A small app on the cashier phone that reads payment news.
Konek QR Listener reads payment notifications from your merchant app, then sends the amount to Konek QR to be matched. It never touches the money, never signs in to your merchant account, and you can check it yourself before installing.
What it reads, sends and keeps.
Read
Incoming-payment notifications from merchant apps on the list. Outgoing-money notifications are ignored.
Sent to Konek QR
The amount, the app it came from, when the notification appeared, and its text, HMAC-signed over HTTPS. Raw text is kept for 30 days, then only the amount.
Heartbeat
Every 180 seconds: Listener status, battery and charging, network type, queue length, last notification time and app version. It can also go to up to 3 of your own servers.
Kept on the phone
The queue of news not yet sent, for up to 7 days. The device token lives in the Android Keystore; "Disconnect device" revokes it and wipes local data.
Every permission, and why.
Listener asks for no access to SMS, contacts, location or the microphone, and never asks for the password, PIN or OTP of your merchant or bank account.
Notification access
Reads "payment received" notifications from the merchant account apps on the list.
Notifications from chat, SMS and other apps are ignored on the phone and never sent.
Unrestricted battery
So Android does not stop Listener while the phone is idle, and the 180-second heartbeat keeps running.
This exempts Listener only, not the whole phone.
Notifications
Shows Listener’s always-on status, and notices you can act on straight away, such as "Mark as paid".
Android requires this notice for a service that keeps running.
Camera
Only to scan the pairing QR from the Devices page in the dashboard.
No photo is taken or kept.
Run after a restart
So Listener comes back and sends its queue without being opened by hand.
Internet and network state
Sends payment news and heartbeats, and knows when the connection is back to send the queue.
Check the APK yourself.
Every version is signed with the same certificate. If the SHA-256 of the file you downloaded differs from the one in the dashboard, or the certificate fingerprint changes, do not install it.
# Windows (Command Prompt)
certutil -hashfile konekqr-listener.apk SHA256
# macOS / Linux
shasum -a 256 konekqr-listener.apk
# Certificate fingerprint (Android SDK build-tools)
apksigner verify --print-certs konekqr-listener.apkRather not use commands? Open the VirusTotal link on the download page: it goes straight to the scan of the very same file.
How to install, step by step.
Listener is not on Google Play. Download its APK from the Apps menu in the dashboard once you are logged in, never from a chat or group. Installing, unlocking restricted settings on Android 13 and newer, pairing, and battery settings per phone brand are all in the guide.
Connect your QRIS and take your first payment today.
Sign up free, upload your static QRIS, then try it in test mode before you take real money.