PayGate Payment Gateway Integration

Flow

1. Create Payment: send the amount and order details to the API from your server.
2. Redirect: send the customer to the returned payment_url.
3. Callback: the final payment status reaches your callback_url as a signed POST.
4. Verify (optional): double-check from your server with the Status API.

1. Create Payment

POST {API}/transaction   Content-Type: application/json (send from your server, never from frontend JavaScript)

Signature

String: merchant_id|amount|order_id|payer_email|timestamp
Key: your Secure Key. Keep exactly this order with no spaces or extra fields.

$sig_string = $merchant_id . '|' . $amount . '|' . $order_id . '|' . $payer_email . '|' . $timestamp;
$signature  = hash_hmac('sha256', $sig_string, $secure_key);

Success response

{
  "status": "success",
  "flow_id": "PSM123456789",
  "payment_url": "https://www.payauto.afglikes.com/checkout/PSM123456789"
}

Error response

{ "status": "error", "message": "Invalid signature" }

Complete PHP example

$merchant_id = "YOUR_MERCHANT_ID";
$secure_key  = "YOUR_SECURE_KEY";
$amount      = 500;                    // whole PKR
$order_id    = "ORDER" . time();
$email       = "customer@example.com";
$timestamp   = time();

$signature = hash_hmac('sha256',
    $merchant_id.'|'.$amount.'|'.$order_id.'|'.$email.'|'.$timestamp, $secure_key);

$payload = [
  "merchant_id"  => $merchant_id,
  "amount"       => $amount,
  "order_id"     => $order_id,
  "payer_email"  => $email,
  "return_url"   => "https://yourwebsite.com/payment/return",
  "callback_url" => "https://yourwebsite.com/payment/callback",
  "timestamp"    => $timestamp,
  "signature"    => $signature,
];

$ch = curl_init("https://www.payauto.afglikes.com/api/transaction");
curl_setopt_array($ch, [
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_POST           => true,
  CURLOPT_HTTPHEADER     => ["Content-Type: application/json"],
  CURLOPT_POSTFIELDS     => json_encode($payload),
  CURLOPT_TIMEOUT        => 30,
]);
$res = json_decode(curl_exec($ch), true);
curl_close($ch);

if (($res['status'] ?? '') === 'success') {
    header("Location: " . $res['payment_url']);
    exit;
}
echo $res['message'] ?? 'Error';

2. Payment Callback

On a final status (paid, cancelled, expired) we send a JSON POST to your callback_url. Your server must reply with HTTP 2xx (for example echo "success";), otherwise we retry up to 6 times.

{
  "merchant_id": "YOUR_MERCHANT_ID",
  "order_id": "ORDER123456",
  "flow_id": "PSM123456789",
  "amount": 500,
  "payment_status": "paid",
  "timestamp": 1710000000,
  "signature": "GENERATED_SIGNATURE",
  "note": null
}

Signature string: merchant_id|order_id|flow_id|amount|payment_status|timestamp
Always verify the signature before updating an order.

$data = json_decode(file_get_contents("php://input"), true);

$str = ($data['merchant_id'] ?? '').'|'.($data['order_id'] ?? '').'|'.($data['flow_id'] ?? '').'|'
     . ($data['amount'] ?? '').'|'.($data['payment_status'] ?? '').'|'.($data['timestamp'] ?? '');
$verify = hash_hmac('sha256', $str, $secure_key);

if (!hash_equals($verify, $data['signature'] ?? '')) {
    http_response_code(403);
    exit("Invalid signature");
}

// Update your order here (keep it idempotent: a callback can arrive more than once)
if ($data['payment_status'] === 'paid') {
    // mark order as paid
}
echo "success";

3. Payment Status API

POST https://www.payauto.afglikes.com/api/status - signature string: merchant_id|order_id

// Request
{ "merchant_id": "YOUR_MERCHANT_ID", "order_id": "ORDER123456", "signature": "GENERATED_SIGNATURE" }

// Response
{ "status": "success", "payment_status": "paid", "order_id": "ORDER123456", "flow_id": "PSM123456789", "amount": 500 }

$sig = hash_hmac('sha256', $merchant_id.'|'.$order_id, $secure_key);

Important notes