POSTCash Withdrawal OTP

Generate the transaction OTP required before an AePS cash withdrawal above ₹5,000.

POST/customer/collection/aeps-fingpay/cash-withdrawal/otp/{customer_id}

Fingpay requires a fresh, transaction-scoped OTP for every cash withdrawal above ₹5,000. Call this before Cash Withdrawal only when amount is greater than ₹5,000 — for ₹5,000 or less, skip it and call Cash Withdrawal directly.

On success the customer receives a 6-digit OTP by SMS on their Aadhaar-linked mobile, and the response returns data.fp_transaction_id. Send that id to Cash Withdrawal as txn_otp_request_id, and put the SMS OTP in the otp attribute of the PidOptions used to capture the customer's fingerprint. They are two different values, and Cash Withdrawal needs both. The id belongs to this one withdrawal attempt: generate a new one for every attempt and never reuse it.

No biometric capture happens in this call — it takes no piddata.

Tip

This endpoint is one step in a complete workflow:

AePS (Fingpay) — Cash Withdrawal — Aadhaar-enabled cash withdrawal: one-time agent activation and eKYC, daily KYC, a transaction OTP for amounts above ₹5,000, then the biometric withdrawal.

Request

Path parameters

Field	Type	Required	Description
`customer_id`	string	required	Customer's registered mobile number.e.g. 9000000000

customer_idstringRequired

Customer's registered mobile number.

example: 9000000000

Body parameters

Field	Type	Required	Description
`initiator_id`	string	required	Registered mobile number of the API user (see Platform Credentials).e.g. 9962981729
`client_ref_id`	string	optional	Unique reference ID per API call, generated by your system (max 20 characters). The SDKs generate one for every non-GET call when you don't.e.g. 2026010100123456789
`user_code`	string	required	Unique code of your user/agent/retailer the service is run for. Use `Onboard Agent` API to register your userse.g. 10000001
`bank_code`	string	optional	Short bank code identifying the customer's Aadhaar-linked bank (e.g. `HDFC`, `SBIN`). Obtain from the bank list API. Recommended — send the same value you will use for the withdrawal.e.g. HDFC
`aadhar`	string	required	RSA-encrypted, Base64-encoded Aadhaar number of the customer — the same value you send to Cash Withdrawal. Encrypt the 12-digit Aadhaar with the Eko RSA public key using PKCS#1 v1.5 padding (Java's default `Cipher.getInstance("RSA")`), then Base64-encode the ciphertext.e.g. BASE64_ENCRYPTED_AADHAAR
`latlong`	string	required	GPS coordinates of the agent's device in 'latitude,longitude' format.e.g. 28.6139,77.2090
`amount`	number	required	Withdrawal amount in Indian Rupees (integer) — the same amount you will send to Cash Withdrawal. Only call this API when it is above ₹5,000.e.g. 6000

initiator_idstringRequired

Registered mobile number of the API user (see Platform Credentials).

example: 9962981729

client_ref_idstringoptional

Unique reference ID per API call, generated by your system (max 20 characters). The SDKs generate one for every non-GET call when you don't.

example: 2026010100123456789

user_codestringRequired

Unique code of your user/agent/retailer the service is run for. Use `Onboard Agent` API to register your users

example: 10000001

bank_codestringoptional

Short bank code identifying the customer's Aadhaar-linked bank (e.g. `HDFC`, `SBIN`). Obtain from the bank list API. Recommended — send the same value you will use for the withdrawal.

example: HDFC

aadharstringRequired

RSA-encrypted, Base64-encoded Aadhaar number of the customer — the same value you send to Cash Withdrawal. Encrypt the 12-digit Aadhaar with the Eko RSA public key using PKCS#1 v1.5 padding (Java's default `Cipher.getInstance("RSA")`), then Base64-encode the ciphertext.

example: BASE64_ENCRYPTED_AADHAAR

latlongstringRequired

GPS coordinates of the agent's device in 'latitude,longitude' format.

example: 28.6139,77.2090

amountnumberRequired

Withdrawal amount in Indian Rupees (integer) — the same amount you will send to Cash Withdrawal. Only call this API when it is above ₹5,000.

example: 6000

These headers authenticate and sign every request. See How Auth Works for details.

Field	Type	Required	Description
`developer_key`	string	required	Static API key issued to your account after KYC.
`secret-key`	string	required	Dynamic per-request signature: base64(HMAC-SHA256(timestamp, base64(access_key))).
`secret-key-timestamp`	string	required	Current time in milliseconds since UNIX epoch, used to compute secret-key. Must match server time.
`content-type`	string	required	application/jsone.g. application/json

developer_keystringRequired

Static API key issued to your account after KYC.

secret-keystringRequired

Dynamic per-request signature: base64(HMAC-SHA256(timestamp, base64(access_key))).

secret-key-timestampstringRequired

Current time in milliseconds since UNIX epoch, used to compute secret-key. Must match server time.

content-typestringRequired

application/json

example: application/json

Response types

response_type_id	Meaning	Next step
`1459`	OTP generated and sent to the customer by SMS — send `data.fp_transaction_id` as `txn_otp_request_id` to Cash Withdrawal	AePS Cash Withdrawal

Responses

1459OTP generated and sent to the customer by SMS — send `data.fp_transaction_id` as `txn_otp_request_id` to Cash WithdrawalNext:AePS Cash Withdrawal

statusnumber
Primary success indicator (0 = success).
messagestring
Human-readable response / error message.
response_status_idnumber
Granular status id; see the shared error-codes table.
response_type_idnumber
A unique id for every possible response shape (success or error) — useful for client logic branching and analytics.
dataobject
API-specific response payload.
- fp_transaction_idstring
  OTP reference id for this one withdrawal attempt. Send it to Cash Withdrawal as `txn_otp_request_id`. It is NOT the OTP — the customer receives that by SMS.

Next steps

NextPOSTAePS Cash WithdrawalWithdraw cash from any Aadhaar-linked bank account using biometric fingerprint authentication — no card or PIN required.