MerasDocs
Get API keys
Products · mPOS

Tap to Phone (mPOS)

Turn any NFC-enabled Android device into an EMV contactless reader. No extra hardware — the device becomes the terminal.

4 endpointsmpos_
ℹ

Requirements

Android 9 (API level 28) or higher · NFC hardware present and enabled · Meras Agent APK installed from the official distribution channel · Merchant KYC approved and live environment activated.

How it works

  1. 1

    Install the Meras Agent app

    Download the Meras Agent APK from agent.merashub.com/apk and install on any Android 9+ device with NFC. The app handles all EMV kernel initialization and communicates with the MerasPay backend over TLS.
  2. 2

    Register the device as a terminal

    Call POST /v1/terminals/mpos with the device fingerprint to create a terminal record. The API returns an activation_code that the Meras Agent app uses to bind itself to the merchant account.
  3. 3

    Customer taps card or NFC phone

    The merchant opens the Meras Agent app and enters the transaction amount. The app activates the NFC reader. The customer taps their Visa or Mastercard contactless card — or an NFC-enabled phone — to the merchant device.
  4. 4

    EMV cryptogram verified server-side

    The app captures the EMV transaction data (ARQC cryptogram, track data) and sends it to the MerasPay gateway over an encrypted channel. MerasPay forwards to Cybersource CP for authorisation and cryptogram validation.
  5. 5

    Webhook fires, receipt issued

    On a successful authorisation response, MerasPay books the ledger, fires a payment_intent.succeeded webhook to your endpoint, and the Meras Agent app displays a receipt. A digital receipt can also be sent via SMS or email.

Endpoints

POST/v1/terminals/mpos

Register a new mPOS device and generate an activation code.

GET/v1/terminals/mpos/{id}

Retrieve a terminal record and its current status.

POST/v1/terminals/mpos/{id}/activate

Activate a registered terminal (confirms the device binding).

POST/v1/terminals/mpos/{id}/deactivate

Deactivate a terminal — blocks new transactions immediately.

Register — parameters

NameTypeDescription
device_id
required
stringAndroid device fingerprint. Retrieved via the Meras Agent SDK — use DeviceInfo.getFingerprint().
merchant_locationstringHuman-readable branch or outlet name. Shown in the merchant portal terminal list.
labelstringShort name for this terminal (e.g. "Counter 1", "Delivery driver – Ahmed"). ≤60 chars.
metadatamapFree-form string-string map; round-trips on every response.

Sample — register + payment webhook

POST /v1/terminals/mposbash
curl -X POST https://api.merashub.com/v1/terminals/mpos \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "device_id": "samsung_a54_8c3f9e2a1b4d",
    "merchant_location": "Main Street branch",
    "label": "Counter 1"
  }'
201 Createdjson
{
  "id": "mpos_01HZH1CYJX5F0P9SM2G7Y6ZL3N",
  "status": "pending_activation",
  "device_id": "samsung_a54_8c3f9e2a1b4d",
  "label": "Counter 1",
  "activation_code": "MP-4821-9037",
  "created_at": "2026-05-25T10:15:30Z"
}
payment_intent.succeeded webhook (card-present)json
{
  "id": "evt_01HZH2DYJX6G1Q0TN3H8Z7AM4P",
  "type": "payment_intent.succeeded",
  "data": {
    "object": {
      "id": "pi_01HZH2DYJX6G1Q0TN3H8Z7AM4P",
      "amount_minor": 12500,
      "currency": "DJF",
      "status": "succeeded",
      "payment_method_details": {
        "type": "card_present",
        "card_present": {
          "brand": "visa",
          "last4": "4242",
          "entry_mode": "contactless",
          "terminal_id": "mpos_01HZH1CYJX5F0P9SM2G7Y6ZL3N"
        }
      }
    }
  }
}

Supported card types

  • Visa Contactless

    EMVCo Level 1 and Level 2 certified. payWave transactions up to the local CVM limit without PIN.

  • Mastercard Contactless

    Mastercard PayPass / Tap & Go. EMVCo Level 1 and Level 2 certified.

  • NFC-enabled mobile wallets

    Any HCE-based wallet presenting a Visa or Mastercard token (e.g. Google Pay, Samsung Pay) is accepted.

⚠

PCI DSS CPOC requirements

Tap to Phone is subject to PCI DSS CPOC (Contactless Payments on COTS) requirements. The Meras Agent app implements all required security controls including runtime integrity checks and secure enclave key storage. Do not load the APK from unofficial sources — only the signed APK distributed via agent.merashub.com/apk is certified.