Quick Answer: Malaysian businesses can integrate DuitNow QR payments via the HitPay API by creating a payment request, generating a dynamic QR code, and listening for confirmation via webhook. HitPay supports DuitNow QR alongside FPX, Touch 'n Go, GrabPay, ShopeePay, Boost, and 50+ payment methods for Malaysian merchants, with next business day payouts in MYR for domestic transactions.

Malaysia's digital payments infrastructure has matured rapidly. Statista Malaysia e-commerce data shows continued double-digit growth in online retail transactions, and DuitNow QR — operated by Payments Network Malaysia (PayNet) — sits at the centre of that shift. Accepting DuitNow payments through a custom checkout or app is no longer optional. It is infrastructure.

Integrating DuitNow via a payment gateway API gives developers full control over the checkout experience: custom UIs, automated order fulfilment, real-time payment confirmation, and clean reconciliation. This guide covers what a correct integration looks like — from first API call to production deployment.

What Does a DuitNow API Integration Actually Involve?

A DuitNow QR API integration has three core components:

1. Authentication — connecting to the payment gateway using an API key

2. Payment request creation — generating a dynamic QR code tied to a specific transaction amount

3. Confirmation handling — receiving and verifying payment status via webhook or status polling

DuitNow QR is a dynamic QR standard. Unlike a printed static QR at a cashier counter, each API-generated QR encodes a specific payment amount and expires after the transaction window. This makes it suitable for e-commerce checkouts, mobile apps, kiosks, and in-person POS flows where the amount varies per transaction.

For developers building on the HitPay API, the payment request endpoint (POST /v1/payment-requests) creates a hosted checkout that surfaces DuitNow QR alongside other Malaysian payment methods — FPX, Touch 'n Go, GrabPay, ShopeePay, Boost, Visa, and Mastercard — without requiring separate integrations for each method.

How Do Malaysian Merchants Authenticate with the HitPay API?

All HitPay API calls require two credentials from the merchant dashboard:

• API Key (X-BUSINESS-API-KEY header) — authenticates the request

• Salt value — used to verify webhook signatures via HMAC-SHA256

These are environment-specific. Sandbox credentials only work against https://api.sandbox.hit-pay.com/v1/. Production credentials only work against https://api.hit-pay.com/v1/. A common integration failure is using a sandbox key against the production endpoint — or omitting the Content-Type and X-Requested-With headers, which will return an invalid API key error regardless of key correctness.

Retrieve both values from Settings > API Keys in the HitPay dashboard before writing a single line of integration code.

How Do You Create a DuitNow QR Payment Request via API?

The standard flow for a DuitNow-enabled checkout works as follows:

1. Customer proceeds to checkout on the merchant's site or app

2. Merchant backend calls POST /v1/payment-requests with the transaction amount, currency (MYR), and a redirect_url for post-payment handling

3. HitPay returns a hosted checkout URL containing a dynamic DuitNow QR code

4. Customer opens their banking app — Maybank2u, CIMB Clicks, Touch 'n Go, or any DuitNow-compatible app — and scans the QR

5. Payment completes; HitPay sends a webhook notification to the merchant's registered endpoint

6. Merchant backend verifies the webhook signature and updates the order status

The HitPay API also supports static QR generation, which creates a reusable QR not tied to a specific amount. Static QRs are appropriate for donation boxes, tip jars, or in-store displays — not for e-commerce transactions where each order has a distinct value.

For Malaysian e-commerce merchants building on WooCommerce, HitPay's DuitNow QR integration for Malaysian businesses handles the payment request lifecycle without custom API code. For custom-built platforms, the API gives full programmatic control.

How Should Webhooks Be Configured for Reliable DuitNow Payment Confirmation?

Webhooks are the correct mechanism for production payment confirmation. Polling the payment status endpoint is acceptable during local development — when a public webhook URL is unavailable — but it is not production-grade. Polling will miss payments if the customer closes the browser before the poll cycle completes.

The production webhook configuration:

1. Register a publicly accessible HTTPS endpoint in Developers > Webhook Endpoints in the HitPay dashboard

2. Subscribe to the payment_request.completed event

3. When a payment completes, HitPay sends a POST request to that endpoint with a JSON payload

4. Verify the signature: verify the HMAC-SHA256 signature using the Salt value from your dashboard — full verification steps are documented in the HitPay webhook guide

5. If the signature is valid and status is completed, mark the order as paid and trigger fulfilment

6. Return HTTP 200 — failure to return 200 will cause HitPay to retry the webhook

The webhook parameter in the payment request payload uses a form-encoded format. The registered webhook system uses JSON payloads, supports multiple event types (refunds, chargebacks, transfers), and is managed centrally from the dashboard — the recommended approach for new integrations.

HitPay enforces a rate limit of 400 API requests per minute across all endpoints, with a tighter limit of 70 requests per minute on the payment request endpoint. For high-volume operations, webhook-first confirmation is operationally essential — it eliminates the need for status-polling loops that will hit these ceilings.

For merchants building more complex checkout experiences with a drop-in UI, HitPay.JS drop-in checkout UI provides a pre-built frontend layer that handles QR rendering and payment status detection without custom polling logic.

What Are the Payout Timelines and Reconciliation Considerations for DuitNow Transactions?

For Malaysian merchants, domestic DuitNow QR transactions processed through HitPay settle next business day in MYR. Cross-border transactions — such as payments via PayNow or QRIS — settle typically within 2 days.

For reconciliation, every HitPay transaction carries a payment_request_id and a reference_number in the webhook payload. Matching these against internal order IDs at the point of webhook processing — not at the point of payout — eliminates end-of-month reconciliation gaps. Merchants processing multiple payment methods (DuitNow QR, FPX, Touch 'n Go, GrabPay, Visa) through a single HitPay integration receive all transactions in one dashboard, reducing the overhead of multi-gateway reconciliation.

HitPay charges no monthly fee and no setup fee — transaction pricing is available at hitpayapp.com/pricing. This per-transaction-only model means Malaysian SMBs are not paying a standing cost during low-volume periods.

What Does a Production-Ready DuitNow Integration Checklist Look Like?

Before switching from sandbox to production, a merchant's technical checklist should confirm:

1. Base URL updated from https://api.sandbox.hit-pay.com/v1/ to https://api.hit-pay.com/v1/

2. API Key and Salt values replaced with production credentials from the HitPay dashboard

3. DuitNow QR payment method enabled under Payments > Integration Settings for the relevant sales channel (Payment Request APIs or Links)

4. Webhook endpoint registered in production dashboard and returning HTTP 200 reliably

5. HMAC-SHA256 signature verification implemented and tested against a live webhook payload

6. Idempotency keys in use on payment recording to prevent double-processing if webhook and polling race

7. DuitNow QR tested end-to-end with a real Malaysian banking app in the production environment

8. Fallback handling in place for webhook delivery failures (HitPay retries failed webhooks, but order status should not remain unresolved indefinitely)

Bank Negara Malaysia regulates payment system operators and sets the compliance framework within which all DuitNow-connected services must operate — merchants should verify that their payment gateway holds a valid licence under BNM's Payment Systems Act requirements. HitPay operates under a MAS licence (PS20200643) in Singapore and complies with applicable payment regulations across its Southeast Asian markets.

For Malaysian merchants evaluating the broader gateway landscape, the Stripe alternatives comparison for Malaysian businesses provides a structured review of how local payment method coverage — particularly DuitNow QR, FPX, and e-wallets — varies across providers.

Practical takeaway: DuitNow API integration is a three-step technical process — authenticate, create payment requests, handle webhooks — but the operational decisions around payout timing, reconciliation, and production readiness determine whether the integration holds up at scale. Configure webhooks from the start, use production credentials only against the production endpoint, and align payout settlement timelines (next business day for domestic MYR; typically within 2 days for cross-border) with actual cash flow planning.

Frequently Asked Questions