Base URL

https://api.akabbo.com

Authentication

The Developer API uses OAuth2 client credentials. The developer backend exchanges its client_id and client_secret for an access token.

Get Access Token

POST/oauth/token/

curl -X POST https://api.akabbo.com/oauth/token/ \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET"

Token Response

{
  "access_token": "ACCESS_TOKEN_HERE",
  "expires_in": 36000,
  "token_type": "Bearer",
  "scope": "read write"
}

Use the access token in API requests:

Authorization: Bearer ACCESS_TOKEN_HERE

Recommended Donation Flow

The donor should submit the donation form to the developer's backend, not directly to Akabbo.

Donor Browser
  -> Developer Backend
  -> Akabbo API

Do not do this:

Donor Browser
  -> Akabbo API with Bearer token

Donation Endpoints

Profile and campaign donations use the same request body. Choose the endpoint based on where the donation should go.

Mobile Money Donation Request

curl -X POST https://api.akabbo.com/v1/campaign/community-water-project/donate/ \
  -H "Authorization: Bearer ACCESS_TOKEN_HERE" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": "10000",
    "currency": "UGX",
    "anonymous": false,
    "donor": "Jane Doe",
    "charge_donor": false,
    "fsource": "2567XXXXXXX",
    "email": "jane@example.com",
    "message": "Supporting this campaign",
    "mode": "MM"
  }'

Card Donation Request

curl -X POST https://api.akabbo.com/v1/campaign/community-water-project/donate/ \
  -H "Authorization: Bearer ACCESS_TOKEN_HERE" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": "10000",
    "currency": "UGX",
    "anonymous": false,
    "donor": "Jane Doe",
    "charge_donor": false,
    "email": "jane@example.com",
    "message": "Supporting this campaign",
    "mode": "CARD",
    "country": "UG",
    "first_name": "Jane",
    "last_name": "Doe",
    "street": "Plot 10 Kampala Road",
    "city": "Kampala",
    "state": "Central",
    "zip": "00256"
  }'

Donation Response

{
  "reference": "1b1c1111-2222-3333-4444-777777777777",
  "link": null
}

For MM payments, link is null. For CARD payments, link contains the gateway checkout URL the user should open to complete payment.

Response Fields

Check Profile Donation Status

GET/v1/profile/donate/{reference}/status/

curl https://api.akabbo.com/v1/profile/donate/0a0b1111-2222-3333-4444-555555555555/status/ \
  -H "Authorization: Bearer ACCESS_TOKEN_HERE"

Check Campaign Donation Status

GET/v1/campaign/{campaign_slug}/donation/{reference}/status/

curl https://api.akabbo.com/v1/campaign/community-water-project/donation/1b1c1111-2222-3333-4444-777777777777/status/ \
  -H "Authorization: Bearer ACCESS_TOKEN_HERE"

Status Response

The status response is the same for profile and campaign donations. Only the status endpoint changes.

{
  "ref": "0a0b1111-2222-3333-4444-555555555555",
  "status": "PENDING",
  "network_response": null
}

Request Fields

Fields Used by Both MM and CARD

Mobile Money Fields

Card Fields

Donation Identity Fields

Status Values

Common payment statuses include:

Error Responses

Invalid or Missing Token

{
  "detail": "Authentication credentials were not provided."
}

Donation Not Found

{
  "detail": "Donation not found"
}

Validation Error

{
  "amount": [
    "A valid number is required."
  ]
}

Payment Limit or Permission Error

{
  "error": "This profile has reached the maximum amount allowed for unverified profiles."
}

Backend Integration Example

The developer backend should store the access token securely and call the donation endpoint after a donor submits a form.

// Example Node.js/Express-style flow

app.post("/api/donate", async (req, res) => {
  const token = await getAkabboAccessToken();
  const payload = {
    amount: req.body.amount,
    currency: req.body.currency || "UGX",
    anonymous: Boolean(req.body.anonymous),
    donor: req.body.donor || null,
    charge_donor: Boolean(req.body.charge_donor),
    fsource: req.body.fsource,
    email: req.body.email || null,
    message: req.body.message || "",
    mode: "MM"
  };

  const response = await fetch(
    "https://api.akabbo.com/v1/campaigns/community-water-project/donate/",
    {
      method: "POST",
      headers: {
        "Authorization": `Bearer ${token}`,
        "Content-Type": "application/json"
      },
      body: JSON.stringify(payload)
    }
  );

  const data = await response.json();
  res.status(response.status).json(data);
});

Security Checklist

• Keep client_secret on the backend only.
• Keep Bearer tokens on the backend only.
• Do not call Akabbo directly from browser JavaScript with a Bearer token.
• Validate donor input and send only approved payload fields to Akabbo.
• Store the returned reference for status checks.
• Always verify status from the backend before showing final payment success to the donor.

Last updated: May 15, 2026