Changelog
Changelog
What's new in Hlawula, newest first.
9 November 2026
API on Vercel and analytics
- The API now runs on Vercel next to the website, at https://hlawula.co.za/api. Endpoints, responses and fee maths are unchanged.
- API and page URLs no longer end in a slash. Old links redirect.
- Receipts moved to their own page, /receipt, after checkout.
- Analytics through Sitetooling on the website, docs and receipt. It never runs on checkout or the dashboard.
9 November 2026
Payment methods, docs and payout fix
- Eight payment methods: Apple Pay, Google Pay, Samsung Pay, cards, Capitec Pay, Absa Pay, Nedbank Direct EFT and Pay by bank.
- Apple Pay is now the first option on the hosted checkout.
- New endpoint: GET /api/payment-methods.
- Fixed: payouts subtracted tax from an amount that didn’t include it, so merchants were underpaid by the tax collected. Fees are now charged on the full amount paid and the card fee counts every payment.
- These docs.
9 November 2026
Hlawula
- Excalibur MoR is now Hlawula MoR (Pty) Ltd.
- Redesigned website, two-column hosted checkout and refreshed dashboard.
9 November 2026
API hardening
- Card payments check the Luhn digit, expiry date and security code.
- Unknown API routes return a JSON 404.
- Concurrent requests can no longer corrupt the in-memory store.
- Tax quotes reject negative amounts.
Older changes live in the repository's commit history.