Documentation

Every request needs an API key created from your dashboard. Send it as a bearer token:

Authorization: Bearer mela_live_xxxxxxxxxxxxxxxxxxxx

Keys have a configurable daily request limit. Exceeding it returns HTTP 429.

Verify a receipt by its transaction reference.

POST https://verifypayment.tec.et/api/v1/verify
Content-Type: application/json
Authorization: Bearer mela_live_...

{
  "bank": "cbe",              // required, see /banks for codes
  "reference": "FT24123ABCDE",// required
  "account_suffix": "12345",  // required for banks that need it (see /banks)
  "phone": "0911223344",      // required for banks that need it
  "expected_amount": 1500     // optional — flags a mismatch, doesn't hard-fail
}

Response on success (HTTP 200):

{
  "verified": true,
  "bank": "cbe",
  "reference": "FT24123ABCDE",
  "receipt": {
    "payer_name": "Abebe Kebede",
    "receiver_name": "Kaleab Store",
    "amount": 1500,
    "currency": "ETB",
    "date": "2026-08-10"
  },
  "amount_matches": true
}

Response on failure (HTTP 404/400/429):

{
  "verified": false,
  "bank": "cbe",
  "reference": "FT24123ABCDE",
  "error": "No receipt found for this reference",
  "error_code": "not_found"
}

Possible error_code values: unknown_bank, invalid_reference, not_found, bank_disabled, relay_not_configured, upstream_error, parse_error.

Verify from a receipt screenshot instead of typing the reference. Mela first tries to decode a QR code in the image; if there isn't one, it falls back to OCR.

POST https://verifypayment.tec.et/api/v1/verify/image
Content-Type: multipart/form-data
Authorization: Bearer mela_live_...

image: <file>              // required
bank: cbe                  // optional — helps when OCR/QR can't tell which bank
expected_amount: 1500      // optional

The response is the same shape as /verify, plus a `detected` object showing what was read from the image.

No authentication required. Lists every bank Mela currently supports and their requirements.

curl https://verifypayment.tec.et/api/v1/banks

Each API key has a daily request limit set when it's created (default 2,000/day). Requests over the limit get HTTP 429. Revoked keys get HTTP 401 immediately.