Authentication

How HellOOpass API requests are authenticated.

The currently published HellOOpass endpoints require no API key or credential — send a JSON request body and you are authenticated.

Published endpoints

Endpoint	Purpose
`POST /api/dube/international/registerproject.php`	Create a Project
`POST /api/dube/international/registerwebhookconfig.php`	Configure a webhook
`POST /api/dube/international/registermerchant.php`	Create a merchant account
`POST /api/dube/international/customerselfregistration.php`	Create a personal user account
`POST /api/dube/international/invoice/placeorder.php`	Send a bill / create an order

Base URL: https://helloomarket.com

Sending requests

The only required header is the content type:

curl -X POST https://helloomarket.com/api/dube/international/customerselfregistration.php \
  -H "Content-Type: application/json" \
  -d '{
    "fullname": "Abebe Kebede",
    "mobile": "911234567",
    "project": "proj_1024",
    "dialCode": "+251",
    "channel": "mobile_app",
    "countryCode": "ET"
  }'

API credentials

The Dashboard issues API credentials per project for HellOOpass services that require them. The payment API contract is not yet published — until it is, treat credentials as backend-only secrets:

Backend only: Secret keys must never go to browsers or mobile apps.
Environment variables: Store in .env or a managed secret store.
Never committed: Add .env to .gitignore and treat leaks as compromised.

Never send secret API keys from clients.