Accept Payments

curl -X POST https://api.epayse.com/api/v1/transaction/create \
  -H "Content-Type: application/json" \
  -H "X-Api-Key-Id: your_api_key" \
  -H "X-Signature: generated_hmac_signature" \
  -H "X-Timestamp: 1700000000" \
  -H "X-Nonce: unique_nonce_value" \
  -d '{
    "ref": "ORDER-2024-001",
    "amount": 1000,
    "currency": "USD",
    "websiteUrl": "https://yoursite.com",
    "redirectUrl": "https://yoursite.com/payment/success",
    "cancelUrl": "https://yoursite.com/payment/cancel",
    "description": "Payment for Order #001",
    "customerDetails": {
      "firstName": "John",
      "lastName": "Doe",
      "email": "[email protected]",
      "country": "US",
      "ip": "203.0.113.50",
      "phoneCode": "US",
      "phoneNumber": "5551234567"
    }
  }'

{
  "status": "SUCCESS",
  "message": "Transaction created successfully",
  "data": {
    "transactionId": "01kd096yg112e40pcyfwsahyev",
    "checkoutUrl": "/checkout/01kd096yg112e40pcyfwsahyev?expires=1766325765&signature=c0108b47..."
  }
}

<?php

$apiKey = 'your_api_key';
$secretKey = 'your_secret_key';

$timestamp = time();
$nonce = bin2hex(random_bytes(16));

$payload = json_encode([
    'ref' => 'ORDER-' . uniqid(),
    'amount' => 1000,            // Amount in cents ($10.00)
    'currency' => 'USD',
    'websiteUrl' => 'https://yoursite.com',
    'redirectUrl' => 'https://yoursite.com/payment/success',
    'cancelUrl' => 'https://yoursite.com/payment/cancel',
    'description' => 'Payment for Order #1234',
    'customerDetails' => [
        'firstName' => 'John',
        'lastName' => 'Doe',
        'email' => '[email protected]',
        'country' => 'US',
        'ip' => $_SERVER['REMOTE_ADDR'],  // Always use real customer IP
        'phoneCode' => 'US',
        'phoneNumber' => '5551234567',
    ],
]);

// Generate HMAC-SHA256 signature
$signatureString = $timestamp . $nonce . $payload;
$signature = hash_hmac('sha256', $signatureString, $secretKey);

$ch = curl_init('https://api.epayse.com/api/v1/transaction/create');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => $payload,
    CURLOPT_HTTPHEADER => [
        'Content-Type: application/json',
        'X-Api-Key-Id: ' . $apiKey,
        'X-Signature: ' . $signature,
        'X-Timestamp: ' . $timestamp,
        'X-Nonce: ' . $nonce,
    ],
    CURLOPT_RETURNTRANSFER => true,
]);

$response = json_decode(curl_exec($ch), true);
curl_close($ch);

if ($response['status'] === 'SUCCESS') {
    // Redirect customer to EPaySe checkout
    header('Location: ' . $response['data']['checkoutUrl']);
    exit;
}

// Handle error
echo 'Error: ' . ($response['message'] ?? 'Unknown error');

{
  "status": "SUCCESS",
  "message": "Transaction created successfully",
  "data": {
    "transactionId": "01kd096yg112e40pcyfwsahyev",
    "checkoutUrl": "/checkout/01kd096yg112e40pcyfwsahyev?expires=...",
    "iframe": {
      "fullCheckoutUrl": "https://gateway.epayse.com/checkout/01kd...?expires=...&signature=...",
      "fullCheckoutEmbedCode": "<iframe src=\"https://gateway.epayse.com/checkout/...\" />",
      "paymentMethods": [
        {
          "key": "credit_card",
          "name": "Credit/Debit Card",
          "url": "https://gateway.epayse.com/checkout-field/...",
          "embedCode": "<iframe src=\"...\" />"
        }
      ],
      "expiresAt": "2024-01-15T15:00:00+00:00",
      "configuration": { "width": "100%", "height": "900px" },
      "postMessageEvents": [
        "epayse:payment:success",
        "epayse:payment:failed",
        "epayse:payment:cancel",
        "epayse:height:change"
      ]
    }
  }
}

// Listen for EPaySe iframe events
window.addEventListener('message', function(event) {
  // IMPORTANT: Verify origin for security
  const ALLOWED_ORIGINS = [
    'https://gateway.epayse.com',    // Production
    'https://sandbox.epayse.com'     // Sandbox
  ];

  if (!ALLOWED_ORIGINS.includes(event.origin)) {
    return; // Ignore untrusted origins
  }

  const { type, data } = event.data;

  switch(type) {
    case 'epayse:payment:success':
      console.log('Payment successful:', data.transactionId);
      // Verify payment via webhook or API before fulfilling order
      break;

    case 'epayse:payment:failed':
      console.error('Payment failed:', data.message);
      // Show error message to customer
      break;

    case 'epayse:payment:cancel':
      console.log('Payment cancelled:', data.transactionId);
      // Redirect to cart or retry
      break;

    case 'epayse:height:change':
      // Dynamically resize iframe
      document.getElementById('epayse-checkout')
        .style.height = data.height + 'px';
      break;
  }
});

// Redirect URL query parameters after payment
// https://yoursite.com/payment/success?
//   status=SUCCESS
//   &ref=ORDER-2024-001
//   &transactionId=01kd096yg112e40pcyfwsahyev
//   &amount=1000
//   &paidAmount=1000
//   &currency=USD
//   &message=Payment+successful
//   &attemptCount=1
//   &maxAttempts=3

// IMPORTANT: Always verify via webhook or API call
// Never trust redirect parameters alone for order fulfillment

<?php

// Receive and verify webhook notification
$payload = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_SIGNATURE'] ?? '';
$timestamp = $_SERVER['HTTP_X_TIMESTAMP'] ?? '';
$nonce = $_SERVER['HTTP_X_NONCE'] ?? '';

// Verify timestamp (reject if older than 5 minutes)
if (abs(time() - (int) $timestamp) > 300) {
    http_response_code(401);
    exit('Timestamp expired');
}

// Verify HMAC signature
$expected = hash_hmac('sha256', $timestamp . $nonce . $payload, $secretKey);
if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    exit('Invalid signature');
}

$event = json_decode($payload, true);

switch ($event['event']) {
    case 'transaction.success':
        // Payment confirmed - fulfill the order
        updateOrderStatus($event['data']['ref'], 'paid');
        break;

    case 'transaction.failed':
        // Payment failed
        updateOrderStatus($event['data']['ref'], 'failed');
        break;
}

// Always return 200 to acknowledge receipt
http_response_code(200);
echo json_encode(['received' => true]);