PlatinaPay Merchant API

curl -X POST https://platinapay.org/api/v1/orders/create \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "order_id": "ORDER-001",
    "amount": 1000.00,
    "currency": "RUB",
    "notify_url": "https://yoursite.com/webhook",
    "redirect_url": "https://yoursite.com/success",
    "sign": "COMPUTED_HMAC_SHA256_HEX"
  }'

import hmac, hashlib, json, requests

API_KEY = "your_api_key"
API_SECRET = "your_api_secret"
BASE_URL = "https://platinapay.org"

def canonical(value) -> str:
    # Numbers are signed the way the gateway reads the JSON: 1000.00 is "1000"
    if isinstance(value, float) and value.is_integer():
        return str(int(value))
    return str(value)

def sign(params: dict, secret: str) -> str:
    fields = {k: canonical(v) for k, v in params.items() if k != "sign" and v not in ("", None)}
    sorted_str = "&".join(f"{k}={v}" for k, v in sorted(fields.items()))
    return hmac.new(secret.encode(), sorted_str.encode(), hashlib.sha256).hexdigest()

# Build request
data = {
    "order_id": "ORDER-001",
    "amount": 1000.00,
    "currency": "RUB",
    "notify_url": "https://yoursite.com/webhook",
    "redirect_url": "https://yoursite.com/success",
}
data["sign"] = sign(data, API_SECRET)

response = requests.post(
    f"{BASE_URL}/api/v1/orders/create",
    headers={"Authorization": f"Bearer {API_KEY}"},
    json=data,
)

result = response.json()
print(result["data"]["payment_url"])
# → Redirect user to this URL

import crypto from 'crypto';

const API_KEY = 'your_api_key';
const API_SECRET = 'your_api_secret';
const BASE_URL = 'https://platinapay.org';

function sign(params, secret) {
  const sorted = Object.keys(params)
    .filter((k) => k !== 'sign' && params[k] !== '' && params[k] != null)
    .sort()
    .map((k) => `${k}=${params[k]}`).join('&');
  return crypto.createHmac('sha256', secret)
    .update(sorted).digest('hex');
}

const data = {
  order_id: 'ORDER-001',
  amount: 1000.00,
  currency: 'RUB',
  notify_url: 'https://yoursite.com/webhook',
  redirect_url: 'https://yoursite.com/success',
};
data.sign = sign(data, API_SECRET);

const res = await fetch(`${BASE_URL}/api/v1/orders/create`, {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify(data),
});

const result = await res.json();
console.log(result.data.payment_url);
// → Redirect user to this URL

<?php
$apiKey = 'your_api_key';
$apiSecret = 'your_api_secret';
$baseUrl = 'https://platinapay.org';

function sign(array $params, string $secret): string {
    unset($params['sign']);
    $params = array_filter($params, fn($v) => $v !== '' && $v !== null);
    ksort($params, SORT_STRING);
    $parts = [];
    foreach ($params as $k => $v) {
        $parts[] = $k . '=' . $v; // raw values: http_build_query would URL-encode them
    }
    return hash_hmac('sha256', implode('&', $parts), $secret);
}

$data = [
    'order_id'     => 'ORDER-001',
    'amount'       => 1000.00,
    'currency'     => 'RUB',
    'notify_url'   => 'https://yoursite.com/webhook',
    'redirect_url' => 'https://yoursite.com/success',
];
$data['sign'] = sign($data, $apiSecret);

$ch = curl_init("$baseUrl/api/v1/orders/create");
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => [
        "Authorization: Bearer $apiKey",
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS     => json_encode($data),
]);

$result = json_decode(curl_exec($ch), true);
curl_close($ch);

$paymentUrl = $result['data']['payment_url'];
header("Location: $paymentUrl");
// → Redirect user to payment page

package main

import (
	"bytes"
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"fmt"
	"net/http"
	"sort"
	"strconv"
	"strings"
)

const (
	apiKey    = "your_api_key"
	apiSecret = "your_api_secret"
	baseURL   = "https://platinapay.org"
)

func sign(params map[string]interface{}, secret string) string {
	keys := make([]string, 0, len(params))
	for k, v := range params {
		if k != "sign" && v != nil && v != "" {
			keys = append(keys, k)
		}
	}
	sort.Strings(keys)
	parts := make([]string, 0, len(keys))
	for _, k := range keys {
		value := fmt.Sprint(params[k])
		if f, ok := params[k].(float64); ok {
			value = strconv.FormatFloat(f, 'f', -1, 64) // 1000.00 is signed as "1000"
		}
		parts = append(parts, k+"="+value)
	}
	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write([]byte(strings.Join(parts, "&")))
	return hex.EncodeToString(mac.Sum(nil))
}

func main() {
	data := map[string]interface{}{
		"order_id":     "ORDER-001",
		"amount":       1000.00,
		"currency":     "RUB",
		"notify_url":   "https://yoursite.com/webhook",
		"redirect_url": "https://yoursite.com/success",
	}
	data["sign"] = sign(data, apiSecret)

	body, _ := json.Marshal(data)
	req, _ := http.NewRequest("POST", baseURL+"/api/v1/orders/create", bytes.NewReader(body))
	req.Header.Set("Authorization", "Bearer "+apiKey)
	req.Header.Set("Content-Type", "application/json")

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	var result map[string]interface{}
	json.NewDecoder(resp.Body).Decode(&result)
	fmt.Println(result["data"].(map[string]interface{})["payment_url"])
}

curl -X POST https://platinapay.org/api/v1/orders/cancel \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"trade_id": "20260322a1b2c3d4e5f67890", "sign": "HMAC_HEX"}'

data = {"trade_id": "20260322a1b2c3d4e5f67890"}
data["sign"] = sign(data, API_SECRET)

response = requests.post(
    f"{BASE_URL}/api/v1/orders/cancel",
    headers={"Authorization": f"Bearer {API_KEY}"},
    json=data,
)
print(response.json())

const data = { trade_id: '20260322a1b2c3d4e5f67890' };
data.sign = sign(data, API_SECRET);

const res = await fetch(`${BASE_URL}/api/v1/orders/cancel`, {
  method: 'POST',
  headers: { 'Authorization': `Bearer ${API_KEY}`, 'Content-Type': 'application/json' },
  body: JSON.stringify(data),
});
console.log(await res.json());

curl https://platinapay.org/api/v1/orders/query/20260322a1b2c3d4e5f67890 \
  -H "Authorization: Bearer YOUR_API_KEY"

trade_id = "20260322a1b2c3d4e5f67890"
response = requests.get(
    f"{BASE_URL}/api/v1/orders/query/{trade_id}",
    headers={"Authorization": f"Bearer {API_KEY}"},
)
order = response.json()["data"]
print(f"Status: {order['status']}, Amount: {order['actual_amount']} USDT")

const tradeId = '20260322a1b2c3d4e5f67890';
const res = await fetch(`${BASE_URL}/api/v1/orders/query/${tradeId}`, {
  headers: { 'Authorization': `Bearer ${API_KEY}` },
});
const { data: order } = await res.json();
console.log(`Status: ${order.status}, Amount: ${order.actual_amount} USDT`);

# Flask example
from flask import Flask, request
import hmac, hashlib

app = Flask(__name__)
API_SECRET = "your_api_secret"

def verify_sign(fields: dict, secret: str) -> bool:
    received = fields.get("sign", "")
    # Every field that arrived except sign and is_test, skipping empty ones
    signed = {k: v for k, v in fields.items() if k not in ("sign", "is_test") and v != ""}
    param_str = "&".join(f"{k}={v}" for k, v in sorted(signed.items()))
    expected = hmac.new(secret.encode(), param_str.encode(), hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected.encode(), received.encode())

@app.route("/webhook", methods=["POST"])
def webhook():
    data = request.form.to_dict()  # the webhook is form-urlencoded, not JSON

    if not verify_sign(data, API_SECRET):
        return "Invalid signature", 403

    # ✅ Mark the order paid in your database, once per trade_id
    print(f"Payment confirmed: order {data['order_id']}, trade {data['trade_id']}")

    return "ok", 200  # Must return 200!

// Express example
import express from 'express';
import crypto from 'crypto';

const app = express();
app.use(express.urlencoded({ extended: false })); // the webhook is form-urlencoded, not JSON

const API_SECRET = 'your_api_secret';

function verifySign(payload, secret) {
  const { sign = '', ...fields } = payload;
  // Every field that arrived except sign and is_test, skipping empty ones
  const paramStr = Object.keys(fields)
    .filter((k) => k !== 'is_test' && fields[k] !== '')
    .sort()
    .map((k) => `${k}=${fields[k]}`)
    .join('&');
  const expected = Buffer.from(crypto.createHmac('sha256', secret).update(paramStr).digest('hex'));
  const received = Buffer.from(String(sign));
  return expected.length === received.length && crypto.timingSafeEqual(expected, received);
}

app.post('/webhook', (req, res) => {
  if (!verifySign(req.body, API_SECRET)) {
    return res.status(403).send('Invalid signature');
  }

  const { order_id, trade_id } = req.body;
  // ✅ Mark the order paid in your database, once per trade_id
  console.log(`Payment confirmed: order ${order_id}, trade ${trade_id}`);

  res.status(200).send('ok'); // Must return 200!
});

<?php
$apiSecret = 'your_api_secret';
$payload = $_POST; // the webhook is form-urlencoded, not JSON

function verifySign(array $payload, string $secret): bool {
    $received = (string) ($payload['sign'] ?? '');
    // Every field that arrived except sign and is_test, skipping empty ones
    unset($payload['sign'], $payload['is_test']);
    $payload = array_filter($payload, fn($v) => $v !== '');
    ksort($payload, SORT_STRING);
    $parts = [];
    foreach ($payload as $k => $v) {
        $parts[] = $k . '=' . $v; // raw values: http_build_query would URL-encode them
    }
    return hash_equals(hash_hmac('sha256', implode('&', $parts), $secret), $received);
}

if (!verifySign($payload, $apiSecret)) {
    http_response_code(403);
    die('Invalid signature');
}

// ✅ Mark the order paid in your database, once per trade_id
error_log("Payment confirmed: order {$payload['order_id']}, trade {$payload['trade_id']}");

http_response_code(200);
echo 'ok'; // Must return 200!

func webhookHandler(w http.ResponseWriter, r *http.Request) {
	// The webhook is form-urlencoded, not JSON
	if err := r.ParseForm(); err != nil {
		http.Error(w, "Bad request", http.StatusBadRequest)
		return
	}
	received := r.PostForm.Get("sign")

	// Every field that arrived except sign and is_test, skipping empty ones
	keys := make([]string, 0, len(r.PostForm))
	for k := range r.PostForm {
		if k != "sign" && k != "is_test" && r.PostForm.Get(k) != "" {
			keys = append(keys, k)
		}
	}
	sort.Strings(keys)
	parts := make([]string, 0, len(keys))
	for _, k := range keys {
		parts = append(parts, k+"="+r.PostForm.Get(k))
	}

	mac := hmac.New(sha256.New, []byte(apiSecret))
	mac.Write([]byte(strings.Join(parts, "&")))
	expected := hex.EncodeToString(mac.Sum(nil))

	if !hmac.Equal([]byte(received), []byte(expected)) {
		http.Error(w, "Invalid signature", http.StatusForbidden)
		return
	}

	// ✅ Mark the order paid in your database, once per trade_id
	log.Printf("Payment confirmed: order %s, trade %s", r.PostForm.Get("order_id"), r.PostForm.Get("trade_id"))

	w.WriteHeader(http.StatusOK)
	w.Write([]byte("ok")) // Must return 200!
}