Nequi

Get started with Nequi

This page provides a comprehensive guide to successfully integrating Nequi with DEUNA in your checkout.

Nequi is a digital wallet managed by Bancolombia and is widely used in Colombia.

How it works

DEUNA's integration with Nequi enables users to pay through a push notification flow, fully handled within the DEUNA Payment Widget — no external redirections required.

Payment process

The following list describes a valid payment process with Nequi:

User selects Nequi inside the Payment Widget.
User enters their real Nequi phone number.
A push notification is sent to their Nequi mobile app.
The user approves the payment directly in the app.
DEUNA receives the payment status .
DEUNA triggers the appropriate callback event in the widget:
- onSuccess for approved payments
- onError for declined or expired ones

onError event handling

The DEUNA widget triggers the onError callback in the following scenarios:

The phone number provided in the checkout form is valid but not associated with a Nequi account.
The user rejects the push notification from the Nequi app.

In both cases, DEUNA returns a response including an error code and error message describing the failure. You can handle the response based on your business logic and desired user experience.

📘
Callback events gives you the flexibility to determine how to guide the user forward, depending on your UX goals and operational needs.

Requirements

The following content lists all the requirements for a successful integration with Nequi.

Your Nequi sandbox and production credentials must be requested directly from your Bancolombia or Nequi account manager.

Environments:

Sandbox: https://api.sandbox.deuna.io
Production: https://api.deuna.io

Complete the certification process with Nequi and obtain the following credentials provided by Nequi:

Merchant ID
Merchant Password
Private Key.

📘
These credentials must be configured in the DEUNA Admin as connection credentials.

Configure webhooks in Nequi

Configure webhooks in your Nequi session for every store.

If you do not configure the Nequi webhooks, then the status updates in Nequi will lag between two to five minutes.

Ensure your webhook endpoint is highly available and scalable. Optionally, you can configure transaction reversal if payment confirmation fails due to service unavailability.

Webhook Payload

Nequi will send the following JSON payload:

{
  "commerceCode": "29603",
  "value": "1",
  "phoneNumber": "3195414070",
  "messageId": "60396545535",
  "transactionId": "350-12345-34000201-60396545535",
  "region": "C001",
  "receivedAt": "2023-02-27T15:50:13.527Z",
  "paymentStatus": "SUCCESS"
}

Payload Fields

Field	Description
`commerceCode`	Your internal Nequi merchant code
`value`	Payment amount
`phoneNumber`	Payer's mobile phone number
`messageId`	Unique transaction identifier
`transactionId`	Payment identifier
`region`	Payment region: `P001` (Panama) or `C001` (Colombia)
`receivedAt`	Payment timestamp in JSON format
`paymentStatus`	Payment status: `SUCCESS`, `CANCELED`, or `DENIED`

Security request verification

All webhook requests from Nequi include security headers that you must verify:

Request Headers

{
  "Content-Type": "application/json",
  "Digest": "SHA-256=43GpOk5L54gfpAMBE0xNX1bj2hJA9JJ1RR0dErHfZhI=",
  "Signature": "keyId=\"YourClientId\",algorithm=\"hmac-sha384\",headers=\"content-type digest\",signature=\"...\""
}

Verification Process

You must verify two things for each request:

1. Verify body digest

The Digest header contains a SHA-256 hash of the request body:

// Convert body to string
const parsedBody = JSON.stringify(request.body);

// Calculate SHA-256 hash
const calculatedDigest = `SHA-256=${createHash('sha256')
  .update(parsedBody)
  .digest('base64')}`;

// Verify it matches the header
if (calculatedDigest !== request.headers.Digest) {
  return 401; // Invalid Digest
}

2. Verify the request signature

The Signature header ensures the request came from Nequi:

Parse the Signature header.

const parts = request.headers.Signature.split(',');
const signature = {};

for (const part of parts) {
  const [key, value] = part.split('=');
  signature[key] = value.slice(1, -1); // Remove quotes
}

// Result:
// {
//   keyId: "YourClientId",
//   algorithm: "hmac-sha384",
//   headers: "content-type digest",
//   signature: "..."
// }

Build the signing text.

const headerNames = signature.headers.split(' '); // ["content-type", "digest"]
const linesForSignature = [];

for (const headerName of headerNames) {
  const value = request.headers[headerName.toLowerCase()];
  linesForSignature.push(`${headerName}: ${value}`);
}

const textForSignature = linesForSignature.join('\n');
// Result:
// "content-type: application/json
// digest: SHA-256=43GpOk5L54gfpAMBE0xNX1bj2hJA9JJ1RR0dErHfZhI="

Calculate and verify HMAC.

const APP_SECRET = 'YourSharedSecret'; // Store securely, never hardcode

// Calculate HMAC-SHA384
const base64hmac = createHmac('sha384', APP_SECRET)
  .update(textForSignature)
  .digest('base64');

// Convert to base64url format
const calculatedSignature = base64hmac
  .replace(/\+/g, '-')
  .replace(/\//g, '_')
  .replace(/=+$/, '');

// Verify signature
if (calculatedSignature !== signature.signature) {
  return 401; // Invalid Signature
}

🔒
Security Best Practice: Store your shared secret securely using environment variables or encrypted database storage. Never hardcode secrets in your application code.

Complete Implementation Example (Node.js)

const { createHash, createHmac } = require('node:crypto');

// Store securely - use environment variables
const APP_SECRET = process.env.NEQUI_WEBHOOK_SECRET;

async function handleNequiWebhook(request, response) {
  try {
    // 1. Verify Body Digest
    const parsedBody = JSON.stringify(request.body);
    const calculatedDigest = `SHA-256=${createHash('sha256')
      .update(parsedBody)
      .digest('base64')}`;
    
    if (calculatedDigest !== request.headers.digest) {
      return response.status(401).send('Invalid Digest');
    }

    // 2. Parse Signature Header
    const parts = request.headers.signature.split(',');
    const signatureData = {};
    
    for (const part of parts) {
      const [key, value] = part.split('=');
      signatureData[key] = value.slice(1, -1);
    }

    // 3. Build Signing Text
    const headerNames = signatureData.headers.split(' ');
    const linesForSignature = headerNames.map(name => 
      `${name}: ${request.headers[name.toLowerCase()]}`
    );
    const textForSignature = linesForSignature.join('\n');

    // 4. Verify Signature
    const base64hmac = createHmac('sha384', APP_SECRET)
      .update(textForSignature)
      .digest('base64');
    
    const calculatedSignature = base64hmac
      .replace(/\+/g, '-')
      .replace(/\//g, '_')
      .replace(/=+$/, '');

    if (calculatedSignature !== signatureData.signature) {
      return response.status(401).send('Invalid Signature');
    }

    // 5. Process the payment notification asynchronously
    processPaymentAsync(request.body);

    // 6. Respond immediately (within 10 seconds)
    return response.status(200).send('OK');

  } catch (error) {
    console.error('Webhook processing error:', error);
    return response.status(500).send('Internal Server Error');
  }
}

async function processPaymentAsync(paymentData) {
  // Process payment in background
  // Update your database, trigger notifications, etc.
  
  const { transactionId, paymentStatus, value, phoneNumber } = paymentData;
  
  if (paymentStatus === 'SUCCESS') {
    // Handle successful payment
  } else if (paymentStatus === 'CANCELED' || paymentStatus === 'REFUSED') {
    // Handle failed payment
  }
}

Integrate Nequi

Now that the technical requirements are set, you can start the step-by-step integration.

1. Create an `order_token`

To make a purchase, you must create a DEUNA order.

Make a request to the Create an Order endpoint.

The API returns an order_token, which is used throughout the entire flow.

2. Get the `order_token`

Make a request to the Get Order endpoint.

Use this token for the next steps.

3. Render the payment widget

After receiving the order token, you can render the DEUNA widget.

📘
You can configure the payment widget to render only Nequi by passing the paymentMethods parameter during your sdk initialization.

await DeunaSDK.initPaymentWidget({
    orderToken: "<DEUNA order token>",
    callbacks: ...,
    paymentMethods: [
        {
            paymentMethod: "voucher",
            processors: ["nequi_push_voucher"],
        },
    ],
});

4. Make a card payment

Make a card payment request to the V1 Purchase endpoint and process the payment.

Response

{
  "order": {
    "cash_change": 0,
    "currency": "USD",
    "discounts": [],
    "display_items_total_amount": "",
    "display_shipping_amount": "",
    "display_sub_total": "",
    "display_tax_amount": "",
    "display_total_amount": "",
    "display_total_discount": "",
    "gift_card": [],
    "items": [
      {
        "brand": "",
        "category": "",
        "color": "",
        "description": "Papa Fritas",
        "details_url": "",
        "discounts": [],
        "id": "001",
        "image_url": "https://images-staging.getduna.com/95463fb5-6279-4ec3-8ff9-fe07aacd2142/cd928351d12c6b96_domicilio_316_744x744.png?d=600x600",
        "isbn": "",
        "manufacturer": "",
        "name": "Papa Fritas",
        "options": "",
        "quantity": 1,
        "size": "",
        "sku": "",
        "tax_amount": {
          "amount": 44,
          "currency": "USD",
          "currency_symbol": "$",
          "display_amount": ""
        },
        "taxable": false,
        "total_amount": {
          "amount": 594,
          "currency": "USD",
          "currency_symbol": "$",
          "display_amount": "",
          "display_original_amount": "",
          "display_total_discount": "",
          "original_amount": 0,
          "total_discount": 0
        },
        "type": "",
        "unit_price": {
          "amount": 550,
          "currency": "USD",
          "currency_symbol": "$",
          "display_amount": ""
        },
        "uom": "",
        "upc": "",
        "weight": {
          "unit": "",
          "weight": 0
        }
      },
      {
        "brand": "",
        "category": "",
        "color": "",
        "description": "Hamburguesa ",
        "details_url": "",
        "discounts": [],
        "id": "002",
        "image_url": "https://images-staging.getduna.com/95463fb5-6279-4ec3-8ff9-fe07aacd2142/cd928351d12c6b96_domicilio_51330_744x744_1646338877.png?d=600x600",
        "isbn": "",
        "manufacturer": "",
        "name": "Hamburguesa",
        "options": "",
        "quantity": 2,
        "size": "",
        "sku": "",
        "tax_amount": {
          "amount": 88,
          "currency": "USD",
          "currency_symbol": "$",
          "display_amount": ""
        },
        "taxable": false,
        "total_amount": {
          "amount": 3088,
          "currency": "USD",
          "currency_symbol": "$",
          "display_amount": "",
          "display_original_amount": "",
          "display_total_discount": "",
          "original_amount": 0,
          "total_discount": 0
        },
        "type": "",
        "unit_price": {
          "amount": 1500,
          "currency": "USD",
          "currency_symbol": "$",
          "display_amount": ""
        },
        "uom": "",
        "upc": "",
        "weight": {
          "unit": "",
          "weight": 0
        }
      }
    ],
    "items_total_amount": 3682,
    "metadata": {
      "key1": "NO REQUERIDO",
      "key2": "NO REQUERIDO"
    },
    "order_id": "order116",
    "payment": {
      "data": {
        "amount": {
          "amount": 3770,
          "currency": "USD"
        },
        "authorization_3ds": {
          "html_content": "<div></div>",
          "url_challenge": "",
          "version": "1.1.1"
        },
        "authorization_code": "TEST00",
        "created_at": "2022-07-22 20:22:48.408419489 +0000 UTC",
        "customer": {
          "email": "[email protected]",
          "id": "xxxxxx-0eb3-450f-8b26-4ff23208470f"
        },
        "from_card": {
          "card_brand": "Visa",
          "first_six": "411111",
          "last_four": "1111"
        },
        "id": "order116",
        "installments": {
          "installment_amount": 5999,
          "installment_rate": 0.12,
          "installment_type": "MCI",
          "installments": 3,
          "plan_id": "7471ed27-094d-44c4-a62d-225644b782f7",
          "plan_option_id": "87309ea8-3942-4fdf-95ec-ce29a792aff2"
        },
        "merchant": {
          "id": "9a85e296-cc3d-454b-b591-208d6e538126",
          "store_code": "all"
        },
        "metadata": {
          "authorization_code": "TEST00"
        },
        "method_type": "credit_card",
        "processor": "paymentez",
        "reason": "",
        "status": "processed",
        "updated_at": "2022-07-22 20:22:48.408809765 +0000 UTC"
      }
    },
    "redirect_url": "",
    "scheduled_at": "",
    "shipping": null,
    "shipping_address": {
      "additional_description": "Piso 9",
      "address_type": "home",
      "address1": "Av. de los Incas 15-33, Ambato 180202, Ecuador",
      "address2": "Av. de los Incas 15-33, Ambato 180202, Ecuador",
      "city": "Ambato",
      "country_code": "EC",
      "created_at": "0001-01-01T00:00:00Z",
      "first_name": "Jhon",
      "id": 0,
      "identity_document": "146565656",
      "is_default": true,
      "last_name": "Doe",
      "lat": -1.2480678792202227,
      "lng": -78.62532788804577,
      "phone": " 946565665",
      "state_name": "Tungurahua",
      "updated_at": "0001-01-01T00:00:00Z",
      "user_id": "xxxxx4e2-xxxx-xxxx-xxxx-xxxxx5b7b2e",
      "zipcode": "180202"
    },
    "shipping_amount": 0,
    "shipping_method": null,
    "shipping_methods": [],
    "shipping_options": {},
    "status": "succeeded",
    "store_code": "",
    "sub_total": 3550,
    "tax_amount": 132,
    "timezone": "",
    "total_amount": 3770,
    "total_discount": 0,
    "user_instructions": "Piso 9",
    "webhook_urls": null
  },
  "order_token": "0b98dbe8-d265-49bc-b80d-536cea46509c"
}

Test Nequi

Nequi can only be tested using real user data. When using Nequi, an actual charge will be made to the customer’s real account.

If necessary, the payment can be refunded via the DEUNA Admin Panel or through the Refunds API.

Get started with Nequi

How it works

Payment process

onError event handling

Callback events gives you the flexibility to determine how to guide the user forward, depending on your UX goals and operational needs.

Requirements

Configure webhooks in Nequi

Webhook Payload

Payload Fields

Security request verification

Request Headers

Verification Process

1. Verify body digest

2. Verify the request signature

Complete Implementation Example (Node.js)

Integrate Nequi

1. Create an order_token

2. Get the order_token

3. Render the payment widget

You can configure the payment widget to render only Nequi by passing the paymentMethods parameter during your sdk initialization.

4. Make a card payment

Test Nequi

1. Create an `order_token`

2. Get the `order_token`

You can configure the payment widget to render only Nequi by passing the `paymentMethods` parameter during your sdk initialization.