Recharge, status and balance — over plain JSON.

Required header

Service codes vary by account — 64 is standard mobile recharge. The full list for your account is shown in the dashboard.

Body parameters

Response

// accepted
{"success": true, "status": 1, "message": "Flexiload-Request Submit Successfully"}

// rejected
{"success": false, "status": 2, "message": "Not User"}

Example

<?php
$url  = 'https://flexiloadapi.com/sendapi/request';

$post = [
    'user'     => '01743739873',
    'key'      => 'xxxxxxxxxxxxxxxx',
    'number'   => '01743739873',
    'amount'   => '10',
    'service'  => '64',
    'type'     => '1',
    'operator' => 'GP',
    // your own reference — keep it against your order
    'id'       => 'BD' . date('dmyHis') . mt_rand(100, 999),
];

$ch = curl_init($url);
curl_setopt_array($ch, [
    CURLOPT_HTTPHEADER     => ['band-key: flexiloadapi.com'],
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => $post,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT        => 30,
]);

$res = json_decode(curl_exec($ch), true);
curl_close($ch);

if (!empty($res['success'])) {
    // accepted — store $post['id'] and wait for the webhook
}

// Node 18+, no dependencies
const body = new URLSearchParams({
  user:     '01743739873',
  key:      'xxxxxxxxxxxxxxxx',
  number:   '01743739873',
  amount:   '10',
  service:  '64',
  type:     '1',
  operator: 'GP',
  id:       'BD' + Date.now()
});

const res = await fetch('https://flexiloadapi.com/sendapi/request', {
  method:  'POST',
  headers: { 'band-key': 'flexiloadapi.com' },
  body
});

const data = await res.json();
console.log(data);

import requests, time

r = requests.post(
    'https://flexiloadapi.com/sendapi/request',
    headers={'band-key': 'flexiloadapi.com'},
    data={
        'user':     '01743739873',
        'key':      'xxxxxxxxxxxxxxxx',
        'number':   '01743739873',
        'amount':   '10',
        'service':  '64',
        'type':     '1',
        'operator': 'GP',
        'id':       'BD' + str(int(time.time() * 1000)),
    },
    timeout=30,
)
print(r.json())

curl -X POST 'https://flexiloadapi.com/sendapi/request' \
  -H 'band-key: flexiloadapi.com' \
  -d 'user=01743739873' \
  -d 'key=xxxxxxxxxxxxxxxx' \
  -d 'number=01743739873' \
  -d 'amount=10' \
  -d 'service=64' \
  -d 'type=1' \
  -d 'operator=GP' \
  -d 'id=BD030823122153128'

Body parameters

Response

{
  "posotion":    1,
  "trxid":       "BD030823122153128",
  "lastbalance": "102",
  "status":      "1"
}

status: 0 pending · 1 success · 2 failed · 3 cancelled · 4 processing · 5 waiting. The key is spelled posotion — that is not a typo in this page, it is the field name the API returns.

Body parameters

Response

{"success": true, "status": 1, "balance": "102"}

Example

curl -X POST 'https://flexiloadapi.com/sendapi/balance' \
  -H 'band-key: flexiloadapi.com' \
  -d 'user=01743739873' \
  -d 'key=xxxxxxxxxxxxxxxx'

• Open API Settings in your dashboard The same page where your API key and whitelist live.
• Enter your callback URL Must be https:// and reachable from the public internet. Private or internal addresses are rejected.
• Choose which events you want Successful, failed, cancelled — any combination.
• Copy your signing secret Generated for you. Keep it server-side, never in front-end code.
• Press Send a test delivery Fires a ping event at your endpoint so you can confirm it answers before relying on it.

Headers we send

Body

{
  "event":          "transaction.success",
  "id":             920184,
  "request_id":     "BD030823122153128",
  "transaction_id": "TRX8891042",
  "number":         "01743739873",
  "amount":         100.00,
  "cost":           98.40,
  "service":        "64",
  "operator":       "GP",
  "pcode":          "017",
  "type":           "1",
  "status":         1,
  "status_text":    "success",
  "sender_no":      null,
  "remark":         "",
  "requested_at":   "2026-08-04 13:20:11",
  "settled_at":     "2026-08-04 13:20:48",
  "sent_at":        "2026-08-04T13:20:49+06:00"
}

Compute HMAC-SHA256 over the raw request body using your secret, and compare it with the header. Use a timing-safe comparison — hash_equals, crypto.timingSafeEqual, hmac.compare_digest — not ==.

Read the body before any framework parses it. Re-encoding parsed JSON changes the bytes and the signature will never match.

<?php
$secret = 'your_signing_secret';

// the RAW body — not $_POST, not a re-encoded array
$body = file_get_contents('php://input');
$sent = $_SERVER['HTTP_X_MITLOAD_SIGNATURE'] ?? '';

$mine = 'sha256=' . hash_hmac('sha256', $body, $secret);

if (!hash_equals($mine, $sent)) {
    http_response_code(401);
    exit('bad signature');
}

$e = json_decode($body, true);

// idempotent: ignore an id you have already settled
if (order_already_settled($e['request_id'])) {
    http_response_code(200);
    exit('ok');
}

if ($e['status'] == 1) {
    mark_delivered($e['request_id'], $e['amount']);
} else {
    refund_customer($e['request_id']);
}

http_response_code(200);
echo 'ok';

const express = require('express');
const crypto  = require('crypto');
const app = express();

const SECRET = process.env.MITLOAD_SECRET;

// express.raw, NOT express.json — we need the exact bytes
app.post('/mitload/callback',
  express.raw({ type: 'application/json' }),
  (req, res) => {

    const mine = 'sha256=' +
      crypto.createHmac('sha256', SECRET).update(req.body).digest('hex');
    const sent = req.get('X-MITLoad-Signature') || '';

    const a = Buffer.from(mine), b = Buffer.from(sent);
    if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
      return res.status(401).send('bad signature');
    }

    const e = JSON.parse(req.body.toString());

    // answer fast, do the slow work afterwards
    res.status(200).send('ok');

    settleOrder(e.request_id, e.status, e.amount).catch(console.error);
});

import hmac, hashlib, os
from flask import Flask, request, abort

app    = Flask(__name__)
SECRET = os.environ['MITLOAD_SECRET'].encode()

@app.route('/mitload/callback', methods=['POST'])
def callback():
    body = request.get_data()          # raw bytes
    sent = request.headers.get('X-MITLoad-Signature', '')
    mine = 'sha256=' + hmac.new(SECRET, body, hashlib.sha256).hexdigest()

    if not hmac.compare_digest(mine, sent):
        abort(401)

    e = request.get_json()

    if already_settled(e['request_id']):
        return 'ok', 200

    if e['status'] == 1:
        mark_delivered(e['request_id'], e['amount'])
    else:
        refund(e['request_id'])

    return 'ok', 200

// routes/api.php
Route::post('/mitload/callback', [MitloadController::class, 'handle'])
     ->withoutMiddleware([VerifyCsrfToken::class]);

// app/Http/Controllers/MitloadController.php
public function handle(Request $request)
{
    $body = $request->getContent();
    $mine = 'sha256=' . hash_hmac('sha256', $body, config('services.mitload.secret'));

    if (!hash_equals($mine, $request->header('X-MITLoad-Signature', ''))) {
        abort(401);
    }

    $e = json_decode($body, true);

    Order::where('reference', $e['request_id'])
         ->where('status', 'pending')
         ->update(['status' => $e['status'] == 1 ? 'delivered' : 'failed']);

    return response('ok', 200);
}

What counts as delivered

Any 2xx response. Anything else — 4xx, 5xx, a timeout, a TLS failure — is a failure and will be retried.

Retry schedule

Make your handler idempotent

A retry means you may see the same event twice — for instance if your 200 was lost on the way back to us. Key on request_id and ignore anything you have already settled. Without that, a retry could credit a customer twice.

Signature check, idempotency and a fast reply, in about forty lines.

<?php
// callback.php — point your webhook URL here

$secret = getenv('MITLOAD_SECRET');
$body   = file_get_contents('php://input');
$sent   = $_SERVER['HTTP_X_MITLOAD_SIGNATURE'] ?? '';

// 1. prove it came from MITLoad
if (!hash_equals('sha256=' . hash_hmac('sha256', $body, $secret), $sent)) {
    http_response_code(401);
    exit;
}

$e = json_decode($body, true);

// 2. a test ping needs nothing but a 200
if (($e['event'] ?? '') === 'ping') {
    http_response_code(200);
    exit('pong');
}

$pdo = new PDO('mysql:host=localhost;dbname=shop', $u, $p);

// 3. idempotent — the UPDATE only matches a row still pending,
//    so a duplicate delivery changes nothing
$st = $pdo->prepare(
    'UPDATE orders SET status = ?, settled_at = ?
       WHERE reference = ? AND status = "pending"'
);
$st->execute([
    $e['status'] == 1 ? 'delivered' : 'failed',
    $e['settled_at'],
    $e['request_id'],
]);

// 4. answer immediately; anything slow goes on a queue
http_response_code(200);
echo 'ok';

if ($st->rowCount() > 0 && $e['status'] == 1) {
    queue_customer_sms($e['number'], $e['amount']);
}