Payment Infrastructure
for You

const createPayin = async () => {
  const body = {
    uid: "user_2883",
    merchantOid: crypto.randomUUID(),
    amount: 1000000,
    notifyUrl: "https://your-server.com/callback/payin",
    redirectUrl: "https://your-app.com/payment/success",
    timestamp: Math.floor(Date.now() / 1000),
    name: "Taylor", email: "[email protected]",
    phone: "08123456789", passage: "your_passage", type: "payin"
  };
  const sign = generateRSASignature(body, privateKey);
  const res = await fetch("https://{domain}/api/v1/payin/create", {
    method: "POST",
    headers: { "Content-Type": "application/json", "SIGN": sign, "MCODE": MCODE },
    body: JSON.stringify(body)
  });
  return res.json();
};

body := map[string]interface{}{
    "uid": "user_2883", "merchantOid": uuid.New().String(),
    "amount": 1000000, "notifyUrl": "https://your-server.com/callback/payin",
    "redirectUrl": "https://your-app.com/payment/success",
    "timestamp": time.Now().Unix(), "name": "Taylor",
    "email": "[email protected]", "phone": "08123456789",
    "type": "payin",
}
sorted := JsonToSortedString(body)
hash := sha256.Sum256([]byte(sorted))
hashHex := hex.EncodeToString(hash[:])
sig, _ := rsa.SignPKCS1v15(rand.Reader, privKey, crypto.SHA256,
    sha256.Sum256([]byte(hashHex))[:])
signB64 := base64.StdEncoding.EncodeToString(sig)

req, _ := http.NewRequest("POST", "https://{domain}/api/v1/payin/create", jsonBody)
req.Header.Set("SIGN", signB64)
req.Header.Set("MCODE", mcode)

body = {
    "uid": "user_2883", "merchantOid": str(uuid.uuid4()),
    "amount": 1000000, "notifyUrl": "https://your-server.com/callback/payin",
    "redirectUrl": "https://your-app.com/payment/success",
    "timestamp": int(time.time()), "name": "Taylor",
    "email": "[email protected]", "phone": "08123456789",
    "type": "payin"
}
sorted_str = "&".join(f"{k}={v}" for k, v in sorted(body.items()) if v)
hash_hex = hashlib.sha256(sorted_str.encode()).hexdigest()
key = RSA.import_key(open("private.pem").read())
signature = pkcs1_15.new(key).sign(SHA256.new(hash_hex.encode()))
sign_b64 = base64.b64encode(signature).decode()

resp = requests.post("https://{domain}/api/v1/payin/create",
    json=body, headers={"SIGN": sign_b64, "MCODE": MCODE})

Map<String, Object> body = new TreeMap<>();
body.put("uid", "user_2883");
body.put("merchantOid", UUID.randomUUID().toString());
body.put("amount", 1000000);
body.put("notifyUrl", "https://your-server.com/callback/payin");
body.put("redirectUrl", "https://your-app.com/payment/success");
body.put("timestamp", System.currentTimeMillis() / 1000);
body.put("name", "Taylor");  body.put("email", "[email protected]");
body.put("phone", "08123456789");  body.put("type", "payin");

String sorted = body.entrySet().stream()
    .filter(e -> !e.getValue().toString().isEmpty())
    .map(e -> e.getKey() + "=" + e.getValue()).collect(Collectors.joining("&"));
String hash = sha256Hex(sorted);
Signature sig = Signature.getInstance("SHA256withRSA");
sig.initSign(privateKey);  sig.update(hash.getBytes());
String signB64 = Base64.getEncoder().encodeToString(sig.sign());
// POST with headers SIGN + MCODE

$body = [
    "uid" => "user_2883",
    "merchantOid" => sprintf("%s-%s-%s-%s-%s", ...),  // UUID
    "amount" => 1000000,
    "notifyUrl" => "https://your-server.com/callback/payin",
    "redirectUrl" => "https://your-app.com/payment/success",
    "timestamp" => time(),
    "name" => "Taylor", "email" => "[email protected]",
    "phone" => "08123456789", "type" => "payin"
];
$sign = PaymentAggregationSystem::sign($body, $privateKeyPem);

$ch = curl_init("https://{domain}/api/v1/payin/create");
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_HTTPHEADER => [
        "Content-Type: application/json",
        "SIGN: " . $sign,
        "MCODE: " . $mcode
    ],
    CURLOPT_POSTFIELDS => json_encode($body),
    CURLOPT_RETURNTRANSFER => true
]);
$result = json_decode(curl_exec($ch), true);
curl_close($ch);

const createPayout = async () => {
  const body = {
    uid: "3800", name: "John Doe",
    notifyUrl: "https://your-server.com/callback/payout",
    amount: 1500000,
    merchantOid: crypto.randomUUID(),
    bankCode: "014",  // BCA
    accountNo: "1234567890",
    email: "[email protected]",
    note: "payout",
    type: "payout",
    feeType: "Additional",
    passage: "your_passage"
  };
  const sign = generateRSASignature(body, privateKey);
  const res = await fetch("https://{domain}/api/v1/payout/create", {
    method: "POST",
    headers: { "Content-Type": "application/json", "SIGN": sign, "MCODE": MCODE },
    body: JSON.stringify(body)
  });
  return res.json();
};

body := map[string]interface{}{
    "uid": "3800", "name": "John Doe",
    "notifyUrl":    "https://your-server.com/callback/payout",
    "amount":       1500000,
    "merchantOid":  uuid.New().String(),
    "bankCode":     "014",  // BCA
    "accountNo":    "1234567890",
    "email":        "[email protected]",
    "note":         "payout",
    "type":         "payout",
    "feeType":      "Additional",
    "passage":      "your_passage",
}
sorted := JsonToSortedString(body)
hash := sha256.Sum256([]byte(sorted))
hashHex := hex.EncodeToString(hash[:])
sig, _ := rsa.SignPKCS1v15(rand.Reader, privKey, crypto.SHA256,
    sha256.Sum256([]byte(hashHex))[:])
signB64 := base64.StdEncoding.EncodeToString(sig)

req, _ := http.NewRequest("POST", "https://{domain}/api/v1/payout/create", jsonBody)
req.Header.Set("SIGN", signB64)
req.Header.Set("MCODE", mcode)

body = {
    "uid": "3800", "name": "John Doe",
    "notifyUrl": "https://your-server.com/callback/payout",
    "amount": 1500000,
    "merchantOid": str(uuid.uuid4()),
    "bankCode": "014",  # BCA
    "accountNo": "1234567890",
    "email": "[email protected]",
    "note": "payout",
    "type": "payout",
    "feeType": "Additional",
    "passage": "your_passage"
}
sorted_str = "&".join(f"{k}={v}" for k, v in sorted(body.items()) if v)
hash_hex = hashlib.sha256(sorted_str.encode()).hexdigest()
key = RSA.import_key(open("private.pem").read())
signature = pkcs1_15.new(key).sign(SHA256.new(hash_hex.encode()))
sign_b64 = base64.b64encode(signature).decode()

resp = requests.post("https://{domain}/api/v1/payout/create",
    json=body, headers={"SIGN": sign_b64, "MCODE": MCODE})

Map<String, Object> body = new TreeMap<>();
body.put("uid", "3800");  body.put("name", "John Doe");
body.put("notifyUrl", "https://your-server.com/callback/payout");
body.put("amount", 1500000);
body.put("merchantOid", UUID.randomUUID().toString());
body.put("bankCode", "014");  // BCA
body.put("accountNo", "1234567890");
body.put("email", "[email protected]");
body.put("note", "payout");
body.put("type", "payout");
body.put("feeType", "Additional");
body.put("passage", "your_passage");

String sorted = body.entrySet().stream()
    .filter(e -> !e.getValue().toString().isEmpty())
    .map(e -> e.getKey() + "=" + e.getValue()).collect(Collectors.joining("&"));
String hash = sha256Hex(sorted);
Signature sig = Signature.getInstance("SHA256withRSA");
sig.initSign(privateKey);  sig.update(hash.getBytes());
String signB64 = Base64.getEncoder().encodeToString(sig.sign());
// POST with headers SIGN + MCODE

$body = [
    "uid" => "3800", "name" => "John Doe",
    "notifyUrl" => "https://your-server.com/callback/payout",
    "amount" => 1500000,
    "merchantOid" => uniqid("", true),
    "bankCode" => "014",  // BCA
    "accountNo" => "1234567890",
    "email" => "[email protected]",
    "note" => "payout",
    "type" => "payout",
    "feeType" => "Additional",
    "passage" => "your_passage"
];
$sign = PaymentAggregationSystem::sign($body, $privateKeyPem);

$ch = curl_init("https://{domain}/api/v1/payout/create");
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_HTTPHEADER => [
        "Content-Type: application/json",
        "SIGN: " . $sign,
        "MCODE: " . $mcode
    ],
    CURLOPT_POSTFIELDS => json_encode($body),
    CURLOPT_RETURNTRANSFER => true
]);
$result = json_decode(curl_exec($ch), true);
curl_close($ch);

const queryOrder = async (type, merchantOid) => {
  const body = { type, merchantOid };
  const sign = generateRSASignature(body, privateKey);
  const res = await fetch("https://{domain}/api/v1/query/order", {
    method: "POST",
    headers: { "Content-Type": "application/json", "SIGN": sign, "MCODE": MCODE },
    body: JSON.stringify(body)
  });
  return res.json();
};
// Usage
const result = await queryOrder("payin", "9d6e7671-64b9-408b-abad-1ef4601af101");

body := map[string]interface{}{
    "type":        "payin",
    "merchantOid": "9d6e7671-64b9-408b-abad-1ef4601af101",
}
sorted := JsonToSortedString(body)
hash := sha256.Sum256([]byte(sorted))
hashHex := hex.EncodeToString(hash[:])
sig, _ := rsa.SignPKCS1v15(rand.Reader, privKey, crypto.SHA256,
    sha256.Sum256([]byte(hashHex))[:])

req, _ := http.NewRequest("POST", "https://{domain}/api/v1/query/order", jsonBody)
req.Header.Set("SIGN", base64.StdEncoding.EncodeToString(sig))
req.Header.Set("MCODE", mcode)

def query_order(order_type, merchant_oid):
    body = {"type": order_type, "merchantOid": merchant_oid}
    sorted_str = "&".join(f"{k}={v}" for k, v in sorted(body.items()) if v)
    hash_hex = hashlib.sha256(sorted_str.encode()).hexdigest()
    key = RSA.import_key(open("private.pem").read())
    signature = pkcs1_15.new(key).sign(SHA256.new(hash_hex.encode()))
    sign_b64 = base64.b64encode(signature).decode()

    resp = requests.post("https://{domain}/api/v1/query/order",
        json=body, headers={"SIGN": sign_b64, "MCODE": MCODE})
    return resp.json()

# Usage
result = query_order("payin", "9d6e7671-64b9-408b-abad-1ef4601af101")

Map<String, Object> body = new TreeMap<>();
body.put("type", "payin");
body.put("merchantOid", "9d6e7671-64b9-408b-abad-1ef4601af101");

String sorted = body.entrySet().stream()
    .map(e -> e.getKey() + "=" + e.getValue()).collect(Collectors.joining("&"));
String hash = sha256Hex(sorted);
Signature sig = Signature.getInstance("SHA256withRSA");
sig.initSign(privateKey);  sig.update(hash.getBytes());
String signB64 = Base64.getEncoder().encodeToString(sig.sign());
// POST to /query/order with headers SIGN + MCODE

$body = [
    "type" => "payin",
    "merchantOid" => "9d6e7671-64b9-408b-abad-1ef4601af101"
];
$sign = PaymentAggregationSystem::sign($body, $privateKeyPem);

$ch = curl_init("https://{domain}/api/v1/query/order");
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_HTTPHEADER => [
        "Content-Type: application/json",
        "SIGN: " . $sign,
        "MCODE: " . $mcode
    ],
    CURLOPT_POSTFIELDS => json_encode($body),
    CURLOPT_RETURNTRANSFER => true
]);
$result = json_decode(curl_exec($ch), true);
curl_close($ch);

const queryBalance = async () => {
  // For balance query, sign the MCODE value itself
  const hash = crypto.createHash("sha256").update(MCODE).digest("hex");
  const sign = crypto.sign("sha256", Buffer.from(hash), privateKey);
  const signB64 = sign.toString("base64");

  const res = await fetch("https://{domain}/api/v1/query/balance", {
    headers: { "SIGN": signB64, "MCODE": MCODE }
  });
  return res.json();
  // { code: 0, data: { amount: 50000000, settleAmount: 10000000, freezeAmount: 0 }, msg: "Operation successful" }
};

// For balance query, sign the MCODE value itself
hash := sha256.Sum256([]byte(mcode))
hashHex := hex.EncodeToString(hash[:])
sig, _ := rsa.SignPKCS1v15(rand.Reader, privKey, crypto.SHA256,
    sha256.Sum256([]byte(hashHex))[:])
signB64 := base64.StdEncoding.EncodeToString(sig)

req, _ := http.NewRequest("GET", "https://{domain}/api/v1/query/balance", nil)
req.Header.Set("SIGN", signB64)
req.Header.Set("MCODE", mcode)

def query_balance():
    # For balance query, sign the MCODE value itself
    hash_hex = hashlib.sha256(MCODE.encode()).hexdigest()
    key = RSA.import_key(open("private.pem").read())
    signature = pkcs1_15.new(key).sign(SHA256.new(hash_hex.encode()))
    sign_b64 = base64.b64encode(signature).decode()

    resp = requests.get("https://{domain}/api/v1/query/balance",
        headers={"SIGN": sign_b64, "MCODE": MCODE})
    return resp.json()
    # {"code": 0, "data": {"amount": 50000000, "settleAmount": 10000000, "freezeAmount": 0}, "msg": "Operation successful"}

// For balance query, sign the MCODE value itself
String hash = sha256Hex(MCODE);
Signature sig = Signature.getInstance("SHA256withRSA");
sig.initSign(privateKey);
sig.update(hash.getBytes());
String signB64 = Base64.getEncoder().encodeToString(sig.sign());

HttpURLConnection conn = (HttpURLConnection)
    new URL("https://{domain}/api/v1/query/balance").openConnection();
conn.setRequestMethod("GET");
conn.setRequestProperty("SIGN", signB64);
conn.setRequestProperty("MCODE", MCODE);

// For balance query, sign the MCODE value itself
$hashHex = hash("sha256", $mcode);
$privKey = openssl_pkey_get_private($privateKeyPem);
openssl_sign($hashHex, $signature, $privKey, OPENSSL_ALGO_SHA256);
$signB64 = base64_encode($signature);

$ch = curl_init("https://{domain}/api/v1/query/balance");
curl_setopt_array($ch, [
    CURLOPT_HTTPHEADER => [
        "SIGN: " . $signB64,
        "MCODE: " . $mcode
    ],
    CURLOPT_RETURNTRANSFER => true
]);
$result = json_decode(curl_exec($ch), true);
// {"code": 0, "data": {"amount": 50000000, "settleAmount": 10000000, "freezeAmount": 0}, "msg": "Operation successful"}

// Express.js handler
app.post("/callback/payin", async (req, res) => {
  const sign = req.headers["onepay-sign"];
  const body = req.body;

  // Sort body params, hash, verify
  const data = body;
  const sorted = Object.keys(data).sort()
    .filter(k => data[k] !== "")
    .map(k => `${k}=${data[k]}`).join("&");
  const hash = crypto.createHash("sha256").update(sorted).digest("hex");

  // Decrypt signature with private key
  const decrypted = crypto.privateDecrypt(
    { key: privateKey, padding: crypto.constants.RSA_PKCS1_PADDING },
    Buffer.from(sign, "base64")
  ).toString();

  if (decrypted !== hash) return res.status(400).send("FAIL");

  // Process order (idempotent!)
  if (data.status === "order_success") {
    await updateOrderStatus(data.merchantOid, data.status, data.settleStatus);
  }
  res.send("SUCCESS");
});

func PayinCallback(c *gin.Context) {
    sign := c.GetHeader("ONEPAY-SIGN")
    var body map[string]interface{}
    c.ShouldBindJSON(&body)

    // Sort body params, hash
    data := body
    sorted := JsonToSortedString(data)
    hash := sha256.Sum256([]byte(sorted))
    hashHex := hex.EncodeToString(hash[:])

    // Decrypt SIGN with private key
    decrypted, err := DecryptWithPrivateKey(privKey, sign)
    if err != nil || decrypted != hashHex {
        c.String(400, "FAIL")
        return
    }

    // Process order (idempotent)
    status := data["status"].(string)
    if status == "order_success" {
        updateOrderStatus(data["merchantOid"].(string), status)
    }
    c.String(200, "SUCCESS")
}

# Flask handler
@app.route("/callback/payin", methods=["POST"])
def payin_callback():
    sign = request.headers.get("ONEPAY-SIGN")
    body = request.get_json()

    # Sort body params, hash
    data = body
    sorted_str = "&".join(f"{k}={v}" for k, v in sorted(data.items()) if str(v))
    hash_hex = hashlib.sha256(sorted_str.encode()).hexdigest()

    # Decrypt signature with private key
    key = RSA.import_key(open("private.pem").read())
    cipher = PKCS1_v1_5.new(key)
    decrypted = cipher.decrypt(base64.b64decode(sign), None).decode()

    if decrypted != hash_hex:
        return "FAIL", 400

    # Process order (idempotent)
    if data["status"] == "order_success":
        update_order(data["merchantOid"], data["status"], data["settleStatus"])
    return "SUCCESS"

// Spring Boot handler
@PostMapping("/callback/payin")
public String payinCallback(
    @RequestHeader("ONEPAY-SIGN") String sign,
    @RequestBody Map<String, Object> body) {

    // Sort body params, hash
    Map<String, Object> data = body;
    String sorted = new TreeMap<>(data).entrySet().stream()
        .filter(e -> !e.getValue().toString().isEmpty())
        .map(e -> e.getKey() + "=" + e.getValue())
        .collect(Collectors.joining("&"));
    String hash = sha256Hex(sorted);

    // Decrypt signature with private key
    Cipher cipher = Cipher.getInstance("RSA/ECB/PKCS1Padding");
    cipher.init(Cipher.DECRYPT_MODE, privateKey);
    String decrypted = new String(cipher.doFinal(Base64.getDecoder().decode(sign)));

    if (!decrypted.equals(hash)) return "FAIL";

    // Process order (idempotent)
    if ("order_success".equals(data.get("status"))) {
        updateOrder(data.get("merchantOid"), data.get("status"));
    }
    return "SUCCESS";
}

// Laravel/raw PHP callback handler
$sign = $_SERVER['HTTP_ONEPAY_SIGN'] ?? '';
$body = json_decode(file_get_contents('php://input'), true);
$data = $body;

// Sort body params, hash
ksort($data);
$pairs = [];
foreach ($data as $k => $v) {
    if ((string)$v !== '') $pairs[] = "$k=$v";
}
$sorted = implode('&', $pairs);
$hashHex = hash('sha256', $sorted);

// Decrypt signature with private key
$privKey = openssl_pkey_get_private($privateKeyPem);
openssl_private_decrypt(base64_decode($sign), $decrypted, $privKey);

if ($decrypted !== $hashHex) {
    http_response_code(400);
    echo "FAIL"; exit;
}

// Process order (idempotent)
if ($data['status'] === 'order_success') {
    updateOrder($data['merchantOid'], $data['status'], $data['settleStatus']);
}
echo "SUCCESS";