Sell data bundles from your own website.

1. 1Sign in and open Dashboard → API. Approved resellers have access straight away; other accounts send a short request and StevLink enables it.
2. 2Create a test key (sk_test_…). It uses a virtual GH₵ 1,000 sandbox balance: nothing is charged or delivered.
3. 3Call GET /v1/packages to see bundles at your price, then POST /v1/orders with a package id and phone number.
4. 4Add a webhook endpoint to hear when orders are delivered, then switch to a live key. Keep keys on your server only.

curl https://stevlink.com/api/v1/balance \
  -H "Authorization: Bearer $STEVLINK_API_KEY"

Send your key in the Authorization header of every request: Authorization: Bearer sk_live_…. Requests without a valid key get 401.

• Live and test keys. sk_live_ keys spend your wallet and deliver real bundles. sk_test_ keys use the sandbox.
• Permissions. read covers balance, packages and orders. orders is needed to place orders. A key without the permission gets insufficient_scope.
• IP allowlist. Optionally limit a key to your server's IP addresses or ranges. Other IPs get ip_not_allowed.
• Shown once. StevLink stores only a fingerprint of each key. If you lose a key, rotate it.
• Rotation. Rotating gives you a new key with the same settings. Choose whether the old key stops now, in 1 hour or in 24 hours.

Never put an API key in browser JavaScript, a mobile app or a public repository. Call StevLink from your server and keep the key in an environment variable.

Test keys behave like live keys (same validation, prices, errors, idempotency and webhooks) but never contact the network or touch your wallet. Each account has a GH₵ 1,000 sandbox balance you can reset from the dashboard. Test orders have references starting SLT- and livemode: false.

/account returns your name, pricing tier and balance. /balance returns just the balance, in pesewas (GH₵ 1 = 100 pesewas).

curl https://stevlink.com/api/v1/balance \
  -H "Authorization: Bearer $STEVLINK_API_KEY"

{
  "object": "balance",
  "available_pesewas": 125050,
  "currency": "GHS",
  "livemode": true,
  "request_id": "req_2c9a7f0b5e1d4a6c8b3e9f10"
}

Bundles you can order right now, at your price: approved resellers see reseller prices. Out-of-stock bundles are left out. Filter with ?network=mtn (mtn, mtn-express, telecel, at).

curl https://stevlink.com/api/v1/packages?network=mtn \
  -H "Authorization: Bearer $STEVLINK_API_KEY"

{
  "object": "list",
  "data": [
    {
      "object": "package",
      "id": "0f6f1f2e-1111-4222-8333-444455556666",
      "name": "1 GB",
      "network": "MTN",
      "network_code": "mtn",
      "data_mb": 1000,
      "validity_days": 90,
      "price_pesewas": 450,
      "currency": "GHS"
    }
  ],
  "networks": [
    {
      "code": "mtn",
      "name": "MTN"
    }
  ],
  "livemode": true,
  "request_id": "req_…"
}

Buys one bundle. The price is taken from your wallet straight away and the order is sent to the network. The response is 201 with the order; a repeat of the same request (same Idempotency-Key) returns 200 with Idempotent-Replayed: true and the original order.

curl https://stevlink.com/api/v1/orders \
  -H "Authorization: Bearer $STEVLINK_API_KEY" \
  -H "Idempotency-Key: 0b7c6a52-6f0e-4d0f-9d44-1c1e2c0f7a91" \
  -H "Content-Type: application/json" \
  -d '{"package_id":"0f6f1f2e-1111-4222-8333-444455556666","recipient":"0241234567","reference":"INV-1001"}'

{
  "object": "order",
  "id": "7d0f8f4e-2b1a-4c55-9a51-3f7a1c2d9b10",
  "reference": "SL-5d8e2c51-0c3e-4a4f-9e07-8b6f0b6a1e22",
  "client_reference": "INV-1001",
  "livemode": true,
  "status": "processing",
  "provider_status": "PLACED",
  "delivered": false,
  "refunded": false,
  "recipient": "+233241234567",
  "amount_pesewas": 450,
  "currency": "GHS",
  "package": {
    "id": "0f6f1f2e-1111-4222-8333-444455556666",
    "name": "1 GB",
    "network": "MTN",
    "network_code": "mtn",
    "data_mb": 1000,
    "validity_days": 90
  },
  "provider_status_at": "2026-10-23T09:15:02.118Z",
  "created_at": "2026-10-23T09:15:00.522Z",
  "updated_at": "2026-10-23T09:15:02.118Z",
  "request_id": "req_6f1c0a9e2b7d4c3a8e5f1d20"
}

If the network provider refuses an order outright, StevLink refunds your wallet automatically and the order comes back with status: "refunded".

Fetch one order by its id or StevLink reference. Live keys see live orders; test keys see sandbox orders.

curl https://stevlink.com/api/v1/orders/SL-5d8e2c51-0c3e-4a4f-9e07-8b6f0b6a1e22 \
  -H "Authorization: Bearer $STEVLINK_API_KEY"

Orders placed through the API, newest first. When has_more is true, pass next_cursor as cursor to get the next page. Cursors stay correct while new orders arrive.

curl https://stevlink.com/api/v1/orders?provider_status=DELIVERED&limit=50 \
  -H "Authorization: Bearer $STEVLINK_API_KEY"

{
  "object": "list",
  "data": [
    "…orders…"
  ],
  "has_more": true,
  "next_cursor": "WyIyMDI2LTEwLTIzVDA5OjE1OjAwLjUyMloiLCI3ZDBm…",
  "request_id": "req_…"
}

Register MTN numbers for AFA for your own customers. Each registration is paid from your wallet at your AFA price; approved resellers pay the reseller AFA price. Charge your customers whatever you like on your side. AFA needs a live key: test keys can't create registrations.

Whether AFA is open right now and what one registration costs you (price_pesewas).

curl https://stevlink.com/api/v1/afa/registrations \
  -H "Authorization: Bearer $STEVLINK_API_KEY" \
  -H "Idempotency-Key: 6a52f0e4-0b7c-4d0f-9d44-1c1e2c0f7a91" \
  -H "Content-Type: application/json" \
  -d '{"full_name":"Esi Boateng","phone":"0241234567","id_type":"ghana_card","id_number":"GHA-123456789-0","location":"Madina, Accra","date_of_birth":"1994-05-12","occupation":"Trader","reference":"CUST-2201"}'

{
  "object": "afa_registration",
  "id": "3c2b1a90-5d4e-4f6a-8b7c-1d2e3f4a5b6c",
  "reference": "AFA-3F9C21D07A",
  "client_reference": "CUST-2201",
  "status": "pending",
  "status_detail": null,
  "full_name": "Esi Boateng",
  "phone": "+233241234567",
  "id_type": "ghana_card",
  "id_number": "GHA-123456789-0",
  "location": "Madina, Accra",
  "date_of_birth": "1994-05-12",
  "occupation": "Trader",
  "amount_pesewas": 1200,
  "amount": "12.00",
  "currency": "GHS",
  "note": null,
  "refunded": false,
  "created_at": "2026-10-27T09:00:00.000Z",
  "updated_at": "2026-10-27T09:00:00.000Z",
  "request_id": "req_2a7d4c3a8e5f1d206f1c0a9e"
}

By id, StevLink reference or your own reference. status is pending, registering, registered or rejected; status_detail is the latest update from the network's AFA service, word for word. A rejected registration is refunded to your wallet (refunded: true) with the reason in note.

Newest first. Filter with status; page with limit (1–100) and offset. The response includes total.

Every order has two statuses. provider_status is the network provider's own status, passed on exactly as reported (or null until it reports). status is StevLink's record of the money: pending, processing, successful, failed or refunded.

Only treat an order as delivered when delivered is true, which happens only when provider_status is DELIVERED or VERIFIED. Never decide delivery from status alone.

Networks drop connections. If you do not get a response to POST /v1/orders, send exactly the same request again with the same Idempotency-Key. You get the original order back and are never charged twice.

• Create the key when you create the order in your own system and store it with the order.
• Reusing a key with a different package, recipient or reference returns 409 idempotency_key_reused.
• Requests that fail validation (for example insufficient_balance) create nothing, so the same key can be used again once the problem is fixed.

Errors always have the same shape and a stable code to branch on. The message is written for people and may change. Quote the request_id (also in the X-Request-Id header) when you contact support.

{
  "error": {
    "code": "insufficient_balance",
    "message": "Your StevLink wallet balance is too low for this bundle. No order was created.",
    "request_id": "req_9d2e4b1a7c3f4e8a9b0c6d15"
  }
}

Each key may make 60 requests a minute by default (StevLink can raise this for busy integrations). Every response tells you where you stand:

Over the limit you get 429 rate_limited. Wait for Retry-After seconds, then retry; for orders, retry with the same Idempotency-Key.

Add an HTTPS endpoint in Dashboard → API (one for live, one for test). StevLink POSTs an event when an API order is created and every time its status or provider_status changes. Use Send test event to check your endpoint.

{
  "id": "evt_3b1f0c9d2e8a4f7b9c6d1e2f3a4b5c6d",
  "object": "event",
  "type": "order.updated",
  "api_version": "2026-10-23",
  "livemode": true,
  "created_at": "2026-10-23T09:16:41.007Z",
  "data": {
    "object": {
      "object": "order",
      "id": "7d0f8f4e-2b1a-4c55-9a51-3f7a1c2d9b10",
      "reference": "SL-5d8e2c51-0c3e-4a4f-9e07-8b6f0b6a1e22",
      "client_reference": "INV-1001",
      "livemode": true,
      "status": "successful",
      "provider_status": "DELIVERED",
      "delivered": true,
      "refunded": false,
      "recipient": "+233241234567",
      "amount_pesewas": 450,
      "currency": "GHS",
      "package": {
        "id": "0f6f1f2e-1111-4222-8333-444455556666",
        "name": "1 GB",
        "network": "MTN",
        "network_code": "mtn",
        "data_mb": 1000,
        "validity_days": 90
      },
      "provider_status_at": "2026-10-23T09:15:02.118Z",
      "created_at": "2026-10-23T09:15:00.522Z",
      "updated_at": "2026-10-23T09:15:02.118Z"
    },
    "previous_attributes": {
      "status": "processing",
      "provider_status": "PLACED"
    }
  }
}

Verify every delivery

Each request carries StevLink-Signature: t=<unix time>,v1=<signature>. The signature is an HMAC-SHA256 of <t>.<raw body> with your endpoint's signing secret (whsec_…). Reject requests whose signature does not match or whose timestamp is more than 5 minutes old. StevLink-Event-Id, StevLink-Event-Type and StevLink-Delivery-Attempt are sent too.

import crypto from "node:crypto";
import express from "express";

const app = express();
const secret = process.env.STEVLINK_WEBHOOK_SECRET; // whsec_...

// Use the RAW body: re-serialised JSON will not match the signature.
app.post("/stevlink/webhook", express.raw({ type: "application/json" }), (req, res) => {
  const header = req.get("StevLink-Signature") ?? "";
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const timestamp = Number(parts.t);
  const expected = crypto.createHmac("sha256", secret).update(`${timestamp}.${req.body}`).digest("hex");
  const valid = parts.v1 && parts.v1.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1));
  if (!valid || Math.abs(Date.now() / 1000 - timestamp) > 300) return res.sendStatus(400);

  const event = JSON.parse(req.body);
  // Ignore duplicates: store event.id and skip ids you have seen.
  if (event.type === "order.updated" && event.data.object.delivered) {
    // mark your order as delivered
  }
  res.sendStatus(200); // answer quickly; do slow work afterwards
});

Retries

Answer with any 2xx within 10 seconds. Otherwise StevLink retries after 1 minute, 5 minutes, 30 minutes, 2 hours, 6 hours, 12 hours and 24 hours (8 attempts in total). Redirects are not followed. Events can arrive more than once or out of order: use the event id to skip duplicates and the order's updated_at to ignore older updates. The dashboard shows every delivery and lets you retry a failed one.

Changes inside v1 only add fields, endpoints or error codes, so build your integration to ignore fields it does not know. Anything that would break an integration will come as v2, announced in advance.