Integration guide

<?php
const GSMONEPAY_BASE   = 'https://gsmonepay.com';
const GSMONEPAY_ID     = 'your-merchant-id';
const GSMONEPAY_SECRET = 'your-webhook-secret';   // server-side only

function gsmonepay_create_checkout(string $email, float $amount, array $opts = []): array {
    $timestamp = (string) time();

    // (float) then string concatenation — matches the server byte for byte.
    $stringToSign = $timestamp . '.' . GSMONEPAY_ID . '.' . $email . '.' . $amount;
    $signature    = hash_hmac('sha256', $stringToSign, GSMONEPAY_SECRET);

    $body = array_merge([
        'merchant_id' => GSMONEPAY_ID,
        'email'       => $email,
        'amount'      => $amount,
        'currency'    => 'USD',
    ], $opts);

    $ch = curl_init(GSMONEPAY_BASE . '/api/v2/checkout/sessions');
    curl_setopt_array($ch, [
        CURLOPT_POST           => true,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT        => 20,
        CURLOPT_HTTPHEADER     => [
            'Content-Type: application/json',
            'X-Checkout-Timestamp: ' . $timestamp,
            'X-Checkout-Signature: ' . $signature,
        ],
        CURLOPT_POSTFIELDS     => json_encode($body),
    ]);
    $raw    = curl_exec($ch);
    $status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);

    $json = json_decode($raw, true);
    if ($status !== 200 || empty($json['success'])) {
        throw new RuntimeException('GSMOnePay: ' . ($json['error'] ?? "HTTP $status"));
    }
    return $json;
}

// Usage — store session_id against your order before redirecting.
$session = gsmonepay_create_checkout('client@example.com', 25.00, [
    'idempotency_key' => 'order-1042',
    'return_url'      => 'https://your-site.com/payment/done',
    'cancel_url'      => 'https://your-site.com/cart',
    'metadata'        => ['order_id' => 1042],
]);

header('Location: ' . $session['checkout_url']);

import hmac, hashlib, time, requests

BASE   = "https://gsmonepay.com"
MID    = "your-merchant-id"
SECRET = b"your-webhook-secret"          # server-side only


def php_float_str(x) -> str:
    """Render a number the way PHP does when it concatenates a float.

    PHP: (float) 25.00 -> "25", 25.50 -> "25.5".
    Python's str(25.0) would give "25.0", which breaks the signature.
    """
    s = repr(float(x))
    return s[:-2] if s.endswith(".0") else s


def create_checkout(email: str, amount, **opts) -> dict:
    timestamp = str(int(time.time()))
    string_to_sign = f"{timestamp}.{MID}.{email}.{php_float_str(amount)}"
    signature = hmac.new(SECRET, string_to_sign.encode(), hashlib.sha256).hexdigest()

    body = {"merchant_id": MID, "email": email,
            "amount": float(amount), "currency": "USD", **opts}

    r = requests.post(
        f"{BASE}/api/v2/checkout/sessions",
        json=body,
        headers={"X-Checkout-Timestamp": timestamp,
                 "X-Checkout-Signature": signature},
        timeout=20,
    )
    data = r.json()
    if r.status_code != 200 or not data.get("success"):
        raise RuntimeError(f"GSMOnePay: {data.get('error', r.status_code)}")
    return data


session = create_checkout(
    "client@example.com", 25.00,
    idempotency_key="order-1042",
    return_url="https://your-site.com/payment/done",
    cancel_url="https://your-site.com/cart",
    metadata={"order_id": 1042},
)
print(session["checkout_url"])

function gsmonepay_session_status(string $sessionToken): array {
    $timestamp = (string) time();
    $signature = hash_hmac(
        'sha256',
        $timestamp . '.' . GSMONEPAY_ID . '.' . $sessionToken,
        GSMONEPAY_SECRET
    );

    $ch = curl_init(GSMONEPAY_BASE . '/api/v2/checkout/sessions/status');
    curl_setopt_array($ch, [
        CURLOPT_POST           => true,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT        => 15,
        CURLOPT_HTTPHEADER     => [
            'Content-Type: application/json',
            'X-Checkout-Timestamp: ' . $timestamp,
            'X-Checkout-Signature: ' . $signature,
        ],
        CURLOPT_POSTFIELDS     => json_encode([
            'merchant_id'   => GSMONEPAY_ID,
            'session_token' => $sessionToken,
        ]),
    ]);
    $out = json_decode(curl_exec($ch), true);
    curl_close($ch);
    return $out ?: [];
}

$s = gsmonepay_session_status($sessionToken);
if (($s['payment']['status'] ?? '') === 'confirmed') {
    // Compare the paid amount with what you asked for before crediting.
}

def session_status(session_token: str) -> dict:
    timestamp = str(int(time.time()))
    string_to_sign = f"{timestamp}.{MID}.{session_token}"
    signature = hmac.new(SECRET, string_to_sign.encode(), hashlib.sha256).hexdigest()

    r = requests.post(
        f"{BASE}/api/v2/checkout/sessions/status",
        json={"merchant_id": MID, "session_token": session_token},
        headers={"X-Checkout-Timestamp": timestamp,
                 "X-Checkout-Signature": signature},
        timeout=15,
    )
    return r.json()


s = session_status(session_token)
if s.get("payment", {}).get("status") == "confirmed":
    ...   # compare the paid amount before crediting

<?php
// Read the RAW body — re-encoding $_POST would change the bytes and break the signature.
$raw       = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';
$expected  = hash_hmac('sha256', $raw, GSMONEPAY_SECRET);

// hash_equals is constant-time; == would leak the secret through timing.
if ($signature === '' || !hash_equals($expected, $signature)) {
    http_response_code(401);
    exit(json_encode(['error' => 'Invalid signature']));
}

$payload = json_decode($raw, true) ?: [];
if (($payload['event'] ?? '') !== 'payment.confirmed') {
    http_response_code(200);
    exit(json_encode(['ok' => true, 'ignored' => true]));
}

$order = find_order_by_session($payload['session_token'] ?? '');
if (!$order) { http_response_code(404); exit(json_encode(['error' => 'Unknown session'])); }

// 2 — never credit more than what was actually paid (1% tolerance for FX drift).
$expectedAmount = (float) $order['total'];
$paidAmount     = (float) ($payload['amount'] ?? 0);
if (abs($paidAmount - $expectedAmount) > max(0.01, $expectedAmount * 0.01)) {
    error_log("GSMOnePay amount mismatch: expected $expectedAmount got $paidAmount");
    http_response_code(400);
    exit(json_encode(['error' => 'Amount mismatch']));
}

// 3 — idempotency: only the first delivery may credit.
if (!mark_order_paid_once($order['id'], $payload['payment_id'] ?? null)) {
    http_response_code(200);
    exit(json_encode(['ok' => true, 'duplicate' => true]));
}

credit_customer($order);
http_response_code(200);
echo json_encode(['ok' => true]);

import hmac, hashlib
from flask import Flask, request, jsonify

app = Flask(__name__)


@app.post("/webhooks/gsmonepay")
def gsmonepay_webhook():
    # Read the RAW body — request.json would re-serialise and break the signature.
    raw = request.get_data()
    signature = request.headers.get("X-Webhook-Signature", "")
    expected = hmac.new(SECRET, raw, hashlib.sha256).hexdigest()

    # compare_digest is constant-time; == would leak the secret through timing.
    if not signature or not hmac.compare_digest(expected, signature):
        return jsonify(error="Invalid signature"), 401

    payload = request.get_json(silent=True) or {}
    if payload.get("event") != "payment.confirmed":
        return jsonify(ok=True, ignored=True), 200

    order = find_order_by_session(payload.get("session_token"))
    if not order:
        return jsonify(error="Unknown session"), 404

    # 2 — never credit more than what was actually paid (1% tolerance for FX drift).
    expected_amount = float(order["total"])
    paid_amount = float(payload.get("amount") or 0)
    if abs(paid_amount - expected_amount) > max(0.01, expected_amount * 0.01):
        app.logger.warning("amount mismatch: want %s got %s", expected_amount, paid_amount)
        return jsonify(error="Amount mismatch"), 400

    # 3 — idempotency: only the first delivery may credit.
    if not mark_order_paid_once(order["id"], payload.get("payment_id")):
        return jsonify(ok=True, duplicate=True), 200

    credit_customer(order)
    return jsonify(ok=True), 200