Introduction
Welcome to the VTStack API Reference. Our platform provides enterprise-grade infrastructure for Virtual Account Management, specifically optimized for small businesses and digital top-up platforms.
With VTStack, you can programmatically create dedicated virtual bank accounts through our partner PalmPay, enabling instant wallet funding and real-time transaction notifications.
Developer-First Infrastructure
Our APIs are built by engineers, for engineers. We handle the complex banking integration so you can focus on building your product.
The Integration Path
Follow these 5 steps to go from zero to live transactions on VTStack. Each step is designed to ensure maximum security and reliability.
Authentication & Identification
Generate your API keys in the Developer dashboard. Use x-api-key for standard requests.
// Header for all requests
x-api-key: sk_live_xxxxxxxxxxxxProvision Virtual Accounts
Create dedicated PalmPay accounts for your users. Each account acts as a permanent funding source.
curl -X POST https://api.vtstack.ng/api/virtual-accounts \
-H "x-api-key: YOUR_API_KEY" \
-d '{
"firstName": "Hassan",
"lastName": "Ibrahim",
"email": "hassan@example.com",
"phone": "08012345678",
"bvn": "22123456789",
"reference": "user_102_fund_acc"
}'Setup Webhooks
Configuring a Webhook URL is mandatory to receive real-time funding notifications.
// Example Webhook Response (POST)
{
"event": "transaction.deposit",
"data": {
"accountNumber": "8102345678",
"amount": 5000,
"reference": "VT-DEP-721",
"status": "success"
}
}Name Enquiry (Verification)
Before sending money out, always verify the recipient's bank details to avoid lost funds.
// Returns verified account name
{
"success": true,
"data": { "accountName": "HASSAN IBRAHIM" }
}Authentication
All API requests require a secret key to be included in the header of your request. Your secret keys allow access to your account sensitive operations, so keep them secure.
// Use the x-api-key header for all requests
x-api-key: YOUR_SECRET_KEYProtect your Secret Key
Never expose your secret keys in frontend code, mobile apps, or public repositories. Use server-side variables to store them.
Base URL
All API requests should be made to the following base URL:
https://api.vtstack.ng/apiStandard APIs use the base path, while Secure Payouts use the /v1 prefix as shown in the examples.
Endpoints
Create Virtual Account
Creates a new dedicated virtual bank account (PalmPay) for your customer.
| Parameter | Type | Description |
|---|---|---|
| firstName | string (Req) | Standard first name (Matches BVN record). |
| lastName | string (Req) | Standard last name (Matches BVN record). |
| string (Req) | Unique email address for the customer. | |
| bvn | string (Req) | 11-digit BVN for identity verification. |
| reference | string | Your unique internal customer/transaction ID. |
{
"firstName": "Hassan",
"lastName": "Ibrahim",
"email": "hassan@example.com",
"phone": "08012345678",
"bvn": "22123456789",
"reference": "user_id_102"
}Fetch Virtual Accounts
Returns a paginated list of all virtual accounts associated with your platform.
{
"success": true,
"data": [
{
"accountNumber": "8102345678",
"accountName": "Hassan Ibrahim",
"bankName": "PalmPay",
"status": "active"
}
]
}Bank Verification
Use VTStack's Bank Verification API to resolve and verify bank account details before initiating payouts. This helps prevent failed transfers by confirming the account holder's name and validating the account number against the bank.
Why Verify?
Always verify a bank account before sending money. This prevents sending funds to the wrong recipient and reduces dispute and chargeback risks. Verification is instant and powered by PalmPay infrastructure.
List Supported Banks
Returns a list of all supported Nigerian banks with their codes. Use the code value when calling the verify endpoint.
curl -X GET https://api.vtstack.ng/api/banks \
-H "x-api-key: YOUR_SECRET_KEY"Success Response
{
"success": true,
"data": [
{ "code": "100033", "name": "PalmPay" },
{ "code": "044", "name": "Access Bank" },
{ "code": "058", "name": "Guaranty Trust Bank" },
{ "code": "033", "name": "United Bank for Africa" },
{ "code": "057", "name": "Zenith Bank" }
]
}Verify Bank Account
Performs a Name Enquiry — resolves an account number to the registered account holder name. Pass the bankCode and accountNumber as query parameters.
| Parameter | Type | Description |
|---|---|---|
| bankCode | string (Req) | The bank code from the List Banks endpoint (e.g. "044" for Access Bank). |
| accountNumber | string (Req) | The 10-digit NUBAN account number to verify. |
Example Request
curl -X GET "https://api.vtstack.ng/api/banks/verify?bankCode=044&accountNumber=0123456789" \
-H "x-api-key: YOUR_SECRET_KEY"Success Response
{
"success": true,
"data": {
"accountName": "HASSAN IBRAHIM",
"accountNumber": "0123456789",
"bankCode": "044"
}
}Error Response
// 400 — Missing parameters
{
"success": false,
"message": "bankCode and accountNumber are required"
}
// 400 — Invalid account
{
"success": false,
"message": "Bank resolution failed"
}Integration Tip
Always verify the account name with your user before proceeding with a transfer. Display the resolved accountName and ask for explicit confirmation to prevent wrong-account payouts.
Webhooks
Webhooks are used to notify your server of events. We send a POST request to your configured URL when a deposit is received.
Signature Verification
Ensure your server validates the X-VTStack-Signature header using your webhook secret to prevent spoofing calls.
{
"event": "transaction.deposit",
"data": {
"reference": "TXN_7726182",
"amount": 5000,
"currency": "NGN",
"customer": { "name": "Hassan Ibrahim" },
"timestamp": "2026-03-20T14:30:00Z"
}
}Errors & Handling
Our API returns standard HTTP status codes. Errors are always returned in a JSON format for easy parsing.
| Code | Meaning | Description |
|---|---|---|
| 400 | Bad Request | Required parameters are missing or invalid. |
| 401 | Unauthorized | Invalid or missing API key. |
| 422 | Validation Error | BVN verification failed or duplicate account found. |
| 429 | Too Many Requests | Your platform has exceeded the rate limit. |
| 500 | Server Error | Something went wrong on our end. |
Best Practices
Key Management
Never hardcode your API keys. Use environment variables and store them in vault systems like Hashicorp Vault or AWS Secrets Manager.
Idempotency
Always use unique reference strings for account creation to avoid creating duplicate accounts for the same user on retries.
Was this documentation helpful?
© 2026 VTStack Documentation. Powered by VTfree Infrastructure.
