Start here

Harbour for developers

What Harbour does, what it never does, and the shape of an integration.

Harbour routes payments through a business's own Paystack, Flutterwave or OPay account, receives the provider's webhook, and keeps one ledger, one settlement calendar and one set of alerts across all of them. You integrate once, against Harbour, and the business can add or switch providers without you shipping anything.

How a payment flows

Every integration, whether you use the SDK, the API or a payment link, is the same five steps:

  1. Your server asks Harbour to create a charge for an amount and a customer.
  2. Harbour creates the checkout on the business's provider and gives you a checkout URL.
  3. The customer pays on the provider's own hosted page. Card details never touch Harbour, and never touch you.
  4. The provider tells Harbour what happened. Harbour writes the ledger and sends you a webhook.
  5. Your server verifies and fulfils the order.

Steps 4 and 5 are the ones that decide whether an order is paid. The customer coming back to your return_url is a hint, never proof: browsers close, networks drop, and query strings can be edited.

The pieces you integrate

PieceWhat it isWhen to use it
Harbour ConnectThe official PHP SDK, zero dependenciesAny PHP app. Start here.
Harbour APIJSON over HTTPS, bearer authenticatedNode, Python, .NET, Go, or anything that is not PHP.
harbour.jsA popup checkout for the browserAn existing page where you would rather not redirect.
Payment linksA link the business sharesNo developer, no site, or a one-off invoice.
WebhooksSigned events from Harbour to your serverAlways. This is what fulfils orders.

Before you write code

Three things belong to the business, not to you, and all three are done in the Harbour dashboard:

  • A provider connected in the mode you are about to use. Test keys reach the provider's test keys only, so a test integration needs a provider connected in test mode.
  • Harbour keys for that mode, from Settings → Developers.
  • A webhook endpoint pointing at your server, with its own signing secret.

The quickstart walks through all three and ends with a paid test payment.

Where to start