Features
Everything between your checkout and your provider
Veyqo takes over the parts of a payment integration that are the same every time, and makes the parts that differ between providers stop mattering.
Integration
Write the integration once
One request shape, one response shape, one set of statuses and one set of error codes — whichever provider ends up processing the payment.
Unified payments API
Create, verify and refund payments through a single versioned API. Provider choice is a field, not a code path.
Normalized statuses
Provider statuses never reach your code. "success", "successful" and "succeeded" all become one value with guarded transitions.
Idempotency built in
Send an Idempotency-Key and a retried request returns the original response instead of charging twice.
Deterministic provider selection
Name a provider per request, set a project default, or use the only active connection. Veyqo never guesses between several providers.
Operations
Debug the day it breaks
Most of the value in orchestration shows up when something goes wrong. These are the screens you will actually live in.
Event inspector
The provider payload and the normalized event, side by side, with the signature verification result.
Full delivery log
Every attempt: status, duration, request headers, request body, response body and the next scheduled retry.
Replay anything
Fix your handler and replay the event to every subscribed endpoint, without touching the provider dashboard.
Retries with backoff
Immediate, then 1m, 5m, 15m, 1h, 6h and 24h. Permanent failures stop retrying but stay inspectable.
Governance
Safe for a team to share
Payments are one of the few systems where the blast radius of a mistake is measured in money, so access control and separation are not optional extras.
Scoped API keys
Keys are bound to one project and one environment, carry explicit scopes, and are revocable instantly.
Encrypted credentials
Provider keys are encrypted at rest behind a vault interface that can move to a managed KMS without code changes.
Roles that mean something
Developers manage keys and webhooks but never see provider credentials. Enforced on the server, not just hidden in the UI.
Audit trail
Who connected which provider, who rotated which secret, who replayed which event — with actor, IP and timestamp.
One webhook handler
Delete the per-provider verification code
Paystack signs with HMAC-SHA512 over the raw body. Flutterwave compares a shared secret hash. Stripe signs a timestamped payload with SHA-256. You implement none of that — you verify Veyqo, once.
// One verification routine, whatever the provider was
const signature = req.headers['veyqo-signature'];
const timestamp = req.headers['veyqo-timestamp'];
const expected = crypto
.createHmac('sha256', process.env.VEYQO_WEBHOOK_SECRET)
.update(`${timestamp}.${rawBody}`)
.digest('hex');
if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature))) {
return res.status(401).end();
}
// Reject anything older than five minutes
if (Date.now() / 1000 - Number(timestamp) > 300) {
return res.status(401).end();
}
handle(JSON.parse(rawBody));Normalization
Three providers, one event
Whatever arrives, what reaches your endpoint is the same shape every time.