Changelog

Under Team you can invite people by email or phone and give each a role: Admin, Finance, Sales, Events or Viewer, or a role of your own where you tick exactly what they can do, area by area. You choose whether they work in every business or only some. Everything they can't do disappears from their menus, and CitaPay refuses it anyway, including through the AI Assistant. Every change is in the Activity log with who made it. Someone you invite sees the invitation in their dashboard however they signed up, with Google or a password, and can accept or decline it there.

In Team, Organisation, an owner can set an amount above which payouts wait for someone else to approve them. Single payouts, bulk payouts and new recurring payouts above it go to Money, Approvals, where a person whose role includes approving payouts approves or declines them, with a reason. Nobody approves their own, and both sides are told. If nobody else could approve, payouts go out as before.

The logo you add to your organisation now shows on your payment links, checkout, invoices, receipts, event pages, tickets and the emails your customers get, as well as in the account switcher. Without a logo, your initials show instead.

Signing up or signing in now recognises your email however it's typed: capital letters, and for Gmail, dots or a +tag. If you already have an account through Google, signing up with a password reaches that same account instead of making a second one, and signing in with Google links to an account you made with a password.

Every account now sits in an organisation, named after your business (or you), and nothing about how you work changes. From the switcher in the top bar you can move between your organisations and their businesses, and CitaPay remembers where you were, across reloads and your next sign-in. Under Settings, Organisation you can rename it, add a logo, create more organisations, and add businesses, such as a second branch or an online shop. Once your organisation is verified, a business you add is covered by that verification and can take payments straight away; it pays out only to accounts your organisation has already verified.

If your platform serves businesses that need to get paid, such as schools, academies or shops, you can now open a CitaPay account for each of them from your own app. Apply under Settings, Partner access, and once approved and the Partner Agreement is accepted, create a key with the "Open CitaPay accounts for your customers" permission. You send the business's details and documents, CitaPay reviews them as usual, and the owner gets an email to set a password. Each account belongs to that business: its money, its login, its payouts. Once it is verified you can create a key to collect payments into it, but never one that sends its money out, and nothing can be paid out until the owner has accepted. You hear about every step by webhook, and the sandbox lets you approve test accounts yourself. See the Partners section of the developer docs.

Every API key now carries a list of permissions, and every endpoint checks the one it needs. When you create a key you can untick anything your integration doesn't use, and you can change a key's permissions at any time from Settings, API keys. Your existing keys keep everything they could already do, so no integration needs to change. If someone else created a key on your account, it shows who, and only you can let it send money out, after entering your password.

Much more of CitaPay now works from your own code with an API key: read your wallet balance and ledger, send money to other CitaPay wallets, manage payout destinations, scheduled payouts and bulk payouts, send and pay requests to other businesses, and manage payment links, invoices and customers. Everything follows the same rules as the dashboard, with the same verification, limits and fees, and endpoints that move money accept an Idempotency-Key so a retry never pays twice.

Paid event tickets now carry a booking fee of 4% a ticket, at least KES 20 and at most KES 300, paid by the buyer on top of your price. You get your full ticket price, and free tickets have no fee. Buyers see the fee at checkout before they pay. If you would rather buyers see one price, switch on "Include the booking fee in my ticket price" on your event and the fee comes out of your sales instead. The booking fee is not refunded when you refund an order.

CitaPay no longer takes a cut of the money you receive. Payment links, checkout, invoices, tickets and top-ups land in your wallet in full, because your customers already pay their provider's usual charge. You pay a small fee only when money leaves CitaPay: cashing out or sending to mobile money or a bank costs KES 5 to KES 100 depending on the amount, with the provider's charge included. It is never more than KES 100. Sending to anyone on CitaPay stays free. Personal and business accounts pay the same, and every fee is shown before you confirm. See Settings, Fees for the full list.

There is nothing to switch on or pay for any more. Savings and Chamas now sit in your menu from day one, and nobody is billed for them again. Anyone who was paying for Chamas keeps them, free. Tip jars and fundraisers also got a fix: tapping a suggested amount now picks it straight away, and you can always type your own.

Lay out your venue as sections of rows and seats, each priced by a ticket type, and buyers pick their exact seats; nobody can ever get the same seat as someone else. Let buyers pay a deposit now and the rest by a date you set (lipa pole pole): their seats stay held, they get a reminder the day before, and their tickets arrive once it is all paid. If the balance is missed, the seats go back on sale and you choose whether the deposit is kept or refunded. The day after the event, everyone who came gets one email asking for a rating, and you see the average and every comment. A new Reports tab shows sales over time and by ticket type, link and promo code, when people arrived, how many never came, and refunds, and you can download the orders or the guest list as CSV or PDF. If you issue eTIMS receipts, each ticket payment is now an itemised receipt with every ticket type at its own VAT rate.

A ticket type can now cover several seats, such as a Table of 10: priced once, with a ticket for every seat that the buyer can name. Sell extras with your tickets, such as parking, merchandise or drink vouchers, each with its own stock and its own QR code scanned once at the gate or the bar. Make an event repeat (every Saturday for 8 weeks): each date has its own tickets and one link lets the buyer pick the date. And the event page now updates sales and check-ins as they happen, without a refresh.

Create promo codes for your events, such as EARLY20 for 20% off, limited to some ticket types, a number of uses or a date, and give each promoter their own code to see what they sold. When a ticket type sells out, buyers can join a waitlist: when seats come free they are held for the next person in line, who gets an email to buy them. Send door staff a private link that opens only check-in and the guest list, with no account and no access to your money. And message your attendees by SMS or email, all of them, one ticket type, or only those not yet checked in, seeing how many people it reaches and what it costs before you send.

Create an event with as many ticket types as you need (early bird, regular, VIP or free), each with its own price, how many are on sale, sale dates and a limit per order. Share the event's ticket link and buyers pick their tickets, pay by M-Pesa and get them by email straight away, each with its own QR code, a PDF to download and an "Add to calendar" button. A buyer can send each ticket to a different person. Seats are held while someone pays, so you never sell more than you have. On the event page you see tickets sold and left, what you take home after CitaPay's fee (and the fee itself, per order), orders and attendees as they come in, broken down by ticket type and by link, and you can resend, cancel or refund tickets or put one in someone else's name. At the door, open Check in and scan tickets with your phone camera: each one gets in once, and a copied or cancelled ticket is turned away. Developers can read events and attendees, check people in from their own app and receive ticket webhooks.

Every list in CitaPay now lets you select rows and act on all of them at once: cancel subscriptions, change invoice due dates, retry webhooks, resend tickets and more. Any selection can be exported as a spreadsheet or have its ids copied. On a phone, tap and hold to start selecting.

Choose where the AI Assistant opens: beside the page, over all of it, or as a floating window you can drag and resize while you keep working. Its button can be dragged to either edge of the screen and tucks away when idle. On an invoice, customer or payout, Ask AI summarises it or tells you what changed since you last looked. You can also schedule questions, such as every Monday at 9:00, what is overdue this week, and get the answer in your notifications.

Sign in with your fingerprint, face or device PIN instead of a password, and add or remove passkeys in Settings. Notifications now read as short sentences, grouped by day, with Unread and Done tabs, so you can mark things done and keep your inbox clear. All your notification settings live on one page.

We're building an AI Assistant that helps you run your business right inside CitaPay. Ask it anything about your business — 'How much did I make last week?', 'Which customers haven't paid?', 'Show me my best-selling payment link.' It reads your live data and answers instantly. When you're ready to take action, it drafts what you want ('send an SMS to my top customers', 'refund transaction TXN_ABC', 'create a payment link for KES 2,000') and hands you a confirmation card — you click Approve, we execute. Every action carries the same audit trail as if you'd done it manually. The Assistant runs on Google Gemini's free tier at launch; heavier use is powered by AI credits you can buy à la carte or receive as a free daily grant. This changelog entry marks the foundation shipping — the runtime, credit ledger, and safety guardrails are now live in the codebase; the chat surface follows in the next release. Turn it on in Settings → AI Assistant when it launches. Opt-in only — your data stays in CitaPay unless you enable it.

The recurring-billing engine is now fully integrator-facing. Browse a merchant's plans without auth at GET /v1/public/merchants/:id/plans, then create and manage subscriptions with your Secret API Key under /v1/checkout/subscriptions — create (idempotent), list, get, cancel, pause, resume, retry-billing, and change-plan. Plan changes follow the industry standard: upgrades take effect once a prorated charge for the remaining days of the period clears (renewal date unchanged), downgrades are scheduled for the end of the current period (no refund), and trial subscriptions switch immediately. Automatic dunning retries failed charges at 24h then 72h before moving the subscription to PAST_DUE. Ten new subscription webhook events fire across the lifecycle — subscription.billed, subscription.billing_failed, subscription.past_due, subscription.trial_ended, subscription.paused, subscription.resumed, subscription.plan_changed, subscription.expired (alongside subscription.created and subscription.cancelled) — each carrying subscriptionId, merchantId, and the new status so you can mirror state without polling. Subscribe a webhook endpoint to subscription.* to get them all. Full reference in the Subscriptions API docs section.

You can now register up to 10 webhook endpoints per account, each with its own URL, signing secret, and event filter — so you can route different categories of events to different apps without forking your CitaPay account. Filters support wildcards (e.g. payment.* receives every current and future payment.* event) so subscriptions are forward-compatible. Each endpoint signs with its own secret; compromising one secret never exposes another endpoint's traffic. Manage endpoints under Settings → Developers → Webhooks or via the API at /v1/checkout/webhook-endpoints (GET, POST, PATCH, DELETE, plus POST /:id/rotate-secret). Existing merchants were auto-migrated: your previous single webhook is now a "Default" endpoint with all the same settings. The legacy PUT /v1/checkout/webhook keeps working but is deprecated — new integrations should use the multi-endpoint API.

The merchant SMS API now supports scheduled sends (up to 30 days out, cancellable with credit refund), bulk sends of up to 500 recipients per call sharing a batchId, and admin-reviewed templates (new templates land as DRAFT, admins approve under Admin → SMS Templates before they're usable). Marketing-category templates auto-append a STOP opt-out footer. Per-merchant rate limits (60 segments/minute, 2,000/day by default) return HTTP 429 with a resetAt. Webhook events sms.sent and sms.failed fire into your configured webhook URL so you can reconcile without polling. Admins can tune per-merchant limits and disable the SMS API per-account from the admin panel.

Every channel that sends SMS — merchant API, system notifications (payment received, payout completed, B2B alerts), customer payment confirmations, and payout recipient SMS — now reserves credits atomically at queue-time and refunds them automatically on permanent failure. Previously a read-then-check path could let two concurrent sends race past a 1-credit balance; under the new reservation model a merchant without credits cannot send through any channel.

A nightly cron now prunes NotificationDelivery rows older than 90 days so the audit table doesn't grow unbounded. The retention window is configurable via the NOTIFICATION_RETENTION_DAYS env var if your compliance posture needs longer.

Send transactional SMS to your customers using your CitaPay credits. Create reusable templates with {{placeholders}} under Dashboard → SMS → Templates, then send them from your backend with POST /v1/sms/send. Credits are reserved per segment up-front and refunded automatically on permanent delivery failure. Test API keys walk the full pipeline without consuming credits so you can integrate for free.

Every successful payin now also sends a confirmation SMS to the paying customer — silently skipped if the merchant has no SMS credits remaining. Works for dashboard, checkout link, and API-initiated payments alike.

Destructive and irreversible actions across the dashboard — deleting API keys, removing payout destinations, cancelling scheduled payouts, deleting customers, bills, subscription plans, B2B requests, and notifications — now require explicit confirmation before proceeding. A clear dialog explains what will happen and lets you cancel safely.

B2B payment request events — a new incoming request, an accepted request, and a declined request — now trigger SMS notifications alongside the existing in-app alerts. If you have SMS notifications enabled, you will receive a text immediately when a counterpart sends, accepts, or declines a payment request, so you can act without needing to open the dashboard.

Per-channel, per-event notification preferences set in Settings → Notifications are now correctly enforced at dispatch time. Previously, disabling SMS for a specific event type would update the preference in the database but the SMS would still be sent. All channels — in-app, SMS, and email — now respect your saved preferences.

Merchants can now receive real-time SMS alerts for key events — payments received, payouts completed, and payout failures. SMS notifications are powered by Africa's Talking and consume credits from your account. Enable or disable individual event types per channel in Settings → Notifications. Admins can top up SMS credits for any merchant via the admin panel.

A new Webhook Delivery dashboard is available under Developers. See every webhook delivery attempt — event type, HTTP status code, number of attempts, and last attempt time — all in one table. Failed deliveries can be retried with a single click without leaving the dashboard.

Export your full transaction history as a CSV file directly from the Transactions page. Use the Export button to download all transactions with reference, date, type, status, amount, fee, net amount, customer name, phone, and payment method. Filters applied to the table are respected in the export.

In addition to CSV, you can now export your transactions as a formatted PDF report. The PDF includes your business name, the export date, and a clean tabular layout of all matching transactions. Download it instantly from the Export dropdown on the Transactions page.

Each transaction now has its own dedicated detail page at /dashboard/transactions/:reference. View the full breakdown — amounts, fees, net received, provider reference, customer info, payment method, and timeline. The page is fully responsive across desktop, tablet, and mobile, and includes a one-click refund action for eligible pay-in transactions.

CitaPay now has a dedicated sandbox environment at sandbox.pay.citatech.cloud — fully isolated from production with its own database, accounts, and API keys. Create a sandbox account to test your integration end-to-end without any risk to live data. Everything works exactly as in production: wallet balance is credited from test payments, in-app notifications fire, subscriptions and invoices update state, and webhooks are delivered with an isTest: true flag so your system can tell them apart.

API keys are now strictly bound to their environment. Test keys (sk_test_...) are rejected on the production API and live keys (sk_live_...) are rejected on the sandbox API. Keys created in the sandbox dashboard are always test keys; keys created in the production dashboard are always live keys — no manual toggle required.

All webhook event payloads now include an isTest boolean field. Use it in your webhook handler to distinguish sandbox events from production events — for example, to skip order fulfillment or revenue tracking for test transactions.

External developers can now integrate CitaPay directly into their applications using API keys — no dashboard login required. New endpoints: POST /checkout/payments, POST /checkout/payouts, and GET /checkout/transactions/:reference. Supports test mode (sk_test_) for end-to-end sandbox testing without moving real money.

A full interactive documentation portal is now live in the dashboard under Developer Settings. Covers authentication, the Payments API, Payouts API, Webhooks (9 events), a step-by-step Testing Guide, a Going Live checklist, and a complete Error Reference.

Checkout endpoints are now rate-limited per merchant API key rather than per IP address. This prevents merchants on shared hosting or behind cloud NAT from throttling each other. Limits: 15 req/s burst, 100 per 10 seconds, 500 per minute.

Complete sandbox environment for integrators. Use sk_test_ API keys to trigger realistic payment and payout flows without contacting any real payment provider. Test transactions auto-complete after ~5 seconds, webhooks fire normally against your configured endpoint, and externalReference is populated with a TEST-prefixed mock reference.

Every merchant now has a dedicated wallet with real-time available and pending balance tracking. Top up instantly via M-Pesa, receive incoming M-Pesa payments instantly to your available balance, and withdraw directly to your M-Pesa account.

You can now create, manage, and instantly send professional invoices directly to your customers. It completely integrates with M-Pesa STK push for fast payments.

Launch your payouts faster. Upload a CSV of phone numbers and amounts to easily process hundreds of B2C payouts via M-Pesa simultaneously.

Added configurable per-merchant withdrawal limits to protect against large unauthorized withdrawals. Limits are enforced at 20,000/hour and 100,000/day by default, helping keep merchant funds secure.

Easily generate and share payment links online without writing any code. Every link comes with a beautifully hosted checkout page and instant QR codes.

M-Pesa pay-ins settle instantly into your available balance. A background hourly settlement cron handles future card and bank hold periods, giving merchants accurate, up-to-date available balances.

Turn your customers into recurring revenue. Create complex subscription plans with automated trials, recurring charges, and automatic transaction retries.