
{ "order_ref":"INV-9981","amount":129.50,"currency":"THB","ttl":600 }
=> { "qr_payload":"00020101...", "expires_at":"..." }

# Webhook (POST from ShopeePay → your server)
{
  "event": "payment.completed",
  "order_ref": "INV-9981",
  "txn_id": "TX2026050312033",
  "amount": 129.50,
  "spaylater": { "used": false, "tenure_months": null },
  "signature": "hmac-sha256=..."
}

# Always verify X-Signature with your shared secret
# before acknowledging with HTTP 200.

Regulatory framework

Every integration we ship in Thailand is mapped to two anchor regulations. First, the Bank of Thailand Payment Systems Act B.E. 2560 (2017), which classifies ShopeePay-style e-wallets as Designated Payment Services that must hold an E-Money license. Second, the Personal Data Protection Act B.E. 2562 (2019) — Thailand PDPA, which has been in full effect since 2022 and applies extraterritorially to anyone processing personal data of Thai users.

We also follow ShopeePay's published merchant integration rules: TLS 1.2 or 1.3, OAuth 2.0 for partner authentication, and HMAC signing for every API call. PSD2-style Open Banking concepts inform our consent and scope design, even though Thai law does not yet mandate them.

How we operate

• Authorized merchant credentials or explicit end-user consent only — never scraped sessions
• Data minimization: every endpoint declares the narrowest scope needed
• Signed audit logs of every API call, retained per BoT and PDPA timelines
• PII redaction (national ID, phone) on by default; opt-in to expose
• NDA, data-processing agreement, and DPIA templates included on request

About OpenFinance Lab

We are an independent technical studio specializing in mobile-app interface integration and authorized API delivery for fintech, e-commerce, travel, and OTT clients. Our team includes engineers who have shipped at banks, payment gateways, e-wallet operators, and protocol-analysis houses across Thailand, Singapore, Indonesia, Malaysia, and the Philippines.

• Mobile wallets, digital banking, BNPL, cross-border remittance
• Enterprise API gateways, security reviews, and threat modeling
• Custom Python / Node.js / Go SDKs and Postman test harnesses
• End-to-end pipeline: protocol analysis → build → validation → compliance
• Source-code delivery from $300 — runnable API source plus full documentation; pay after delivery upon satisfaction
• Pay-per-call hosted API — usage-based pricing, zero upfront cost

Contact

To request a quote, share a target app, or discuss compliance scope, open our contact page. We typically respond within one business day, in English, Thai, or Chinese.

Contact page

Engagement workflow

1. Scope confirmation: which ShopeePay flows are in scope (login, statement, PromptPay QR, SPayLater, webhook).
2. Protocol analysis & API design: 2–5 business days, complexity dependent.
3. Build & internal validation against sandbox: 3–8 business days.
4. Documentation, sample apps, and pytest / Jest test cases: 1–2 business days.
5. Typical first delivery: 5–15 business days; third-party processor approvals may extend the schedule.

FAQ

Which ShopeePay data and flows can you integrate?

How long does ShopeePay API integration delivery take?

How do you stay compliant with Thai PDPA and Bank of Thailand rules?

Do you support cross-wallet reconciliation across TrueMoney, LINE Pay and ShopeePay?