Skip to main content
The Kori Merchant API lets your application collect payments from customers, disburse funds, run payouts and bulk payments, create payment links, and manage your team — all over mobile money (Orange Money, Wave, Moov). Everything documented here is reachable with a merchant API key, using exactly the permissions (“scopes”) you see in the API Keys screen of your Kori dashboard.
All amounts are in XOF (West African CFA franc), the currency the Mali mobile-money operators settle in. XOF has no minor unit, so 5000 means 5 000 francs — never cents. The currency field defaults to XOF and is the only value the API returns.Minimums differ by direction: 100 XOF to collect a payment, 1 000 XOF to send one (payouts, bulk pay, and /deposit). Below the floor the request is rejected with 400 and a message naming the minimum.

Quickstart

Make your first authenticated request in a few minutes.

Authentication

Exchange your API key + secret for a scoped Bearer token.

Scopes

Understand what each API key permission grants.

API Reference

Full endpoint reference with request/response schemas.

​
Base URL

All merchant endpoints are served under the /merchant/api path, e.g. https://api.kori.ml/merchant/api/balance.

​
How it works

1

Create an API key

In the dashboard, open API Keys and create a key. Choose the scopes it should carry (for example pay, balance, webhooks). You receive an API key (mk_...) and secret (ms_...).
2

Get a token

Call POST /merchant/api/auth with your key and secret to receive a short-lived Bearer token embedding your scopes.
3

Call the API

Send the token as Authorization: Bearer <token> on every request. Each endpoint checks for its required scope.
4

Receive webhooks

Register a webhook endpoint to be notified when payments settle, payouts complete, and more.

​
Response format

Every response uses the same envelope:
Errors set success: false with a human-readable message. See Errors.
Collections are asynchronous. POST /merchant/api/pay returns 202 with status: "pending" — the customer has only been prompted. Treat an order as paid only after the payment_received webhook. See Webhooks.