Changelog

2026-09-29

• API version 2026-09-29. Amounts are decimal strings. TZS uses exponent 2.
• Collections, payouts, bulk payouts, settlements, and signed webhooks.
• Cookie sessions use a double-submit CSRF token. MFA is available at sign-in.
• Mobile-money collections from 500.00 TZS through 3,000,000.00 TZS. Customers pay with M-Pesa, Airtel Money, Mixx by Yas, or Halopesa.
• Idempotency keys are kept for 72 hours. The same key and the same body return the original object.
• Webhook deliveries are HMAC-signed. A timestamp more than five minutes off is rejected. Retries keep the same event id for 24 hours.
• A payout reserves the amount and the fee together. A failed payout releases that reservation.

2026-10-23

• Documentation is published at docs.afripei.co.tz. Collections and disbursements are described together on the Payments page.

How to read a change

Amounts stay decimal strings. A new field on an object should be ignored by a reader that does not know it. A create response is still not proof that a customer paid. Fulfill on payment.success. Pay out only against available balance.