UPI Cash Withdrawal API for Assisted Cash-out

Yes. Transactions are blocked between 23:30 and 00:05 IST — an NPCI / acquirer maintenance window, not an Eko rule.

No. The customer scans the QR from any UPI app and authorises with their own UPI PIN. There is no biometric, Aadhaar or daily eKYC step for the customer.

Only after the status API returns tx_status "0" (paid). A generated QR means no money has moved yet; failed, pending, unknown or timed-out results all mean not paid.

The retailer must be onboarded and eKYC-complete for UPI Cash Withdrawal. Until then the API returns response_type_id 99016 (not enabled) — a provisioning state; contact your relationship manager.

The commercials are the same as AePS cash withdrawal. See the earnings calculator on the pricing page for the commission per transaction.

Not yet — UPI Cash Withdrawal is not available on the UAT / sandbox environment.

Four steps: sign up at the developer console page, verify your identity with PAN and address details, load your wallet to test the APIs live, then integrate and go live. Sandbox credentials are issued immediately — you can call your first endpoint before any paperwork clears.

EPS (Eko Platform Services) is the technology arm of Eko — the developer tools, AI tooling and APIs that power modern fintech integration, from money transfer and AePS to identity verification.

Three paths, pick whichever suits your stack:

• Call the REST APIs directly.
• Use our official Node.js, Python, PHP, Go or Java SDKs to skip request-signing boilerplate.
• Let an AI coding agent build it via our MCP server and agent skills.

For multi-step flows (onboard a sender, then transfer) start from a transaction-flow recipe rather than wiring single endpoints together yourself.

Each request carries your static developer_key header plus a per-request secret-key header — an HMAC-SHA256 signature of the current timestamp, keyed by your access key. The access key itself is never sent over the wire. You receive UAT keys on signup and production keys after KYC.

The How Authentication Works guide has the full signing recipe in five languages plus an in-browser playground that generates and verifies a real secret-key against your own access key.

Authentication failed. For the known causes, the response body's status names the check that failed:

• 2483 — The developer_key is wrong.
• 2484 — The secret-key (signature) is wrong.
• 2485 — The secret-key-timestamp is more than 2 minutes older or newer than the server clock, or was reused from an earlier request.
• 2486 — The secret-key-timestamp is not in milliseconds (13 digits) — often seconds (10 digits).
• 2487 — The secret-key or secret-key-timestamp header is missing.

If your signature checks out in the secret-key playground and you still get a 401, make sure the base URL matches your keys (UAT vs production) and, in production, that your server's IP is whitelisted.

Yes. A full sandbox is available immediately on signup — test your integration end-to-end before going live, no commitment required. For offline work you can also run our mock server (npx -y @ekoindia/eps-mock-server) and get canned responses with no network calls at all.

Sandbox and production share the same paths and differ only by base URL:

• UAT / Sandbox — https://staging.eko.in/ekoapi/v3
• Production — https://api.eko.in/ekoicici/v3

A common cause of failures is calling the sandbox URL with live credentials, or vice-versa — make sure the base URL matches the keys you are using.

It's optional. IP whitelisting is available for production access as an extra layer of security — share your static public (server) IP with us and we'll whitelist it.

Yes — that is the fastest path. Point your agent (Claude Code, Codex, Cursor, Copilot, …) at our MCP server and it can look up any endpoint, generate correctly-signed requests, and scaffold the integration in your own stack. Install it in one step from the AI hub, or start from a ready-made prompt.

We also publish an OpenAPI 3.1 spec, a Postman collection and per-agent context packs (AGENTS.md, CLAUDE.md, .cursorrules) so an agent has the ground truth instead of guessing.

Most verification APIs return in real time with sub-second responses, and 99th-percentile latency stays under two seconds across verification endpoints. Transaction APIs (DMT, AePS, BBPS) respond within seconds.

Yes. The API is designed to handle large-scale volumes reliably without performance degradation.

Usage is billed per successful API call with no minimum commitment. Volume-based pricing tiers are available — see the pricing calculator for indicative rates, or contact our team for a custom quote.