{"info":{"_postman_id":"f4499ae9-c802-403c-b30a-adde8530acd2","name":"InByte API Service","description":"

StartFragment

InByte API

Version: 1.1
Base URL: https://inbyte.ng/v2/apiProtocol: HTTPS only

InByte is a Nigerian VTU (Virtual Top-Up) platform that lets you purchase mobile data bundles, airtime, and manage wallet operations programmatically via this REST API.

Quick Start

Generate an API key — log into your InByte dashboard, go to Settings → API Access → Generate new key, give it a name (e.g. \"Production server\"), and copy the key shown. This is the only time you'll see the full key — InByte only stores a hash of it after this point, so if you lose it, revoke it and generate a new one. There's no \"reveal\" or \"reset\" option.
\n
Find your User ID — your 10-digit phone number, no leading 0 and no country code (e.g. 08160271109 → 8160271109). It's shown on the same Settings page.
\n
Make your first call:
\n

curl https://inbyte.ng/v2/api/balance \\\n  -H \"x-user-id: 8160271109\" \\\n  -H \"x-api-key: inbyte_live_your_key_here\"\n\n

{ \"success\": true, \"balance\": 1250.00 }\n\n

That's it — no OAuth flow, no token refresh, no client secrets. Every request just carries these two headers.

Authentication

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Header	Type	Description
`x-user-id`	`string`	Your 10-digit phone number, e.g. `8160271109` (no leading zero, no country code)
`x-api-key`	`string`	A key generated from your dashboard. Starts with `inbyte_live_`.

Getting and managing your API key

API keys are fully self-service — there's no support ticket required:

Generate: Dashboard → Settings → API Access → Generate new key. Name it something that identifies where it's used (e.g. \"Order bot\", \"Inventory sync\") — you can hold multiple keys at once, which makes it easy to revoke one integration's access without breaking the others.
\n
Reveal: Only happens once, at creation. InByte stores a one-way hash of your key, not the key itself — this is intentional and can't be changed, so treat the one-time reveal as your only backup.
\n
Revoke: Dashboard → Settings → API Access → Revoke, next to any key. Takes effect immediately — any request using that key fails from that moment on, no propagation delay.
\n
Last used: Each key's row shows when it was last used, so you can spot a key that should've been revoked a while ago.
\n

There is currently no way to rotate a key in place — revoking and generating a new one is the rotation flow.

Authentication failure responses

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Scenario	HTTP Status	Response
Missing `x-user-id`	`401`	`{ \"success\": false, \"message\": \"Missing required header: x-user-id.\" }`
Missing `x-api-key`	`401`	`{ \"success\": false, \"message\": \"Missing required header: x-api-key.\" }`
Both missing	`401`	`{ \"success\": false, \"message\": \"Missing required headers: x-user-id and x-api-key.\" }`
Key doesn't exist / never generated	`403`	`{ \"success\": false, \"message\": \"Invalid credentials.\" }`
Key was revoked	`403`	`{ \"success\": false, \"message\": \"Invalid credentials.\" }`
Key is valid but `x-user-id` doesn't match the account it belongs to	`403`	`{ \"success\": false, \"message\": \"Invalid credentials.\" }`

Note that all 403 cases return the same generic message deliberately — the API doesn't distinguish \"wrong key\" from \"revoked key\" from \"mismatched user\" in the response body, so a bad actor probing for valid userIds or key states can't learn anything from the error text. If you're debugging your own integration and get an unexplained 403, check (in order): is the key still active in your dashboard, does the x-user-id you're sending match the account that generated the key, and did you copy the whole key including the inbyte_live_ prefix.

Response Format

All responses are JSON. Every response includes a success boolean as the first field so you can always branch on it without inspecting HTTP status codes.

// Success shape\n{\n  \"success\": true,\n  ...                  // endpoint-specific fields\n}\n// Error shape\n{\n  \"success\": false,\n  \"message\": \"Human-readable explanation of what went wrong.\"\n}\n\n

HTTP Status Codes

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Code	Meaning
`200`	Request succeeded
`400`	Bad request — missing field, wrong PIN, invalid network, insufficient balance
`401`	Missing authentication header(s)
`403`	Invalid credentials (bad, revoked, or mismatched API key)
`404`	Resource not found (user, bundle)
`500`	Server or provider error — see `message` field for detail

Transaction PIN

The /data and /airtime endpoints require a 4-digit transaction PIN (pin field in the request body). This is separate from both your account password and your API key — it's the same PIN you'd use confirming a purchase in the WhatsApp or Telegram bot. If you haven't set one yet, it's configured from Dashboard → Settings → Security.

Design note for integrators: since the PIN travels in the request body on every purchase call, make sure your integration stores it as a secret with the same care as the API key itself — not in logs, not in client-side code, not in version control.

Wallet & Refund Guarantee

All purchases are deducted from your InByte wallet balance. The deduction is atomic — meaning even if two purchases happen at the same time, your balance will never go negative due to a race condition.

If a purchase is submitted to a provider and the provider returns a failure, your wallet is automatically refunded in full before the error response is sent. You will never be charged for a failed purchase.

Integration note: no idempotency support yet

There is currently no idempotency-key mechanism on /data or /airtime. If your client times out waiting for a response and retries the same purchase, the API has no way to recognize it as a duplicate — it will attempt a second purchase. If your integration retries on timeout, either:

Check /api/transactions for a matching recent entry before retrying, or
\n
Check /api/balance to confirm whether the deduction already happened
\n

before firing the same request again. This is a known gap, not a documented feature — treat retries as your responsibility to de-duplicate for now.

No rate limiting

As of this version, the API does not enforce rate limits. Please still be a good citizen — cache /api/bundles responses on your side (bundle prices don't change every second) rather than polling it before every purchase.

Endpoints

`GET /api/balance`

Returns your current wallet balance in NGN.

No request body required.

curl https://inbyte.ng/v2/api/balance \\\n  -H \"x-user-id: 8160271109\" \\\n  -H \"x-api-key: inbyte_live_your_key_here\"\n\n

Example response:

{\n  \"success\": true,\n  \"balance\": 1250.00\n}\n\n

Use this endpoint to:

Display available balance before initiating a purchase
\n
Confirm a deduction after a transaction
\n

`POST /api/bundles`

Returns available data bundles, grouped by bundle type and sorted cheapest-first within each group. Disabled bundles are excluded automatically.

Request body:

{\n  \"network\": \"mtn\"\n}\n\n

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Field	Type	Required	Description
`network`	`string`	No	Filter by network: `mtn`, `airtel`, `glo`, `9mobile`. Omit entirely to get all four networks in one call.

curl -X POST https://inbyte.ng/v2/api/bundles \\\n  -H \"x-user-id: 8160271109\" \\\n  -H \"x-api-key: inbyte_live_your_key_here\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"network\": \"mtn\"}'\n\n

Example response:

{\n  \"success\": true,\n  \"bundles\": {\n    \"mtn\": {\n      \"count\": 14,\n      \"grouped\": {\n        \"sme\": [\n          {\n            \"bundleId\":   \"mtn-1gb-sme\",\n            \"bundleName\": \"1GB SME\",\n            \"validity\":   \"30 Days\",\n            \"salePrice\":  280,\n            \"dataType\":   \"SME\"\n          }\n        ],\n        \"gifting\": [ \"...\" ],\n        \"cg\":      [ \"...\" ]\n      }\n    }\n  }\n}\n\n

Error response (no active bundles at all):

{ \"success\": false, \"message\": \"No active bundles found.\" }\n\n

\n

Important: Save the bundleId from this response — it's required when calling POST /api/data. Bundle IDs and prices can change, so don't hardcode them long-term; re-fetch periodically.

Bundle types you may see:

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Key	Full name
`sme`	SME Data
`sme1` / `sme2`	SME variants
`cg`	Corporate Gifting
`gifting`	Gifting Data
`extra`	Extra Data
`promo`	Promotional
`social`	Social Bundle

`POST /api/data`

Purchases a mobile data bundle and sends it to a recipient phone number.

Request body:

{\n  \"bundleId\":    \"mtn-1gb-sme\",\n  \"network\":     \"mtn\",\n  \"phoneNumber\": \"08160271109\",\n  \"pin\":         \"1234\"\n}\n\n

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Field	Type	Required	Description
`bundleId`	`string`	Yes	The `bundleId` from `POST /api/bundles`
`network`	`string`	Yes	`mtn`, `airtel`, `glo`, or `9mobile` — must match the network the bundle belongs to
`phoneNumber`	`string`	Yes	11-digit Nigerian number of the recipient (can be different from your own number)
`pin`	`string`	Yes	Your 4-digit transaction PIN

curl -X POST https://inbyte.ng/v2/api/data \\\n  -H \"x-user-id: 8160271109\" \\\n  -H \"x-api-key: inbyte_live_your_key_here\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"bundleId\": \"mtn-1gb-sme\",\n    \"network\": \"mtn\",\n    \"phoneNumber\": \"08160271109\",\n    \"pin\": \"1234\"\n  }'\n\n

Success response:

{\n  \"success\":        true,\n  \"message\":        \"1GB SME sent to 08160271109 successfully.\",\n  \"transactionRef\": \"DATA|29110FFB-F7D8-442F-81C4-7661A9F95EB8\",\n  \"newBalance\":     970.00\n}\n\n

Possible error responses:

{ \"success\": false, \"message\": \"Incorrect PIN.\" }\n{ \"success\": false, \"message\": \"Bundle not found.\" }\n{ \"success\": false, \"message\": \"This bundle is currently unavailable.\" }\n{ \"success\": false, \"message\": \"Insufficient wallet balance. Required: ₦280, Available: ₦50.\" }\n{ \"success\": false, \"message\": \"Missing required fields: phoneNumber, pin.\" }\n// Provider-side failure — wallet is automatically refunded\n{ \"success\": false, \"message\": \"Purchase failed at provider. Your wallet has been refunded.\" }\n// Hard provider exception — wallet was never charged\n{ \"success\": false, \"message\": \"Provider error. Your wallet was not charged.\" }\n\n

How the purchase flow works:

Your PIN is verified
\n
The bundle is looked up and confirmed active
\n
Your balance is checked — if insufficient, the request stops here (no deduction)
\n
Your wallet is deducted atomically
\n
The request is sent to the data provider
\n
If the provider fails → your wallet is refunded in full before the response is sent
\n
The transaction is saved to your history
\n

`POST /api/airtime`

Purchases airtime and sends it to a recipient phone number.

Request body:

{\n  \"network\":     \"mtn\",\n  \"amount\":      200,\n  \"phoneNumber\": \"08160271109\",\n  \"pin\":         \"1234\"\n}\n\n

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Field	Type	Required	Description
`network`	`string`	Yes	`mtn`, `airtel`, `glo`, or `9mobile`
`amount`	`number`	Yes	Amount in NGN. Must be a positive number.
`phoneNumber`	`string`	Yes	11-digit Nigerian number of the recipient
`pin`	`string`	Yes	Your 4-digit transaction PIN

curl -X POST https://inbyte.ng/v2/api/airtime \\\n  -H \"x-user-id: 8160271109\" \\\n  -H \"x-api-key: inbyte_live_your_key_here\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"network\": \"mtn\",\n    \"amount\": 200,\n    \"phoneNumber\": \"08160271109\",\n    \"pin\": \"1234\"\n  }'\n\n

Success response:

{\n  \"success\":        true,\n  \"message\":        \"₦200 MTN airtime sent to 08160271109 successfully.\",\n  \"transactionRef\": \"AIRT1781780460231\",\n  \"newBalance\":     800.00\n}\n\n

Possible error responses:

{ \"success\": false, \"message\": \"Incorrect PIN.\" }\n{ \"success\": false, \"message\": \"Amount must be a positive number.\" }\n{ \"success\": false, \"message\": \"Invalid network \\\"etl\\\". Valid options: mtn, airtel, glo, 9mobile.\" }\n{ \"success\": false, \"message\": \"Insufficient wallet balance. Required: ₦200, Available: ₦50.\" }\n{ \"success\": false, \"message\": \"Missing required fields: amount, pin.\" }\n// Provider failure — wallet refunded\n{ \"success\": false, \"message\": \"Airtime purchase failed. Your wallet has been refunded.\" }\n\n

The purchase flow is the same as /api/data — balance is checked before deduction, and a provider failure triggers an automatic refund.

`GET /api/transactions`

Returns your transaction history, newest first. At most 20 records are stored per user — older ones are automatically pruned after each new purchase.

Query parameters:

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Parameter	Type	Required	Description
`limit`	`number`	No	How many records to return. Default `20`. Maximum `20`. Example: `?limit=10`

curl \"https://inbyte.ng/v2/api/transactions?limit=10\" \\\n  -H \"x-user-id: 8160271109\" \\\n  -H \"x-api-key: inbyte_live_your_key_here\"\n\n

Example response:

{\n  \"success\": true,\n  \"count\": 2,\n  \"transactions\": [\n    {\n      \"transactionRef\":       \"DATA|29110FFB-F7D8-442F-81C4-7661A9F95EB8\",\n      \"transaction_category\": \"DATA PURCHASE\",\n      \"transaction_type\":     \"DEBIT\",\n      \"amount\":               280,\n      \"prev_bal\":             1250.00,\n      \"new_bal\":              970.00,\n      \"status\":               \"success\",\n      \"service\":              \"1GB SME to 08160271109\",\n      \"channel\":              \"API\",\n      \"createdAt\":            1781673930215\n    },\n    {\n      \"transactionRef\":       \"AIRT1781673000000\",\n      \"transaction_category\": \"AIRTIME PURCHASE\",\n      \"transaction_type\":     \"DEBIT\",\n      \"amount\":               200,\n      \"prev_bal\":             1450.00,\n      \"new_bal\":              1250.00,\n      \"status\":               \"success\",\n      \"service\":              \"MTN ₦200 airtime to 08160271109\",\n      \"channel\":              \"API\",\n      \"createdAt\":            1781670000000\n    }\n  ]\n}\n\n

Transaction fields explained:

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Field	Description
`transactionRef`	Unique reference for this transaction, sourced from the provider where possible
`transaction_category`	`DATA PURCHASE`, `AIRTIME PURCHASE`, or `WALLET FUNDING`
`transaction_type`	`DEBIT` for purchases, `CREDIT` for wallet funding
`amount`	NGN amount involved in this transaction
`prev_bal`	Your wallet balance before this transaction
`new_bal`	Your wallet balance after this transaction
`status`	`success` or `fail`
`service`	Human-readable description of what was purchased and for whom
`channel`	Where the order originated. Purchases made through this API are always `API`.
`createdAt`	Unix timestamp in milliseconds

Empty history response:

{ \"success\": true, \"count\": 0, \"transactions\": [] }\n\n

Quick Reference

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Method	Endpoint	Auth	Body
`GET`	`/api/balance`	Required	None
`POST`	`/api/bundles`	Required	`{ network? }`
`POST`	`/api/data`	Required	`{ bundleId, network, phoneNumber, pin }`
`POST`	`/api/airtime`	Required	`{ network, amount, phoneNumber, pin }`
`GET`	`/api/transactions`	Required	None (`?limit` query)

Troubleshooting Checklist

Before reaching out for support, check:

[ ] Both x-user-id and x-api-key headers are present on every request, including GET calls
\n
[ ] x-user-id is 10 digits, no leading 0, no 234 prefix
\n
[ ] The API key includes the full inbyte_live_ prefix and hasn't been truncated in copy/paste
\n
[ ] The key hasn't been revoked (check Dashboard → Settings → API Access)
\n
[ ] Content-Type: application/json is set on POST requests with a body
\n
[ ] The transaction PIN sent matches what's configured in Dashboard → Settings → Security — not your account password
\n

Changelog

2.1 — Self-service API key management. Keys are now generated, named, and revoked directly from the dashboard (Settings → API Access) instead of requiring a support request. Multiple keys per account are supported. Keys are shown once at creation and never again — only a hash is retained. Revocation is now immediate.

2.0 — Initial public release: /balance, /bundles, /data, /airtime, /transactions.

Support

For PIN resets or general integration issues, reach out via the InByte platform or contact the development team directly. API key generation and revocation no longer require contacting support — see Getting and managing your API key above.

EndFragment

\n","schema":"https://schema.getpostman.com/json/collection/v2.0.0/collection.json","toc":[{"content":"InByte API","slug":"inbyte-api"}],"owner":"38716395","collectionId":"f4499ae9-c802-403c-b30a-adde8530acd2","publishedId":"2sBXwwn7Wf","public":true,"customColor":{"top-bar":"FFFFFF","right-sidebar":"303030","highlight":"FF6C37"},"publishDate":"2026-06-23T11:54:43.000Z"},"item":[{"name":"Get Balance","id":"21ce2716-0ae5-4b06-adec-4e6ca6c57939","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"GET","header":[{"key":"x-user-id","value":"","type":"text"},{"key":"x-api-key","value":"","type":"text"}],"body":{"mode":"raw","raw":"","options":{"raw":{"language":"json"}}},"url":" /balance","urlObject":{"path":["balance"],"host":[" "],"query":[],"variable":[]}},"response":[{"id":"ea7d0660-c97c-42d5-a5db-c1e3665e9e25","name":"New Request","originalRequest":{"method":"GET","header":[{"key":"x-user-id","value":"","type":"text"},{"key":"x-api-key","value":"","type":"text"}],"url":"/balance"},"_postman_previewlanguage":"","header":[],"cookie":[{"expires":"Invalid Date","domain":"","path":""}],"responseTime":null,"body":""}],"_postman_id":"21ce2716-0ae5-4b06-adec-4e6ca6c57939"},{"name":"Get Bundles","id":"e34cae6a-db5a-4fb8-8e4e-1fcf789f4d4d","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[{"key":"x-user-id","value":"","type":"text"},{"key":"x-api-key","value":"","type":"text"}],"body":{"mode":"raw","raw":"{\r\n \"network\": \"\"\r\n}","options":{"raw":{"language":"json"}}},"url":"/bundles","urlObject":{"path":["bundles"],"host":[""],"query":[],"variable":[]}},"response":[{"id":"52470f2c-0560-4aa3-8ced-b41c1ac8f0ee","name":"Get Bundles","originalRequest":{"method":"POST","header":[{"key":"x-user-id","value":"","type":"text"},{"key":"x-api-key","value":"","type":"text"},{"key":"Content-Type","value":"application/json","type":"text"}],"body":{"mode":"raw","raw":"{\r\n \"network\": \"mtn\"\r\n}","options":{"raw":{"language":"json"}}},"url":"/bundles"},"_postman_previewlanguage":"","header":[],"cookie":[{"expires":"Invalid Date","domain":"","path":""}],"responseTime":null,"body":""}],"_postman_id":"e34cae6a-db5a-4fb8-8e4e-1fcf789f4d4d"},{"name":"Buy Data","id":"9281659e-88de-4495-a9f3-2f3475275060","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[],"url":"/data","urlObject":{"path":["data"],"host":[""],"query":[],"variable":[]}},"response":[{"id":"47030661-6163-486b-a4b1-fad59e3a9c8c","name":"Buy Data","originalRequest":{"method":"GET","header":[{"key":"x-user-id","value":"","type":"text"},{"key":"x-api-key","value":"","type":"text"},{"key":"Content-Type","value":"application/json","type":"text"}],"body":{"mode":"raw","raw":"{\r\n \"bundleId\":\"ms1_7\",\r\n \"network\":\"mtn\",\r\n \"phoneNumber\": \"07041143286\",\r\n \"pin\":\"2301\"\r\n}","options":{"raw":{"language":"json"}}},"url":"/data"},"_postman_previewlanguage":"","header":[],"cookie":[{"expires":"Invalid Date","domain":"","path":""}],"responseTime":null,"body":""}],"_postman_id":"9281659e-88de-4495-a9f3-2f3475275060"},{"name":"Buy Airtime","id":"77f9fdcd-914e-4faf-8d5b-77cf79aa0a24","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[{"key":"x-user-id","value":"","type":"text"},{"key":"x-api-key","value":"","type":"text"}],"body":{"mode":"raw","raw":"{\r\n \"network\": \"mtn\",\r\n \"amount\": 200,\r\n \"phoneNumber\": \"08160271109\",\r\n \"pin\": \"1234\"\r\n}","options":{"raw":{"language":"json"}}},"url":"/airtime","urlObject":{"path":["airtime"],"host":[""],"query":[],"variable":[]}},"response":[],"_postman_id":"77f9fdcd-914e-4faf-8d5b-77cf79aa0a24"},{"name":"Get Transactions","id":"7d326c2b-f333-4376-a05a-2f3503791b6c","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"GET","header":[{"key":"x-user-id","value":"","type":"text"},{"key":"x-api-key","value":"","type":"text"}],"url":"/transactions","urlObject":{"path":["transactions"],"host":[""],"query":[],"variable":[]}},"response":[],"_postman_id":"7d326c2b-f333-4376-a05a-2f3503791b6c"}],"variable":[{"key":"{","value":""},{"key":"baseUrl","value":""},{"key":"userid","value":""},{"key":"apiKey","value":""}]}