How do webhook signatures work?

Every webhook is signed with HMAC-SHA256 using your endpoint secret. The signature is in the ShegerPay-Signature header along with a timestamp. Verify before trusting the payload.

Frequently Asked Questions

Q: How much does ShegerPay cost?

Pricing is published at shegerpay.com/pricing. We offer a free tier for low-volume merchants and transparent per-verification pricing above that. No setup fees, no monthly minimums on the free tier.

Q: Is ShegerPay safe to integrate?

Yes. ShegerPay is non-custodial, uses TLS 1.3 everywhere, HMAC-SHA256 webhook signatures, and tier-1 cloud hosting. We never see payment instruments or card numbers.

General

What is ShegerPay?

ShegerPay is non-custodial payment-verification infrastructure for Ethiopian and international merchants. We confirm payments across 20+ rails — CBE, Telebirr, Awash, Dashen, BOA, Hibret, M-Pesa, PayPal, Wise, Payoneer, and major crypto networks — through a single API, SDK, or no-code plugin. We never hold customer funds.

Who is ShegerPay for?

E-commerce stores, SaaS founders, marketplaces, freelancers, NGOs, and any business accepting payments in Ethiopia or from the Ethiopian diaspora. Integration takes minutes for low-code use cases (WooCommerce plugin) and a few hours for full custom flows via the REST API or SDKs.

Where is ShegerPay based?

ShegerPay is headquartered in Addis Ababa, Ethiopia. Our infrastructure runs on tier-1 cloud (AWS / GCP) in the Africa region with multi-AZ failover.

Is it "ShegerPay", "Sheger Pay", or "Shegar Pay"?

The official name is ShegerPay — one word, capital S and P. "Sheger" (ሸገር) is the popular nickname for Addis Ababa, so the name literally means "Addis Pay". You'll see people write it as Sheger Pay, Shegar Pay, ShegarPay, or ሸገር ፔይ in Amharic — they all refer to this platform at shegerpay.com. If you searched one of those spellings and landed here, you're in the right place.

How is ShegerPay different from a payment gateway?

A traditional gateway routes the money and takes custody. ShegerPay verifies payments that have already settled on regulated rails — we are read-only infrastructure, like Plaid. This means lower fees, no licensing burden for merchants, and faster integration.

Pricing

How much does ShegerPay cost?

Pricing is published at https://shegerpay.com/pricing. We offer a free tier for low-volume merchants and transparent per-verification pricing above that. No setup fees, no monthly minimums on the free tier.

Are there hidden fees?

No. The price you see on the pricing page is the price you pay. We do not mark up the underlying rail fees and we do not take a percentage of the transaction value.

Is there a free trial?

Yes. Every new account starts with a sandbox key (sk_test_…) that works with unlimited test verifications, plus a free production tier that covers a meaningful volume of live verifications per month.

Do you offer enterprise pricing?

Yes. For high-volume merchants and platforms reselling ShegerPay verification, contact [email protected] for volume pricing and dedicated SLAs.

Security

Is ShegerPay safe to integrate?

Yes. ShegerPay is non-custodial — we never hold customer funds, and we never see payment instruments or card numbers. We use TLS 1.3 everywhere, HMAC-SHA256 webhook signatures, and tier-1 cloud hosting. See https://shegerpay.com/security for the full architecture.

Does ShegerPay store my customers' bank credentials?

Never. We only store transaction metadata: provider, transaction ID, amount, timestamp, merchant ID. We never see or store passwords, card numbers, or banking credentials.

How do I report a vulnerability?

Email [email protected]. We acknowledge within 24 hours, triage within 3 business days, and publish a CVE for confirmed high-severity issues. Full responsible-disclosure policy at https://shegerpay.com/security.

Is ShegerPay PCI-DSS certified?

ShegerPay is not in the cardholder data flow (we verify bank, mobile-money, and crypto payments — not card numbers), so we are out of PCI-DSS scope as a processor. We still follow PCI-aligned operational controls for defense in depth.

Integration

How long does integration take?

The WooCommerce plugin installs in under 5 minutes. A custom REST integration typically takes a few hours including testing. The SDKs ship with copy-paste examples for verification, payment links, webhooks, and refunds.

What languages do you support?

We ship 12 official SDKs: TypeScript, Python, PHP, Go, Ruby, Java, C#, Kotlin, Swift, Android, Dart, and WordPress. All are open source and on GitHub.

Do you have a sandbox?

Yes. Every account ships with a sandbox key (sk_test_…) and a demo key (sk_test_demo) you can use without signing up. The sandbox simulates every provider and webhook event.

Where is the API documentation?

At https://shegerpay.com/docs. Also available as a public OpenAPI 3.1 spec at https://shegerpay.com/openapi.json — feed it into Postman, Insomnia, or your favorite codegen tool.

Do you have an MCP server for AI coding tools?

Yes. Our MCP server is registered with modelcontextprotocol.io and works with Claude, Cursor, Cline, and Continue. AI assistants can verify payments and create payment links directly from your editor.

Providers

Which Ethiopian banks do you support?

Commercial Bank of Ethiopia (CBE), Awash, Dashen, Bank of Abyssinia (BOA), Hibret, Cooperative Bank of Oromia, and others. Full list at https://shegerpay.com/providers.

Do you support Telebirr?

Yes. Telebirr verification is real-time and ships in every SDK. We parse the Telebirr reference and confirm in under 2 seconds.

Do you support M-Pesa Ethiopia?

Yes. Added in v2.3 (February 2026).

Can I accept international payments?

Yes — via PayPal, Wise, and Payoneer (added in v2.2), plus stablecoin and major crypto rails for cross-border use cases.

Crypto

Which cryptocurrencies do you support?

USDT (TRC20, ERC20, BSC), BTC, ETH, SOL, TRX, and LTC. We also auto-verify deposits from Binance Pay, Bybit, OKX, and MEXC exchange wallets.

How fast are crypto confirmations?

Our reconciler auto-confirms most stablecoin payments within 30 seconds of broadcast. We wait for the network-recommended confirmation count for each chain.

Do you support stablecoins for cross-border invoicing?

Yes. USDT on TRC20 is the most common choice for Ethiopian merchants invoicing international clients — low fees, fast settlement, USD-pegged.

Licensing

Do I need a payment-services license to use ShegerPay?

No. Because ShegerPay does not transmit money, merchants integrating ShegerPay are not operating as money transmitters. The licensed bank or mobile-money provider handles the actual money movement. This is the same legal architecture as Plaid in the US. Not legal advice — consult Ethiopian counsel for your specific structure.

Does ShegerPay itself hold any license?

ShegerPay operates as non-custodial verification infrastructure, which under Ethiopian and international precedent does not require a money-transmitter license. We maintain compliance records and audit-ready logs for 7 years per NBE record-keeping norms.

What if my business model involves holding customer funds (marketplace, escrow)?

Marketplaces holding seller funds, escrow services, and multi-party split structures have additional regulatory considerations. Email [email protected] and we'll provide a written architecture summary for your lawyer at no cost.

Webhooks

How do webhooks work?

When a payment is verified, ShegerPay POSTs a signed JSON payload to your endpoint URL. Every delivery includes an ShegerPay-Signature header with an HMAC-SHA256 signature and a timestamp. Verify the signature before trusting the payload.

What happens if my server is down?

We retry up to 5 times with exponential backoff (1m, 5m, 30m, 2h, 12h). After the final attempt the event is parked in your dashboard for manual replay.

How do I verify webhook signatures?

Use HMAC-SHA256 with your endpoint secret over {timestamp}.{raw_body}, then compare with the signature in the header using a constant-time comparison. Code samples in Node, Python, and PHP at https://shegerpay.com/security.

How many webhook events are there?

Over 100 — covering verification, payment links, refunds, payouts, disputes, subscriptions, and account-level events. Full list at https://shegerpay.com/docs/webhooks.

SDKs

Are the SDKs open source?

Yes. All 12 SDKs are MIT-licensed and on GitHub at github.com/shegerpay. Issues and PRs welcome.

Which SDK should I use?

Pick the one that matches your stack. Server-side: TypeScript, Python, PHP, Go, Ruby, Java, C#, Kotlin. Mobile: Swift (iOS), Kotlin/Android, Dart (Flutter). CMS: WordPress plugin. CLI: npm install -g @shegerpay/cli.

How often are SDKs updated?

SDKs are versioned together. The current major version (v2.x) is updated for every new API feature, and we cut a release within 48 hours of any breaking change.

Is there a CLI tool?

Yes: npm install -g @shegerpay/cli. It supports verification, payment-link creation, webhook tunnel for local development, and log streaming.