Claude Code

# LigdiCash integration

## Context

LigdiCash is a mobile money payment aggregator in West Africa.
API base URL: https://app.ligdicash.com

## Mandatory headers on every request

```
Apikey: {API_KEY}
Authorization: Bearer {AUTH_TOKEN}
Accept: application/json
Content-Type: application/json
```

## Data format

- Phone numbers: E.164 format without `+` or spaces — e.g. `22670000000`
- Amounts: integers (CFA francs have no sub-unit) — e.g. `5000`
- Currency: `XOF` exclusively
- API keys in examples: always `{API_KEY}` and `{AUTH_TOKEN}`, never real values

## Golden rule — transaction identification

The `token` returned at creation is different from the `token` received in the callback.
Never use that token to identify a transaction.

Always pass a merchant identifier in `custom_data` at creation:
```json
"custom_data": { "transaction_id": "ORD-2025-00042" }
```

In the callback, `custom_data` comes back as an array of objects. LigdiCash adds its own fields (`hash`, `logfile`). Extract with:
```javascript
const entry = custom_data.find(e => e.keyof_customdata === "transaction_id");
const transactionId = entry?.valueof_customdata;
```

## Hosted payin — pitfalls

- `customer` must stay `""` — otherwise LigdiCash filters the visible operators
- Never open the payment URL in an `<iframe>` — use the same tab, a new tab, a popup, or a native WebView
- Popup: open `about:blank` before the `await fetch`, then navigate once the URL is received

## Callback

- LigdiCash sends two POSTs: one `application/x-www-form-urlencoded` + one `application/json`. Deduplicate.
- Re-verify each callback by calling the `confirm` endpoint with the token stored at creation. Never trust the received payload.