DMC Pay APIVendor integration guide

Accept bank-transfer and DuitNow QR deposits, send withdrawals, and receive signed postbacks — over a request-signed v2 API.

Signed requests

Every v2 call is signed with your RSA key over method, URL, timestamp, nonce and payload. Replays and cross-environment reuse are rejected.

How signing works

Create a deposit (Maybank, CIMB, RHB, Public Bank, QR and more) and redirect your customer to the hosted payment page.

Init deposit

Pay out to any supported Malaysian bank account or Touch 'n Go with a single signed request.

Init withdrawal

Get the final outcome pushed to your webhook, optionally RSA-signed so you can prove it came from us.

Verify postbacks

Environment	API base URL
Production	`https://oapi.dmcpay.net`
Staging	`https://staging-oapi.dmcpay.net`

Build and test against staging first, then switch the base URL (and your keypair) for production.