README

Official PHP SDK for the inPAY payment platform (Uzbekistan). One inPAY contract → accept Click, Payme, UzCard/HUMO with a few lines of code.

Bitta inPAY shartnomasi bilan barcha to'lov usullarini qabul qiling — har bir PSP bilan alohida integratsiya qilish shart emas.

O'rnatish / Installation

composer require inpayuz/inpay-php

Talab: PHP ≥ 7.4, ext-curl, ext-json.

Tez boshlash / Quick start

use InPay\InPay;

$inpay = new InPay([
    'merchant_id'    => 12345,          // kassa merchant_id
    'bearer_token'   => 'xxxxxxxx',     // kassa bearer token
    'webhook_secret' => 'yyyyyyyy',     // webhook imzosi uchun
]);

// 1) To'lov yaratish
$invoice = $inpay->create([
    'amount'       => 50000,            // so'm (min 1000)
    'callback_url' => 'https://shop.uz/inpay/webhook.php',
    'order_id'     => 'A-123',          // sizning ichki reference
]);

header('Location: ' . $invoice->payUrl);   // foydalanuvchini yo'naltiring

$invoice:

To'g'ridan-to'g'ri bitta usul

$invoice = $inpay->create([
    'amount'         => 50000,
    'payment_method' => 'click',   // 'click' | 'payme' | 'myuzcard'
]);
header('Location: ' . $invoice->payUrlLink);

2) Holatni tekshirish / Status

$tx = $inpay->status('a1b2c3d4e5f6a7b8');
if ($tx->isPaid()) {
    // ...
}
// $tx->status: 'pending' | 'success' | 'failed'

3) Webhook (payment.success)

inPAY to'lov muvaffaqiyatli bo'lganda callback_url'ingizga POST yuboradi va uni X-InPAY-Signature (HMAC-SHA256) bilan imzolaydi. SDK imzoni constant-time tekshiradi.

use InPay\InPay;
use InPay\Transaction;

$inpay = new InPay([
    'merchant_id'    => 12345,
    'bearer_token'   => 'xxxxxxxx',
    'webhook_secret' => 'yyyyyyyy',
]);

$inpay->webhook()->onSuccess(function (Transaction $tx) {
    // ⚠️ IDEMPOTENT bo'ling — takror kelishi mumkin
    // if (already_paid($tx->orderId)) return;
    // mark_paid($tx->orderId, $tx->amount);
});

Qo'lda tekshirish (framework ichida):

$wh   = $inpay->webhook();
$body = file_get_contents('php://input');
$sig  = $_SERVER['HTTP_X_INPAY_SIGNATURE'] ?? '';

if ($wh->isValid($body, $sig)) {
    $tx = $wh->verify($body, $sig);   // Transaction
}

Xavfsizlik: imzo tekshiruvidan o'tmagan webhook'ni HECH QACHON to'lov deb qabul qilmang. Tekshiruvsiz har kim soxta success yuborishi mumkin.

Xatolar / Errors

use InPay\Exception\ApiException;      // inPAY biznes-xatosi (error_code bilan)
use InPay\Exception\SignatureException;// webhook imzosi mos emas
use InPay\Exception\InPayException;    // bazaviy tur (hammasini ushlaydi)

try {
    $inpay->create([...]);
} catch (ApiException $e) {
    echo $e->getErrorCode();   // masalan "MERCHANT_INACTIVE", "AMOUNT_TOO_LOW"
}

Litsenziya

MIT © inPAY