One payment link that opens in your bank's app

01How a link works

1. The merchant sends the link by SMS, email or WhatsApp. Every link names the merchant's bank and carries a short code.
2. The page shows the merchant, the amount and the status, then one button per participating bank app and a unified code for every other app.
3. Your app opens the payment. The same bank pays directly inside Astro; another bank pays over OnePay or LyPay.
4. The page updates the moment the bank confirms. Money, fees and notifications stay with each bank.

02Participating banks

• A
  Andalus BankAndaPay Pays other banks over OnePay · LyPay

03The unified QR

One EMVCo merchant-presented code that every Libyan bank app already reads. It carries the OnePay and LyPay merchant fields as the Central Bank of Libya specifies them, LyPay's reference in tag 51, and the Astro template in tag 26, which other readers skip. The amount is locked in tag 54, and a CRC-16 seals the code.

04Tap to pay

A tap carries the same payment as the code: one NDEF message of two records. A merchant's Android phone emulates an NFC Forum Type 4 tag, and a written NFC sticker does the job at a till.

1. URI record: the payment link, so any phone opens the page or the app.
2. External record of type neptune.ly:astro: the unified code as text, which the new app prefers.

NDEF · AID D2760000850101 · CC E103 · NDEF file E104

05For merchants and developers

A merchant's bank issues its API key. The merchant creates a payment intent and gets its link, code and NFC payload, receives signed webhooks, and can replay anything it missed from the events feed. SDKs for TypeScript and PHP; the sandbox is UAT.

POST /api/astro/v1/payment-intents
Authorization: Bearer <merchant key>
Idempotency-Key: order-1042

{"amount": "12.500", "reference": "ORDER-1042"}

201 {"intent": {"status": "OPEN",
  "checkout_url": "https://pay.neptune.ly/anda/i/Ab3dE5g",
  "qr_payload": "000201...6304FF82",
  "nfc_ndef_base64": "..."}}

Webhook: N-Agora-Signature: t=<unix>,v1=<HMAC-SHA256>

Ask your bank for access.

06Security and privacy

• Money never passes through pay.neptune.ly. Your app pays through your bank.
• Only banks publish links, and every push is signed with HMAC-SHA256 under the bank's key and guarded against replay.
• No payer names, phone numbers or accounts. IP addresses are not kept beyond the rate-limit window.
• Each app claims only its own path, such as open.neptune.ly/anda, so a phone never has to guess which app to open.
• Records are kept for 400 days, then only as totals.