Frequently asked questions

EPS (Eko Platform Services) is the technology arm of Eko — the developer tools, AI tooling and APIs that power modern fintech integration, from money transfer and AePS to identity verification.

Three paths, pick whichever suits your stack:

• Call the REST APIs directly.
• Use our official JavaScript / PHP SDKs to skip request-signing boilerplate.
• Let an AI coding agent build it via our MCP server and agent skills.

For multi-step flows (onboard a sender, then transfer) start from a transaction-flow recipe rather than wiring single endpoints together yourself.

Each request carries your static developer_key header plus a per-request secret-key header — an HMAC-SHA256 signature of the current timestamp, keyed by your access key. The access key itself is never sent over the wire. You receive UAT keys on signup and production keys after KYC.

The How Authentication Works guide has the full signing recipe in five languages plus an in-browser playground that generates and verifies a real secret-key against your own access key.

Yes. A full sandbox is available immediately on signup — test your integration end-to-end before going live, no commitment required. For offline work you can also run our mock server (npx -y @ekoindia/eps-mock-server) and get canned responses with no network calls at all.

Sandbox and production share the same paths and differ only by base URL:

• UAT / Sandbox — https://staging.eko.in/ekoapi/v3
• Production — https://api.eko.in/ekoicici/v3

A common cause of failures is calling the sandbox URL with live credentials, or vice-versa — make sure the base URL matches the keys you are using.

Production API access may require your static public (server) IP to be whitelisted. If your calls work from Postman but fail or time out from your own server, that is almost always the cause — share your static public IP with us so we can whitelist it.

Yes — that is the fastest path. Point your agent (Claude Code, Codex, Cursor, Copilot, …) at our MCP server and it can look up any endpoint, generate correctly-signed requests, and scaffold the integration in your own stack. Install it in one step from the AI hub, or start from a ready-made prompt.

We also publish an OpenAPI 3.1 spec, a Postman collection and per-agent context packs (AGENTS.md, CLAUDE.md, .cursorrules) so an agent has the ground truth instead of guessing.

Most verification APIs return in real time with sub-second responses, and 99th-percentile latency stays under two seconds across verification endpoints. Transaction APIs (DMT, AePS, BBPS) respond within seconds.

Yes. The API is designed to handle large-scale volumes reliably without performance degradation.

Usage is billed per successful API call with no minimum commitment. Volume-based pricing tiers are available — see the pricing calculator for indicative rates, or contact our team for a custom quote.

Every response carries a status code (0 = success), a response_status_id and a human-readable message. A 200 OK with a non-zero response_status_id is a business failure, not a transport success — always check both before treating a call as done. The Status & Error Codes reference lists every code and what to do about it.

Eko APIs are versioned in the base path (currently v3). Sandbox and production share the same paths and differ only by base URL, so promoting an integration from UAT to live is a base-URL and credentials change — not a code change.

Through a UIDAI registered device (RDService) — the scanner returns a signed, encrypted PID block that you pass straight through to the API. Never capture or store raw biometrics yourself.

The Aadhaar Biometric Auth (RDService) guide covers both the Windows/Web and Android capture paths, and includes an in-browser device tester — plug in your scanner and confirm it works before writing any code.

Most real use cases are multi-step — onboard a customer, verify them, then transact. Rather than stitching endpoints together from the reference, start from a transaction flow recipe: each one is an ordered runbook showing which endpoint to call at each step and how to branch on response_status_id.

The same recipes are available to AI agents through our MCP server, so an agent can execute a whole flow end to end.

Eko follows applicable RBI and data-protection guidelines for its regulated banking and KYC services. Aadhaar-based KYC is performed only with explicit customer consent.

Share the complete request and response so we can debug in one round trip:

• The full curl (including headers)
• The response body, verbatim
• The timestamp of the call
• Your initiator_id, user_code and client_ref_id

Issues raised with these details are resolved much faster than "the API is failing".

Three frequent ones:

• client_ref_id must be at most 20 characters and unique per request.
• Calling the sandbox base URL with live credentials (or vice-versa) fails auth — see How Authentication Works.
• The JSESSIONID cookie Postman adds automatically is harmless — it has no effect on the API and can be ignored.

Inside the API docs: Integration FAQs collects the credential, signing, environment, error-handling and support questions in one place, right next to the endpoint reference and guides.