ɃU Gateway

API reference

Same shape as Paystack: secret key on your server, public key in the browser, initialize, redirect, verify, webhook. Base URL https://buapp.vercel.app/api/v1/gateway

API keys

pk_live_… / pk_test_… — public. Widget and hosted checkout only.

sk_live_… / sk_test_… — secret. Your server only. Header Authorization: Bearer sk_…

Production issues live keys. Localhost issues test keys. The secret is shown once; rotate it from the Gateway dashboard if you lose it.

1. Initialize (secret key)

Your website's server starts the payment. ɃU returns authorization_url. Redirect the guest there. They pay on Paystack. ɃU mints the ticket.

curl -X POST https://buapp.vercel.app/api/v1/gateway/tickets/initialize \
  -H "Authorization: Bearer sk_live_xxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "guest@example.com",
    "event_id": "EVENT_UUID",
    "ticket_type": "vip",
    "quantity": 2,
    "callback_url": "https://yoursite.com/payment/callback",
    "metadata": { "buyer_name": "Ada", "phone": "08012345678" }
  }'

POST /tickets/initialize

Required: email and either event_id or ticket_tier_id.

Optional: ticket_type (e.g. vip), quantity, callback_url, metadata.buyer_name, metadata.phone.

Response: authorization_url, access_code, reference.

Repeat the same body with header Idempotency-Key to safely retry.

2. Verify

After the guest returns, or on your webhook, confirm with the secret key. Do not trust the browser.

curl https://buapp.vercel.app/api/v1/gateway/tickets/verify/BU_LIVE_REFERENCE \
  -H "Authorization: Bearer sk_live_xxxx"

GET /tickets/verify/:reference — data.status is success when tickets exist.

3. Webhooks

POST /webhooks with { "webhook_url": "https://yoursite.com/webhooks/bu" }

ɃU POSTs JSON { "event": "ticket.purchased", "data": { … } }

Header X-BU-Signature is HMAC-SHA256 of the raw body using your webhook_secret.

Events: ticket.purchased, ticket.checked_in, event.sold_out, payment.failed

Events

GET /events — your live organiser events and ticket type ids

GET /events/:event_id

GET /events/:event_id/stats

POST /events — create a live ɃU event (same fields as Organiser create)

Inline button (public key)

Like Paystack Inline. Paste on your page. The secret key stays on your server; this only uses pk_live_.

<script
  src="https://buapp.vercel.app/widget/bu-widget.js"
  data-public-key="pk_live_xxxx"
  data-event-id="EVENT_UUID"
  data-ticket-type="vip"
  data-button-text="Buy tickets">
</script>

Who can sell

Keys are tied to the ɃU organiser who registered them. They only sell that organiser's live events. Guests do not need a ɃU login. If their phone is already a ɃU ID, the ticket also appears in the ɃU app.