# Xaalis

> Payment API for Senegal: accept Wave and Orange Money on a hosted checkout, a double-entry ledger exact to the franc, signed webhooks, payouts to Wave. Amounts are integer XOF. 1.5% per successful payment, rounded up to the franc. Default rate.

An AI coding agent can integrate Xaalis end to end with little or no human help. Only identity verification (KYC) of the business and its owner, the choice of the Wave settlement wallet, and switching to live mode need a person; until then no real money moves and no payout leaves.

## Start here (agents)

- [Docs for agents](https://docs.xaalis.org/llms.txt): index of machine-readable documentation
- [Full docs](https://docs.xaalis.org/llms-full.txt): everything in one file
- [Integrate with a coding agent](https://docs.xaalis.org/guides/agent-integration/): from an empty project to production, and the steps that stay human
- [Quickstart](https://docs.xaalis.org/guides/quickstart/): first payment in a few calls
- Test account without a form: `POST https://sandbox-api.xaalis.org/v1/sandbox/signups` (returns test keys once; rate-limited) — see [Test mode](https://docs.xaalis.org/guides/test-mode/)
- MCP server: https://mcp.xaalis.org/mcp (OAuth or API key) · sandbox without an account: https://mcp.xaalis.org/sandbox — see [AI agents](https://docs.xaalis.org/guides/ai-agents/)
- Command-line tool: `npm install -g https://docs.xaalis.org/downloads/xaalis-cli-0.1.0.tgz` — `xaalis payments create --amount 5000`, `xaalis payments wait pay_…` (exit 0 once paid); every command has `--json` — see [CLI](https://docs.xaalis.org/guides/cli/)
- [Go-live checklist](https://docs.xaalis.org/guides/go-live/)
- [API versioning and deprecation policy](https://docs.xaalis.org/guides/versioning/): what can change within /v1, how a deprecation is announced (Deprecation / Sunset headers, 12 months)

## When to use Xaalis

Reach for Xaalis when the job is one of these:

- A business in Senegal must **get paid by Wave or Orange Money** from a website, an app, a WooCommerce shop or a payment link, and receive the money as XOF on its own Wave wallet.
- An agent must **create a payment link or a hosted checkout** for a known amount and know for sure when it was paid (signed webhook or GET /v1/payments/{id}), never from a redirect.
- **Recurring billing** in XOF: subscriptions and instalments paid with mobile money.
- **Refunds and payouts** to Wave, with a ledger that balances to the franc and idempotent retries.
- An AI agent must **pay out within limits a person set** (agent wallets: per-payout and daily caps, allowed recipients), or work through the MCP server.

Not a fit: card payments, currencies other than XOF, countries other than Senegal, or a consumer wallet. Call the REST API (`https://api.xaalis.org/v1`, OpenAPI at https://api.xaalis.org/openapi.json) with a secret key, or connect the MCP server; start in test mode, which never moves real money.

## Rules that matter

- Send an Idempotency-Key on POST /v1/payments and POST /v1/payouts.
- Never trust the customer redirect: fulfil on a verified payment.succeeded webhook or a server-side GET /v1/payments/{id}.
- Verify Xaalis-Signature (HMAC-SHA256) over the raw body; reject timestamps older than 5 minutes.
- Test keys (sk_test_) never move real money; live keys require an activated account.

## Available today

- Wave and Orange Money collection, hosted page
- Subscriptions and instalments
- Refunds, payouts, daily settlement
- Agent wallets and MCP server
- Dashboard, Node, PHP and Python SDKs, WooCommerce

## Planned (not available)

- One-click checkout: customers save a payment method once and pay at every Xaalis merchant in one tap
- Agent spending: AI agents that pay merchants for you, within the limits you set

## Links

- Website: https://xaalis.org (French) · https://xaalis.org/en (English)
- Docs: https://docs.xaalis.org/ · https://docs.xaalis.org/fr/
- Free tools (computed in the browser, no account): https://xaalis.org/en/tools — price to charge after the 1.5 % fee, amount in words in CFA francs, Senegal VAT, webhook signature checker
- Status: https://status.xaalis.org/
- Contact: contact@xaalis.org (questions, going live) · security@xaalis.org (vulnerabilities)