Glossary

Absa's own payment method, which the customer authorises in their Absa banking app. It gets its own button at checkout rather than sitting inside the bank list, and it requires Customer Identity Verification.

A way of writing binary data using ordinary text characters, so it can travel inside JSON or a URL. It is an encoding, not encryption: anyone can decode it.

An access token sent in the Authorization header as Authorization: Bearer <token>. Anyone holding the token can use it, which is why it belongs on your server and never in a browser or a mobile app.

The six-digit number identifying a South African bank branch, the equivalent of a sort code or a routing number elsewhere. Each bank publishes one universal branch code that works for every account it holds, which is the one to use unless you have been given another.

Capitec's own payment method. The payer gives a cellphone, account or ID number rather than card details, and approves the payment in the Capitec app, so no card number and no banking login is ever entered at checkout. It gets its own button rather than sitting inside the bank list, and it requires Customer Identity Verification.

A completed card payment reversed by the customer's bank after a successful dispute. The funds come back out, and the process runs between the banks rather than through Ozow, so it is not something you can approve or refuse. Your transaction records and delivery confirmations are what it is decided on.

Moving funds between two banks so the recipient can rely on them. It is a separate step from a payment being approved: a payment can succeed and the money still be in transit. Real-Time Clearing is the immediate version.

A response header listing the origins a page is allowed to load scripts, frames and other resources from. A policy that does not name Ozow's origin blocks an embedded checkout, and the browser reports it in the console rather than on the page.

The browser rule that decides whether JavaScript on one site may call another. It governs what a page can call directly from the browser, and it does not apply to calls made from your server.

Checking that the payment instrument belongs to the natural person making the payment. Ozow requires it for merchants it has classified as high-risk, on Pay by Bank, Absa Pay, Capitec Pay, Nedbank Direct EFT, FNB Payment Requests and PayShap Request, and can disable those methods where it is not implemented correctly.

A customer challenging a completed card payment through their own bank. A successful dispute becomes a chargeback and reverses the funds. Distinct from a refund, which you initiate and control.

A transfer between two bank accounts. Used here for the standard kind, which takes one to two business days, as against Real-Time Clearing, which moves the funds immediately. A payout or refund is one or the other, and which you choose is the difference between a customer waiting minutes and waiting days.

The balance held with Ozow that payouts and refunds are paid out of. Both draw on it, and neither will process while it is empty. Payins do not need one, so if you only take payments you never meet it.

A compression format. A large payload is compressed before it is sent and has to be decompressed before it can be read.

A hash of a message combined with a secret key, so the result proves both that the message is unchanged and that the sender held the key. A plain hash proves only the first: anybody can compute one. This is what makes a webhook signature worth checking.

A request is idempotent when sending it twice has the same effect as sending it once. It matters most where a retry after a timeout could otherwise take a payment twice.

The two-letter country codes published by the International Organization for Standardization, such as ZA for South Africa and GB for the United Kingdom. Always uppercase.

The three-letter currency codes, such as ZAR for the South African rand. Always uppercase.

The international standard for writing dates and times, such as 2026-03-14T09:30:00Z. Unambiguous about ordering and time zone, which local formats are not.

A path into a JSON document, written as /data/attributes/title. An error response uses one to say exactly which value caused the problem.

A convention for the shape of a JSON request and response, including how errors and pagination are represented. One API follows it.

Nedbank's own payment method. Like the other bank APIs it gets its own button at checkout rather than sitting inside the bank list, and it requires Customer Identity Verification.

The authorisation framework behind the token endpoint. Ozow uses the client credentials flow: your server exchanges a client ID and secret for a short-lived access token, and sends that token rather than the secret on every subsequent call.

The payer authorises the payment inside their own banking app or online banking, and the funds move from their bank account. No card is involved and no card details are entered.

A payment made by a consumer to a merchant. The direction most of this site is about: money coming in. Its counterpart is a payout, which sends money out and is not tied to any payment anyone made you.

Money sent from a merchant to a bank account. Unlike a refund, a payout is not tied to a payment anyone made you, so you can pay anyone with a bank account. Payouts draw on your float rather than on your incoming payments, and they are not self-service: they need approval from Ozow and testing in staging first.

South Africa's rapid payments service, run by the banks. Low-value payments clear in seconds, and the recipient can be identified by a ShapID instead of by an account number.

The request side of PayShap. Rather than the payer pushing money, the payee asks for it: the payer receives a request and approves it in their own banking app, and the funds move once they do. Enabled by Ozow on request rather than by default.

The security standard that applies to anyone who stores, processes or transmits card data. Its reach is the reason most integrations avoid touching card numbers at all.

South Africa's data protection law. It governs how personal information about a payer may be collected, stored and shared.

Payments that clear immediately rather than waiting for a batch. A batch run settles at set times through the day; a Real-Time Clearing payment moves the funds between the two bank accounts as it is made, so the recipient can rely on them straight away.

Sending the payer to the Ozow payment page to complete the payment, and returning them to your site afterwards. The alternative is embedding the checkout in your own page, where the payer never leaves it.

A profile of ISO 8601 for timestamps on the internet, and what most APIs mean when they say a field is an ISO date.

Ozow paying the money you have collected into your bank account. Payins arrive at Ozow first and are settled to you on a schedule, so what a customer paid you today and what has been settled to you today are different amounts.

A hashing algorithm from the same family as SHA-512, producing a shorter hash.

A hashing algorithm. Ozow uses it to sign the values in a request or a notification so you can tell that they arrived unaltered and came from us. Hashing is one-way: the hash cannot be turned back into what produced it.

A proxy for a bank account: usually a mobile number, registered with the account holder's bank and used in place of an account number and branch code. Resolving a ShapID returns the account it stands for, which is what lets a payer send money to a phone number they already have.

The unique code for a site registered under a merchant. A site is a place to transact: a website, or a branch of a store. A merchant can have several, and each transaction names the one it belongs to, so sending the wrong code files the payment against the wrong place.

The encryption behind https. Every call to Ozow uses it, which is what keeps a request unreadable in transit.

A 128-bit identifier written as 36 characters, such as 497f6eca-6276-4993-bfeb-53cbbbba6f08. Generated rather than assigned in sequence, so two systems can create identifiers without coordinating.

A URL of yours that Ozow calls when something happens, rather than you polling to find out. The call carries no credential of yours and arrives at a public URL, so authenticate it before acting on it: a hash field on the Payments API, a Svix signature on One API.

The ISO 4217 code for the South African rand, and the currency every amount on this site is in unless a page says otherwise. Amounts are decimal rand rather than cents, so 100.00 is one hundred rand.