Przelewy24 REST API: płatność od rejestracji do weryfikacji

1<?php2declare(strict_types=1);3 4final class Przelewy245{6    public function __construct(7        public readonly string $baseUrl,  // https://sandbox.przelewy24.pl8        public readonly int $merchantId,9        public readonly int $posId,10        private string $apiKey,           // klucz do raportów (API) z panelu11        private string $crc,              // klucz CRC z panelu12    ) {}13 14    /** SHA-384 z JSON-a o stałej kolejności pól, zawsze zakończonego kluczem CRC. */15    public function sign(array $fields): string16    {17        $fields['crc'] = $this->crc;18        return hash('sha384', json_encode($fields, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES));19    }20 21    public function call(string $method, string $path, ?array $body = null): array22    {23        $curl = curl_init($this->baseUrl . $path);24        curl_setopt_array($curl, [25            CURLOPT_CUSTOMREQUEST => $method,26            CURLOPT_USERPWD => $this->posId . ':' . $this->apiKey,27            CURLOPT_HTTPHEADER => ['Content-Type: application/json'],28            CURLOPT_RETURNTRANSFER => true,29            CURLOPT_TIMEOUT => 30,30        ]);31        if ($body !== null) {32            curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode($body, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES));33        }34        $raw = (string) curl_exec($curl);35        $status = curl_getinfo($curl, CURLINFO_RESPONSE_CODE);36        curl_close($curl);37        return [$status, json_decode($raw, true)];38    }39}

1$p24 = new Przelewy24(2    'https://sandbox.przelewy24.pl',3    (int) getenv('P24_MERCHANT_ID'),4    (int) getenv('P24_POS_ID'),5    getenv('P24_API_KEY'),6    getenv('P24_CRC'),7);8 9[$status, $body] = $p24->call('GET', '/api/v1/testAccess');10// 200 przy poprawnych danych, 401 {"error":"Incorrect authentication"} przy złych

1$sessionId = 'zamowienie-' . $order->id;  // unikalny w Twoim systemie2$amount = 12300;                           // w groszach: 123,00 zł3 4$db->prepare('UPDATE orders SET p24_session = ?, p24_amount = ? WHERE id = ?')5   ->execute([$sessionId, $amount, $order->id]);

1[$status, $body] = $p24->call('POST', '/api/v1/transaction/register', [2    'merchantId' => $p24->merchantId,3    'posId' => $p24->posId,4    'sessionId' => $sessionId,5    'amount' => $amount,6    'currency' => 'PLN',7    'description' => 'Zamówienie ' . $order->id,8    'email' => $order->email,9    'country' => 'PL',10    'language' => 'pl',11    'urlReturn' => 'https://sklep.example/zamowienie/' . $order->id,12    'urlStatus' => 'https://sklep.example/p24/powiadomienie',13    'sign' => $p24->sign([14        'sessionId' => $sessionId,15        'merchantId' => $p24->merchantId,16        'amount' => $amount,17        'currency' => 'PLN',18    ]),19]);20 21if ($status !== 200) {22    throw new RuntimeException('P24 register: ' . json_encode($body));23}24header('Location: ' . $p24->baseUrl . '/trnRequest/' . $body['data']['token']);

1$n = json_decode(file_get_contents('php://input'), true);2 3$expected = $p24->sign([4    'merchantId' => $n['merchantId'],5    'posId' => $n['posId'],6    'sessionId' => $n['sessionId'],7    'amount' => $n['amount'],8    'originAmount' => $n['originAmount'],9    'currency' => $n['currency'],10    'orderId' => $n['orderId'],11    'methodId' => $n['methodId'],12    'statement' => $n['statement'],13]);14if (!hash_equals($expected, (string) ($n['sign'] ?? ''))) {15    http_response_code(400);16    exit;17}18 19$order = findOrderBySessionId($n['sessionId']);20if ($order === null || $order->p24_amount !== $n['amount'] || $n['currency'] !== 'PLN') {21    http_response_code(400);22    exit;23}

1[$status, $body] = $p24->call('PUT', '/api/v1/transaction/verify', [2    'merchantId' => $p24->merchantId,3    'posId' => $p24->posId,4    'sessionId' => $n['sessionId'],5    'amount' => $n['amount'],6    'currency' => $n['currency'],7    'orderId' => $n['orderId'],8    'sign' => $p24->sign([9        'sessionId' => $n['sessionId'],10        'orderId' => $n['orderId'],11        'amount' => $n['amount'],12        'currency' => $n['currency'],13    ]),14]);15 16if ($status === 200 && ($body['data']['status'] ?? null) === 'success') {17    markOrderPaid($order, $n['orderId']);  // dopiero tu zamówienie jest opłacone18}19http_response_code(200);

1// zamowienie.php, adres z urlReturn2if ($order->paid_at === null) {3    echo 'Czekamy na potwierdzenie płatności z Przelewy24. Odśwież stronę za chwilę.';4} else {5    echo 'Płatność przyjęta. Dziękujemy!';6}