# Nedbank Partner Technical Pack The Nedbank Partner Technical Pack provides the technical specifications, integration standards, and certification requirements for the PAMP × Nedbank partnership. This document serves as the primary technical reference for the DukaExpress payment integration team. ## Partnership Overview ## Technical Architecture ### Integration Model DukaExpress uses the Nedbank JavaScript SDK integration model, where the Nedbank-provided SDK is embedded in the DukaExpress checkout page. Card data is collected by the SDK and sent directly to Nedbank — it never passes through PAMP servers. SDK SDK -->|Card data direct| TOKEN_SVC TOKEN_SVC --> THREEDS_SVC THREEDS_SVC --> EPAY_SVC SDK -->|Token only| CHECKOUT CHECKOUT --> API_GW API_GW --> PAY_SVC PAY_SVC --> IDENTITY_SVC PAY_SVC -->|Token-based requests| EPAY_SVC EPAY_SVC --> SETTLE_SVC SETTLE_SVC --> WEBHOOK_SVC WEBHOOK_SVC --> PAY_SVC PAY_SVC --> LEDGER_SVC `} /> ### API Connectivity ## Sandbox Credentials Guidance ### Obtaining Credentials 1. Register a developer account on the Nedbank API Market portal (apimarket.nedbank.co.za) 2. Create a new application and select the required API products (ePay, Payments, Wallet, VAS, Rewards, Customers) 3. The portal generates a `client_id` and `client_secret` for the sandbox environment 4. Store credentials securely — never commit to version control ### Credential Management {`# Environment variables for sandbox NEDBANK_BASE_URL=https://api.nedbank.co.za/apimarket/sandbox NEDBANK_CLIENT_ID= NEDBANK_CLIENT_SECRET= NEDBANK_WEBHOOK_SECRET= # Never hardcode credentials in source code # Use environment variables or a secrets manager (HashiCorp Vault, AWS Secrets Manager)`} ### Test Data ## Certification Requirements ### Sandbox Certification Before progressing to UAT, the integration must demonstrate the following capabilities: ### UAT Certification ## Integration Standards ### Request Headers All API requests must include the following headers: {`Authorization: Bearer Content-Type: application/json Accept: application/json Idempotency-Key: # Required for all POST/PUT/DELETE X-Request-Id: # Recommended for tracing X-Partner-Id: pamp-dukaexpress # Partner identification User-Agent: DukaExpress/1.0 # Client identification`} ### Webhook Signature Validation {`import crypto from 'crypto'; function validateWebhookSignature( payload: string, signature: string, secret: string ): boolean { const expectedSignature = crypto .createHmac('sha256', secret) .update(payload) .digest('hex'); return crypto.timingSafeEqual( Buffer.from(signature), Buffer.from(expectedSignature) ); } // Usage in webhook handler app.post('/webhooks/nedbank', (req, res) => { const signature = req.headers['x-nedbank-signature'] as string; const isValid = validateWebhookSignature( JSON.stringify(req.body), signature, process.env.NEDBANK_WEBHOOK_SECRET! ); if (!isValid) { return res.status(401).json({ error: 'Invalid signature' }); } // Process webhook event... res.status(200).json({ received: true }); });`} ### Error Handling Standards - All 4xx errors must be logged with request context (request ID, merchant ID, endpoint) - All 5xx errors must trigger automatic retry with exponential backoff - Gateway timeouts must check payment status before retrying to prevent duplicate charges - Circuit breaker must open after 5 consecutive failures or 50% failure rate in 60 seconds - All errors must be reported to the observability stack with structured metadata ### Data Format Standards - All monetary amounts are in the major currency unit (e.g., 1250.00 ZAR, not 125000 cents) - All timestamps are ISO 8601 format in UTC (e.g., 2026-03-15T14:30:00Z) - All currency codes are ISO 4217 (ZAR, NGN, KES, MAD, CDF, XOF, GHS) - All IDs are UUID v4 format - All phone numbers are E.164 format (e.g., +27821234567) ## Support Channels