API Reference

Terabox Streaming & Paytm Gateway API

Two APIs, one signed auth flow. Resolve Terabox share links into high-bitrate stream URLs, and verify Paytm transactions in real time. Every request is signed with HMAC-SHA256, so nothing can be forged or replayed.

BASE URL https://api.mswpresents.tech
ProtocolHTTPS · REST
AuthHMAC-SHA256
FormatJSON
StackFastAPI

Authentication

Both APIs share the same scheme. You sign each request body, tying the signature to the payload and a timestamp. This section applies to every endpoint below.

HeaderRequiredDescription
X-API-KeyrequiredYour public key. Terabox keys start with tbx_, Paytm keys with anku_.
X-SignaturerequiredHex HMAC-SHA256 of timestamp:body using your secret.
X-TimestamprequiredUnix seconds. Requests drifting beyond ±300s (5 min) are rejected.
Content-TypefixedMust be application/json.

1 Build the Signature

Serialize the JSON body with sorted keys and no whitespace, prepend the timestamp, then HMAC it with your secret. Send that exact byte-identical string as the request body, or the signature won't match server-side.

import hmac, hashlib, time, json, requests

API_KEY    = "tbx_your_api_key"
API_SECRET = "your_api_secret"
BASE_URL   = "https://api.mswpresents.tech"

def create_signature(api_secret, timestamp, body):
    """Create HMAC-SHA256 signature. No spaces after separators!"""
    body_str  = json.dumps(body, separators=(",", ":"), sort_keys=True)
    message   = f"{timestamp}:{body_str}"
    return hmac.new(api_secret.encode(), message.encode(), hashlib.sha256).hexdigest()

def get_link(terabox_url):
    timestamp = int(time.time())
    body      = {"url": terabox_url}
    signature = create_signature(API_SECRET, timestamp, body)
    headers   = {
        "X-API-Key":    API_KEY,
        "X-Signature":  signature,
        "X-Timestamp":  str(timestamp),
        "Content-Type": "application/json",
    }
    # Send raw JSON string to match the signature (data=, not json=)
    body_str = json.dumps(body, separators=(",", ":"), sort_keys=True)
    r = requests.post(f"{BASE_URL}/api/v1/terabox/get-link", data=body_str, headers=headers)
    return r.json()

result = get_link("https://terabox.com/s/1example")
print(result)
const crypto = require("crypto");
const axios  = require("axios");

const API_KEY    = "tbx_your_api_key";
const API_SECRET = "your_api_secret";
const BASE_URL   = "https://api.mswpresents.tech";

function createSignature(apiSecret, timestamp, body) {
  const bodyStr = JSON.stringify(body);
  const message = `${timestamp}:${bodyStr}`;
  return crypto.createHmac("sha256", apiSecret).update(message).digest("hex");
}

async function getLink(teraboxUrl) {
  const timestamp = Math.floor(Date.now() / 1000);
  const body      = { url: teraboxUrl };
  const signature = createSignature(API_SECRET, timestamp, body);
  const headers   = {
    "X-API-Key": API_KEY, "X-Signature": signature,
    "X-Timestamp": timestamp.toString(), "Content-Type": "application/json",
  };
  const res = await axios.post(`${BASE_URL}/api/v1/terabox/get-link`, body, { headers });
  return res.data;
}

getLink("https://terabox.com/s/1example").then(console.log);
<?php
define("API_KEY", "tbx_your_api_key");
define("API_SECRET", "your_api_secret");
define("BASE_URL", "https://api.mswpresents.tech");

function createSignature($apiSecret, $timestamp, $body) {
    $bodyStr = json_encode($body, JSON_UNESCAPED_SLASHES);
    return hash_hmac("sha256", "$timestamp:$bodyStr", $apiSecret);
}

function getLink($teraboxUrl) {
    $timestamp = time();
    $body      = ["url" => $teraboxUrl];
    $signature = createSignature(API_SECRET, $timestamp, $body);
    $headers   = [
        "X-API-Key: " . API_KEY,
        "X-Signature: " . $signature,
        "X-Timestamp: " . $timestamp,
        "Content-Type: application/json",
    ];
    $ch = curl_init(BASE_URL . "/api/v1/terabox/get-link");
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($body));
    curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    $response = curl_exec($ch);
    curl_close($ch);
    return json_decode($response, true);
}

print_r(getLink("https://terabox.com/s/1example"));
#!/bin/bash
API_KEY="tbx_your_api_key"
API_SECRET="your_api_secret"
BASE_URL="https://api.mswpresents.tech"
TIMESTAMP=$(date +%s)
TERABOX_URL="https://terabox.com/s/1example"

BODY='{"url":"'$TERABOX_URL'"}'
MESSAGE="${TIMESTAMP}:${BODY}"
SIGNATURE=$(echo -n "$MESSAGE" | openssl dgst -sha256 -hmac "$API_SECRET" | cut -d' ' -f2)

curl -X POST "${BASE_URL}/api/v1/terabox/get-link" \
  -H "X-API-Key: ${API_KEY}" \
  -H "X-Signature: ${SIGNATURE}" \
  -H "X-Timestamp: ${TIMESTAMP}" \
  -H "Content-Type: application/json" \
  -d "$BODY"
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.net.http.*;
import java.net.URI;
import com.google.gson.Gson;

public class TeraboxAPI {
    private static final String API_KEY    = "tbx_your_api_key";
    private static final String API_SECRET = "your_api_secret";
    private static final String BASE_URL   = "https://api.mswpresents.tech";

    public static String createSignature(String apiSecret, long timestamp, String body) throws Exception {
        String message = timestamp + ":" + body;
        Mac hmac = Mac.getInstance("HmacSHA256");
        hmac.init(new SecretKeySpec(apiSecret.getBytes(), "HmacSHA256"));
        byte[] hash = hmac.doFinal(message.getBytes());
        StringBuilder hex = new StringBuilder();
        for (byte b : hash) {
            String h = Integer.toHexString(0xff & b);
            if (h.length() == 1) hex.append('0');
            hex.append(h);
        }
        return hex.toString();
    }

    public static String getLink(String teraboxUrl) throws Exception {
        long timestamp = System.currentTimeMillis() / 1000;
        String body   = new Gson().toJson(Map.of("url", teraboxUrl));
        String sig    = createSignature(API_SECRET, timestamp, body);

        HttpClient client = HttpClient.newHttpClient();
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create(BASE_URL + "/api/v1/terabox/get-link"))
            .header("X-API-Key", API_KEY)
            .header("X-Signature", sig)
            .header("X-Timestamp", String.valueOf(timestamp))
            .header("Content-Type", "application/json")
            .POST(HttpRequest.BodyPublishers.ofString(body))
            .build();

        HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
        return response.body();
    }
}
package main

import (
    "bytes"
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "encoding/json"
    "fmt"
    "net/http"
    "strconv"
    "time"
)

const (
    APIKey    = "tbx_your_api_key"
    APISecret = "your_api_secret"
    BaseURL   = "https://api.mswpresents.tech"
)

func createSignature(apiSecret string, timestamp int64, body []byte) string {
    message := fmt.Sprintf("%d:%s", timestamp, string(body))
    h := hmac.New(sha256.New, []byte(apiSecret))
    h.Write([]byte(message))
    return hex.EncodeToString(h.Sum(nil))
}

func getLink(teraboxURL string) (string, error) {
    timestamp := time.Now().Unix()
    bodyMap := map[string]string{"url": teraboxURL}
    body, _ := json.Marshal(bodyMap)
    signature := createSignature(APISecret, timestamp, body)

    req, _ := http.NewRequest("POST", BaseURL+"/api/v1/terabox/get-link",
                              bytes.NewBuffer(body))
    req.Header.Set("X-API-Key", APIKey)
    req.Header.Set("X-Signature", signature)
    req.Header.Set("X-Timestamp", strconv.FormatInt(timestamp, 10))
    req.Header.Set("Content-Type", "application/json")

    client := &http.Client{}
    resp, err := client.Do(req)
    if err != nil { return "", err }
    defer resp.Body.Close()

    var result map[string]interface{}
    json.NewDecoder(resp.Body).Decode(&result)
    resultJSON, _ := json.MarshalIndent(result, "", "  ")
    return string(resultJSON), nil
}

func main() {
    result, _ := getLink("https://terabox.com/s/1example")
    fmt.Println(result)
}
require 'openssl'
require 'json'
require 'net/http'
require 'uri'

API_KEY    = 'tbx_your_api_key'
API_SECRET = 'your_api_secret'
BASE_URL   = 'https://api.mswpresents.tech'

def create_signature(api_secret, timestamp, body)
  body_str = body.to_json
  message  = "#{timestamp}:#{body_str}"
  OpenSSL::HMAC.hexdigest('SHA256', api_secret, message)
end

def get_link(terabox_url)
  timestamp = Time.now.to_i
  body      = { url: terabox_url }
  signature = create_signature(API_SECRET, timestamp, body)

  uri  = URI("#{BASE_URL}/api/v1/terabox/get-link")
  http = Net::HTTP.new(uri.host, uri.port)
  http.use_ssl = true

  request = Net::HTTP::Post.new(uri.path)
  request['X-API-Key']    = API_KEY
  request['X-Signature']  = signature
  request['X-Timestamp']  = timestamp.to_s
  request['Content-Type'] = 'application/json'
  request.body = body.to_json

  response = http.request(request)
  JSON.parse(response.body)
end

result = get_link('https://terabox.com/s/1example')
puts JSON.pretty_generate(result)
using System;
using System.Net.Http;
using System.Security.Cryptography;
using System.Text;
using System.Text.Json;
using System.Threading.Tasks;

public class TeraboxAPI
{
    private const string API_KEY    = "tbx_your_api_key";
    private const string API_SECRET = "your_api_secret";
    private const string BASE_URL   = "https://api.mswpresents.tech";

    public static string CreateSignature(string apiSecret, long timestamp, string body)
    {
        string message = $"{timestamp}:{body}";
        using (var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(apiSecret)))
        {
            byte[] hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(message));
            return BitConverter.ToString(hash).Replace("-", "").ToLower();
        }
    }

    public static async Task<string> GetLink(string teraboxUrl)
    {
        long timestamp = DateTimeOffset.UtcNow.ToUnixTimeSeconds();
        var bodyObj    = new { url = teraboxUrl };
        string body    = JsonSerializer.Serialize(bodyObj);
        string sig     = CreateSignature(API_SECRET, timestamp, body);

        using (var client = new HttpClient())
        {
            var request = new HttpRequestMessage(HttpMethod.Post,
                $"{BASE_URL}/api/v1/terabox/get-link");
            request.Headers.Add("X-API-Key", API_KEY);
            request.Headers.Add("X-Signature", sig);
            request.Headers.Add("X-Timestamp", timestamp.ToString());
            request.Content = new StringContent(body, Encoding.UTF8, "application/json");

            var response = await client.SendAsync(request);
            return await response.Content.ReadAsStringAsync();
        }
    }
}
🎬

Terabox Streaming API

Ultra HD M3U8 stream links from Terabox share URLs

🔒

HMAC-SHA256

Military-grade encryption

Ultra HD Quality

Best streaming quality

📊

Usage Analytics

Track your API usage

🚀

Rate Limiting

As per your plan

Check Usage Statistics

Monitor your API key's usage, remaining quota, and account details.

GET /api/v1/secure/usage
✅ 200 OK
{
    "success": true,
    "data": {
        "client_name": "Your Company",
        "daily_limit": 1000,
        "requests_today": 247,
        "total_requests": 15892,
        "remaining_today": 753,
        "created_at": "2026-01-01T00:00:00",
        "expires_at": "2026-02-01T00:00:00",
        "last_used": "2026-01-07T10:30:00",
        "is_active": true
    }
}

Rate Limits & Error Codes

CodeStatusDescription
200✅ SuccessRequest processed successfully
400❌ Bad RequestInvalid request format or parameters
401🔒 UnauthorizedInvalid API key or signature
403🚫 ForbiddenIP not whitelisted or key expired
408⏱️ TimeoutRequest processing took too long
429🛑 Rate LimitedDaily request limit exceeded
500⚠️ Server ErrorInternal server error occurred
Rate Limits:
  • Default: 1000 requests per day
  • Limits reset at midnight UTC
  • Custom limits available for enterprise clients
  • Check /api/v1/secure/usage for current usage
💳

Paytm Payment Gateway

Verify transactions and track UTR IDs in real-time

⚠️
Requires Paytm Permission:

Your API key must have Paytm gateway access enabled. Contact admin if you get a 403 error.

🔍

Real-time Verify

Instant txn status check

💰

UTR Tracking

Get bank UTR instantly

🛡️

HMAC Secured

Same auth as Terabox API

📊

Usage Analytics

Track your API calls

Verify Payment

Verify Paytm payment transaction status in real-time. Returns UTR ID, payment mode, amount, and full transaction details.

POST /api/v1/paytm/verify-payment

1 Request Body (JSON)

ParameterTypeRequiredDescription
merchant_idstringrequiredYour Paytm Merchant ID (MID)
orderidstringrequiredThe Order ID to verify

2 Required Headers

HeaderDescription
X-API-KeyYour API key (starts with anku_)
X-SignatureHMAC-SHA256 signature of timestamp:body
X-TimestampCurrent Unix timestamp (within 5 minutes)
Content-Typeapplication/json

3 Code Examples

import hmac, hashlib, time, json, requests

API_KEY    = "anku_your_api_key"
API_SECRET = "your_api_secret"
BASE_URL   = "https://api.mswpresents.tech"

def create_signature(api_secret, timestamp, body):
    """Create HMAC-SHA256 signature"""
    body_str = json.dumps(body, separators=(",", ":"), sort_keys=True)
    message  = f"{timestamp}:{body_str}"
    return hmac.new(api_secret.encode(), message.encode(), hashlib.sha256).hexdigest()

def verify_payment(merchant_id, order_id):
    timestamp = int(time.time())
    body = {
        "merchant_id": merchant_id,
        "orderid": order_id
    }
    signature = create_signature(API_SECRET, timestamp, body)
    headers = {
        "X-API-Key":    API_KEY,
        "X-Signature":  signature,
        "X-Timestamp":  str(timestamp),
        "Content-Type": "application/json",
    }
    # IMPORTANT: Use data= with raw string to match signature
    body_str = json.dumps(body, separators=(",", ":"), sort_keys=True)
    r = requests.post(f"{BASE_URL}/api/v1/paytm/verify-payment", data=body_str, headers=headers)
    return r.json()

result = verify_payment("YOUR_MERCHANT_MID", "ORDER_123456")
print(json.dumps(result, indent=2))

if result.get("success"):
    print(f"✅ Payment successful!")
    print(f"UTR ID: {result.get('UTR_ID')}")
    print(f"Amount: ₹{result.get('TXNAMOUNT')}")
    print(f"Mode: {result.get('PAYMENTMODE')}")
else:
    print(f"❌ {result.get('message')}")
const crypto = require('crypto');
const axios  = require('axios');

const API_KEY    = 'anku_your_api_key';
const API_SECRET = 'your_api_secret';
const BASE_URL   = 'https://api.mswpresents.tech';

function createSignature(apiSecret, timestamp, body) {
  const bodyStr = JSON.stringify(body);
  const message = `${timestamp}:${bodyStr}`;
  return crypto.createHmac('sha256', apiSecret).update(message).digest('hex');
}

async function verifyPayment(merchantId, orderId) {
  const timestamp = Math.floor(Date.now() / 1000);
  const body = { merchant_id: merchantId, orderid: orderId };
  const signature = createSignature(API_SECRET, timestamp, body);
  const headers = {
    'X-API-Key': API_KEY, 'X-Signature': signature,
    'X-Timestamp': timestamp.toString(), 'Content-Type': 'application/json',
  };

  const res = await axios.post(`${BASE_URL}/api/v1/paytm/verify-payment`, body, { headers });
  if (res.data.success) {
    console.log('✅ Payment verified!');
    console.log('UTR:', res.data.UTR_ID);
    console.log('Amount:', res.data.TXNAMOUNT);
  }
  return res.data;
}

verifyPayment('YOUR_MERCHANT_MID', 'ORDER_123456').then(console.log);
#!/bin/bash
API_KEY="anku_your_api_key"
API_SECRET="your_api_secret"
BASE_URL="https://api.mswpresents.tech"
TIMESTAMP=$(date +%s)

BODY='{"merchant_id":"YOUR_MERCHANT_MID","orderid":"ORDER_123456"}'
MESSAGE="${TIMESTAMP}:${BODY}"
SIGNATURE=$(echo -n "$MESSAGE" | openssl dgst -sha256 -hmac "$API_SECRET" | cut -d' ' -f2)

curl -X POST "${BASE_URL}/api/v1/paytm/verify-payment" \
  -H "X-API-Key: ${API_KEY}" \
  -H "X-Signature: ${SIGNATURE}" \
  -H "X-Timestamp: ${TIMESTAMP}" \
  -H "Content-Type: application/json" \
  -d "$BODY"
<?php
define('API_KEY', 'anku_your_api_key');
define('API_SECRET', 'your_api_secret');
define('BASE_URL', 'https://api.mswpresents.tech');

function createSignature($apiSecret, $timestamp, $body) {
    $bodyStr = json_encode($body, JSON_UNESCAPED_SLASHES);
    return hash_hmac('sha256', "$timestamp:$bodyStr", $apiSecret);
}

function verifyPayment($merchantId, $orderId) {
    $timestamp = time();
    $body = ['merchant_id' => $merchantId, 'orderid' => $orderId];
    $signature = createSignature(API_SECRET, $timestamp, $body);
    $headers = [
        'X-API-Key: ' . API_KEY,
        'X-Signature: ' . $signature,
        'X-Timestamp: ' . $timestamp,
        'Content-Type: application/json',
    ];
    $ch = curl_init(BASE_URL . '/api/v1/paytm/verify-payment');
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($body));
    curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    $response = curl_exec($ch);
    curl_close($ch);
    return json_decode($response, true);
}

$result = verifyPayment('YOUR_MERCHANT_MID', 'ORDER_123456');
print_r($result);
?>

4 Success Response

✅ 200 — TXN_SUCCESS
{
    "success": true,
    "UTR_ID": "330217XXXXXXXX",
    "ORDERID": "ORDER_123456",
    "TXNAMOUNT": "499.00",
    "STATUS": "TXN_SUCCESS",
    "RESPMSG": "Txn Success",
    "PAYMENTMODE": "UPI",
    "TXNDATE": "2026-04-04 14:30:00.0",
    "GATEWAYNAME": "PPBLPG",
    "BANKTXNID": "330217XXXXXXXX",
    "CURRENCY": "INR",
    "MID": "YOUR_MERCHANT_MID",
    "TXNID": "20260404111212800XXXXXXXX"
}

5 Failed Response

❌ TXN_FAILURE
{
    "success": false,
    "STATUS": "TXN_FAILURE",
    "ORDERID": "ORDER_123456",
    "RESPMSG": "Your payment has been declined by your bank.",
    "TXNAMOUNT": "499.00",
    "message": "Payment not successful. Status: TXN_FAILURE"
}

Additional Paytm Endpoints

🔗

GET /api/v1/paytm/health — Check if your API key has Paytm gateway access and view service status


GET /api/v1/paytm/usage — Get your Paytm-specific usage statistics and recent activity logs


Both endpoints require the same authentication headers (X-API-Key, X-Signature, X-Timestamp)

Paytm Error Codes

CodeMeaningAction
400Missing merchant_id or orderidCheck your request body
401Invalid API key, signature, or timestampVerify your auth headers
403API key doesn't have Paytm permissionContact admin to enable Paytm access
429Daily rate limit exceededWait for reset or upgrade plan
502Paytm gateway unreachableRetry after a few seconds
504Paytm API timeout (30s)Retry the request

Best Practices

🔐 Security

  • Never commit API secret to version control
  • Store credentials in environment variables
  • Always use HTTPS in production
  • Rotate API keys periodically
  • Implement proper error handling

⚡ Performance

  • Cache M3U8 links to save API calls
  • Implement request retries with exponential backoff
  • Monitor your usage with /api/v1/secure/usage
  • Use connection pooling for multiple requests

Get API Access

💬
Ready to integrate our API? Get your API credentials and start building!
  • ✅ Instant API key generation
  • ✅ Custom rate limits for your needs
  • ✅ Technical support and documentation
  • ✅ Enterprise solutions available
  • Terabox API — Ultra HD M3U8 streaming links
  • Paytm Gateway — Payment verification & UTR tracking

Contact on Telegram