Step 1: Apply Fabric Token

Same as the H5 C2B flow — every Telebirr API call requires a short-lived bearer token first.

With the PHP or JS/TS library, createInAppOrder() fetches the token automatically. You only need to call applyFabricToken() directly if you’re caching the token yourself.

The library way

use Melaku\Telebirr\Config;
use Melaku\Telebirr\Telebirr;
 
$config = Config::forTest([
    'appSecret'     => $_ENV['TELEBIRR_APP_SECRET'],
    'fabricAppId'   => $_ENV['TELEBIRR_FABRIC_APP_ID'],
    'merchantAppId' => $_ENV['TELEBIRR_MERCHANT_APP_ID'],
    'merchantCode'  => $_ENV['TELEBIRR_MERCHANT_CODE'],
    'notifyUrl'     => 'https://your-site.com/pay/notify',
    'privateKey'    => file_get_contents('/path/to/private-key.pem'),
]);
 
$client = new Telebirr($config);
 
// Optional — call directly if you want to cache the token
$tokenInfo = $client->applyFabricToken();
 
echo $tokenInfo['token'];          // "Bearer 94cc42bee41..."
echo $tokenInfo['expirationDate']; // "20221101142422"

Cache the token and reuse it until expirationDate to avoid hitting the rate limit.

Raw API (all languages)

$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL            => 'https://developerportal.ethiotelebirr.et:38443'
                              . '/apiaccess/payment/gateway/payment/v1/token',
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_SSL_VERIFYPEER => false, // test env has self-signed cert
    CURLOPT_HTTPHEADER     => [
        'Content-Type: application/json',
        'X-APP-Key: ' . $fabricAppId,
    ],
    CURLOPT_POSTFIELDS => json_encode(['appSecret' => $appSecret]),
]);
 
$response = json_decode(curl_exec($ch), true);
$token    = $response['token']; // "Bearer ..."

const BASE = 'https://developerportal.ethiotelebirr.et:38443/apiaccess/payment/gateway'
 
async function applyFabricToken(fabricAppId: string, appSecret: string): Promise<string> {
  const res = await fetch(`${BASE}/payment/v1/token`, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'X-APP-Key': fabricAppId,
    },
    body: JSON.stringify({ appSecret }),
  })
  const data = await res.json()
  if (!data.token) throw new Error(`Token request failed: ${JSON.stringify(data)}`)
  return data.token
}

import requests
 
BASE = "https://developerportal.ethiotelebirr.et:38443/apiaccess/payment/gateway"
 
def apply_fabric_token(fabric_app_id: str, app_secret: str) -> str:
    resp = requests.post(
        f"{BASE}/payment/v1/token",
        headers={"Content-Type": "application/json", "X-APP-Key": fabric_app_id},
        json={"appSecret": app_secret},
        verify=False,  # test env self-signed cert
    )
    resp.raise_for_status()
    data = resp.json()
    if "token" not in data:
        raise ValueError(f"Token missing: {data}")
    return data["token"]

Response

{
  "effectiveDate": "20221101132422",
  "expirationDate": "20221101142422",
  "token": "Bearer 94cc42bee412696d754508c06ca1db20"
}

Field	Description
`token`	Pass as `Authorization` header in all subsequent requests
`effectiveDate`	When token became valid (`YYYYMMddHHmmss`)
`expirationDate`	When token expires — re-fetch after this

Overview