Приём платежей через QR и перевод на карту

Authorization: Bearer pk_live_9f3c…

[
  {
    "method": "qr",
    "qr_method_id": "12",
    "name": "СБП QR",
    "description": "Оплата по QR в приложении банка",
    "min_amount": "1000.00",
    "max_amount": "200000.00"
  },
  {
    "method": "card",
    "qr_method_id": null,
    "name": "Перевод на карту Узбекистана",
    "description": null,
    "min_amount": "1000.00",
    "max_amount": "100000.00"
  }
]

curl -X POST https://m-pay-provider.com/api/v1/payments/ \
  -H "Authorization: Bearer pk_live_9f3c…" \
  -H "Content-Type: application/json" \
  -d '{
    "method": "card",
    "amount": 5000,
    "order_id": "A-1042",
    "customer_id": "user-17",
    "success_url": "https://shop.example/thanks",
    "fail_url": "https://shop.example/fail"
  }'

import requests

resp = requests.post(
    "https://m-pay-provider.com/api/v1/payments/",
    headers={"Authorization": "Bearer pk_live_9f3c…"},
    json={
        "method": "card",
        "amount": 5000,
        "order_id": "A-1042",
        "customer_id": "user-17",
        "success_url": "https://shop.example/thanks",
        "fail_url": "https://shop.example/fail",
    },
    timeout=30,
)
payment = resp.json()
if resp.status_code == 201:
    redirect_to(payment["payment_url"])
else:
    print(payment["error"], payment["message"])

<?php
$ch = curl_init('https://m-pay-provider.com/api/v1/payments/');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer pk_live_9f3c…',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'method' => 'card',
        'amount' => 5000,
        'order_id' => 'A-1042',
        'customer_id' => 'user-17',
        'success_url' => 'https://shop.example/thanks',
        'fail_url' => 'https://shop.example/fail',
    ]),
]);
$payment = json_decode(curl_exec($ch), true);
$code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

if ($code === 201) {
    header('Location: ' . $payment['payment_url']);
}

const resp = await fetch("https://m-pay-provider.com/api/v1/payments/", {
  method: "POST",
  headers: {
    Authorization: "Bearer pk_live_9f3c…",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    method: "card",
    amount: 5000,
    order_id: "A-1042",
    customer_id: "user-17",
    success_url: "https://shop.example/thanks",
    fail_url: "https://shop.example/fail",
  }),
});
const payment = await resp.json();
if (resp.status === 201) res.redirect(payment.payment_url);

{
  "id": "83c00c41-ca6c-4d34-bb53-77de721d0b3d",
  "status": "pending",
  "method": "card",
  "amount": "5000.00",
  "paid_amount": null,
  "currency": "RUB",
  "order_id": "A-1042",
  "customer_id": "user-17",
  "description": null,
  "payment_url": "https://m-pay-provider.com/pay/83c00c41-ca6c-4d34-bb53-77de721d0b3d/",
  "comment": null,
  "created_at": "2026-10-18T13:40:02+03:00",
  "expires_at": "2026-10-18T14:10:02+03:00",
  "paid_at": null,
  "card": {
    "number": "8600 1234 5678 9012",
    "holder_name": "ALIYEV ALISHER",
    "phone": "+998 90 111 22 33",
    "bank": "Kapitalbank",
    "instructions": "Откройте приложение банка → Переводы за границу…"
  },
  "receipts_count": 0
}

curl -X POST https://m-pay-provider.com/api/v1/payments/83c00c41-…/receipt/ \
  -H "Authorization: Bearer pk_live_9f3c…" \
  -F "file=@check.jpg"

with open("check.jpg", "rb") as f:
    resp = requests.post(
        f"https://m-pay-provider.com/api/v1/payments/{payment_id}/receipt/",
        headers={"Authorization": "Bearer pk_live_9f3c…"},
        files={"file": f},
        timeout=60,
    )

$ch = curl_init("https://m-pay-provider.com/api/v1/payments/$paymentId/receipt/");
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Authorization: Bearer pk_live_9f3c…'],
    CURLOPT_POSTFIELDS => ['file' => new CURLFile('check.jpg')],
]);
$payment = json_decode(curl_exec($ch), true);

const form = new FormData();
form.append("file", new Blob([fs.readFileSync("check.jpg")]), "check.jpg");
const resp = await fetch(`https://m-pay-provider.com/api/v1/payments/${paymentId}/receipt/`, {
  method: "POST",
  headers: { Authorization: "Bearer pk_live_9f3c…" },
  body: form,
});

{
  "id": "4821",
  "event": "payment.success",
  "created_at": "2026-10-18T13:52:10+03:00",
  "data": {
    "id": "83c00c41-ca6c-4d34-bb53-77de721d0b3d",
    "status": "success",
    "method": "card",
    "amount": "5000.00",
    "paid_amount": "5000.00",
    "currency": "RUB",
    "order_id": "A-1042",
    "customer_id": "user-17",
    "paid_at": "2026-10-18T13:52:10+03:00"
  }
}

import hashlib, hmac, json, time

SECRET = "whsec_…"

def handle_webhook(raw_body, headers):
    ts = headers.get("X-Timestamp", "")
    signature = headers.get("X-Signature", "")
    expected = "sha256=" + hmac.new(
        SECRET.encode(), ts.encode() + b"." + raw_body, hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(expected, signature):
        return 401
    if abs(time.time() - int(ts)) > 300:
        return 401

    event = json.loads(raw_body)
    if already_processed(event["id"]):
        return 200
    if event["event"] == "payment.success":
        mark_order_paid(event["data"]["order_id"], event["data"]["paid_amount"])
    remember(event["id"])
    return 200

<?php
$secret = 'whsec_…';
$raw = file_get_contents('php://input');
$ts = $_SERVER['HTTP_X_TIMESTAMP'] ?? '';
$signature = $_SERVER['HTTP_X_SIGNATURE'] ?? '';
$expected = 'sha256=' . hash_hmac('sha256', $ts . '.' . $raw, $secret);

if (!hash_equals($expected, $signature) || abs(time() - (int)$ts) > 300) {
    http_response_code(401);
    exit;
}

$event = json_decode($raw, true);
if ($event['event'] === 'payment.success') {
    markOrderPaid($event['data']['order_id'], $event['data']['paid_amount']);
}
http_response_code(200);

const crypto = require("node:crypto");
const express = require("express");
const SECRET = "whsec_…";
const app = express();

app.post("/payments/webhook", express.raw({ type: "application/json" }), (req, res) => {
  const ts = req.get("X-Timestamp") || "";
  const received = Buffer.from(req.get("X-Signature") || "");
  const expected = Buffer.from(
    "sha256=" + crypto.createHmac("sha256", SECRET).update(ts + "." + req.body).digest("hex")
  );

  if (received.length !== expected.length || !crypto.timingSafeEqual(received, expected)) return res.sendStatus(401);
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return res.sendStatus(401);

  const event = JSON.parse(req.body);
  if (event.event === "payment.success") markOrderPaid(event.data.order_id, event.data.paid_amount);
  res.sendStatus(200);
});

{
  "error": "customer_pending_limit",
  "message": "У покупателя слишком много неоплаченных платежей"
}