Payment gateway API documentation

<?php
// 1) Save the order in YOUR database first (status = pending),
//    keyed by a unique identifier (max 20 chars, unique forever).
$identifier = 'ORD' . time() . rand(100, 999);   // e.g. ORD1790000000123

$parameters = [
    'public_key'     => 'YOUR_PUBLIC_KEY',
    'identifier'     => $identifier,
    'currency'       => 'PKR',
    'amount'         => 500,                       // PKR
    'details'        => 'Wallet Recharge',
    'ipn_url'        => 'https://yourdomain.com/zurvapay/ipn.php',
    'success_url'    => 'https://yourdomain.com/payment/success',
    'cancel_url'     => 'https://yourdomain.com/payment/cancel',
    'site_logo'      => 'https://yourdomain.com/logo.png',  // optional
    'checkout_theme' => 'dark',                              // optional: dark | light
    'customer_name'  => 'John Doe',
    'customer_email' => 'john@mail.com',
];

$ch = curl_init('https://zurvapay.com/payment/initiate');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $parameters);     // form data
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 30);
$result = json_decode(curl_exec($ch), true);
curl_close($ch);

if (($result['success'] ?? '') === 'ok') {
    header('Location: ' . $result['url']);   // send the customer to checkout
    exit;
}
echo 'Payment could not be started: ' . ($result['message'] ?? 'unknown error');

curl -X POST "https://zurvapay.com/payment/initiate" \
  -F "public_key=YOUR_PUBLIC_KEY" \
  -F "identifier=ORD1790000000123" \
  -F "currency=PKR" \
  -F "amount=500" \
  -F "details=Wallet Recharge" \
  -F "ipn_url=https://yourdomain.com/zurvapay/ipn.php" \
  -F "success_url=https://yourdomain.com/payment/success" \
  -F "cancel_url=https://yourdomain.com/payment/cancel" \
  -F "checkout_theme=dark" \
  -F "customer_name=John Doe" \
  -F "customer_email=john@mail.com"

import time, random, requests

identifier = f"ORD{int(time.time())}{random.randint(100, 999)}"

r = requests.post("https://zurvapay.com/payment/initiate", data={
    "public_key": "YOUR_PUBLIC_KEY",
    "identifier": identifier,
    "currency": "PKR",
    "amount": 500,
    "details": "Wallet Recharge",
    "ipn_url": "https://yourdomain.com/zurvapay/ipn",
    "success_url": "https://yourdomain.com/payment/success",
    "cancel_url": "https://yourdomain.com/payment/cancel",
    "checkout_theme": "dark",
    "customer_name": "John Doe",
    "customer_email": "john@mail.com",
}, timeout=30)

res = r.json()
if res.get("success") == "ok":
    checkout_url = res["url"]      # redirect the customer here
else:
    print("Error:", res.get("message"))

// Node.js 18+ (built-in fetch)
const identifier = 'ORD' + Date.now().toString().slice(0, 10) + Math.floor(100 + Math.random() * 900);

const body = new URLSearchParams({
  public_key: 'YOUR_PUBLIC_KEY',
  identifier,
  currency: 'PKR',
  amount: '500',
  details: 'Wallet Recharge',
  ipn_url: 'https://yourdomain.com/zurvapay/ipn',
  success_url: 'https://yourdomain.com/payment/success',
  cancel_url: 'https://yourdomain.com/payment/cancel',
  checkout_theme: 'dark',
  customer_name: 'John Doe',
  customer_email: 'john@mail.com',
});

const res = await (await fetch('https://zurvapay.com/payment/initiate', { method: 'POST', body })).json();
if (res.success === 'ok') {
  // res.redirect(res.url)  -> send the customer to checkout
} else {
  console.error(res.message);
}

<?php
// ipn.php  —  ZurvaPay POSTs here (form data) when a payment is PAID.
// This is the ONLY place you should mark an order as paid.

$secret = 'YOUR_SECRET_KEY';

$status     = $_POST['status']     ?? '';
$identifier = $_POST['identifier'] ?? '';
$signature  = $_POST['signature']  ?? '';
$statusSig  = $_POST['status_signature'] ?? '';
$data       = $_POST['data']       ?? [];
$amount     = $data['amount']      ?? '';        // e.g. "500.00000000" — use AS-IS

// 1) Verify signatures (use the raw strings exactly as received)
$expected       = strtoupper(hash_hmac('sha256', $amount . $identifier, $secret));
$expectedStatus = strtoupper(hash_hmac('sha256', $status . '|' . $identifier . '|' . $amount, $secret));

if (!hash_equals($expected, $signature) || !hash_equals($expectedStatus, $statusSig) || $status !== 'success') {
    http_response_code(200);
    echo json_encode(['status' => 'failed']);
    exit;
}

// 2) Find YOUR pending order and check the amount
$order = find_order_by_identifier($identifier);           // your function
if ($order && $order['status'] === 'pending' && (float) $amount >= (float) $order['amount']) {
    // 3) Mark paid ONCE (use a DB transaction / row lock), then deliver
    mark_order_paid($order['id'], $data['payment_trx']);   // your function
}

// 4) Always answer HTTP 200 — anything else makes ZurvaPay retry
http_response_code(200);
echo json_encode(['status' => 'ok']);

# Flask example
import hmac, hashlib
from flask import Flask, request, jsonify

app = Flask(__name__)
SECRET = b"YOUR_SECRET_KEY"

def sign(msg: str) -> str:
    return hmac.new(SECRET, msg.encode(), hashlib.sha256).hexdigest().upper()

@app.post("/zurvapay/ipn")
def zurvapay_ipn():
    f = request.form
    status, identifier = f.get("status", ""), f.get("identifier", "")
    amount = f.get("data[amount]", "")                      # raw string, e.g. "500.00000000"

    ok = (hmac.compare_digest(sign(amount + identifier), f.get("signature", ""))
          and hmac.compare_digest(sign(f"{status}|{identifier}|{amount}"), f.get("status_signature", ""))
          and status == "success")

    if ok:
        order = find_pending_order(identifier)              # your function
        if order and float(amount) >= float(order.amount):
            mark_order_paid(order.id, f.get("data[payment_trx]"))   # once only
        return jsonify(status="ok"), 200
    return jsonify(status="failed"), 200

// Express example
const express = require('express');
const crypto = require('crypto');
const app = express();
app.use(express.urlencoded({ extended: true }));   // IPN is form-encoded

const SECRET = 'YOUR_SECRET_KEY';
const sign = (msg) => crypto.createHmac('sha256', SECRET).update(msg).digest('hex').toUpperCase();
const same = (a, b) => a.length === b.length && crypto.timingSafeEqual(Buffer.from(a), Buffer.from(b));

app.post('/zurvapay/ipn', async (req, res) => {
  const { status = '', identifier = '', signature = '', status_signature = '' } = req.body;
  const data = req.body.data || {};
  const amount = String(data.amount || '');           // raw string, e.g. "500.00000000"

  const valid = same(sign(amount + identifier), signature)
             && same(sign(`${status}|${identifier}|${amount}`), status_signature)
             && status === 'success';

  if (valid) {
    const order = await findPendingOrder(identifier);             // your function
    if (order && Number(amount) >= Number(order.amount)) {
      await markOrderPaid(order.id, data.payment_trx);            // once only
    }
    return res.status(200).json({ status: 'ok' });
  }
  res.status(200).json({ status: 'failed' });
});

<?php
function zurvapay_status(array $identifiers): array
{
    $ch = curl_init('https://zurvapay.com/payment/status');
    curl_setopt_array($ch, [
        CURLOPT_POST => true,
        CURLOPT_POSTFIELDS => http_build_query([
            'public_key'  => 'YOUR_PUBLIC_KEY',
            'secret_key'  => 'YOUR_SECRET_KEY',
            'identifiers' => $identifiers,            // max 50
        ]),
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT => 30,
    ]);
    $res = json_decode(curl_exec($ch), true);
    curl_close($ch);

    return ($res['success'] ?? '') === 'ok' ? $res['payments'] : [];
}

print_r(zurvapay_status(['ORD1790000000123', 'ORD1790000000456']));

# One payment
curl -X POST "https://zurvapay.com/payment/status" \
  -d "public_key=YOUR_PUBLIC_KEY" \
  -d "secret_key=YOUR_SECRET_KEY" \
  -d "identifier=ORD1790000000123"

# Up to 50 payments in one call
curl -X POST "https://zurvapay.com/payment/status" \
  -d "public_key=YOUR_PUBLIC_KEY" \
  -d "secret_key=YOUR_SECRET_KEY" \
  -d "identifiers[]=ORD1790000000123" \
  -d "identifiers[]=ORD1790000000456"

import requests

r = requests.post("https://zurvapay.com/payment/status", data={
    "public_key": "YOUR_PUBLIC_KEY",
    "secret_key": "YOUR_SECRET_KEY",
    "identifiers[]": ["ORD1790000000123", "ORD1790000000456"],
}, timeout=30)

for p in r.json().get("payments", []):
    print(p["identifier"], p["status"])

const body = new URLSearchParams();
body.append('public_key', 'YOUR_PUBLIC_KEY');
body.append('secret_key', 'YOUR_SECRET_KEY');
['ORD1790000000123', 'ORD1790000000456'].forEach(id => body.append('identifiers[]', id));

const res = await (await fetch('https://zurvapay.com/payment/status', { method: 'POST', body })).json();
for (const p of res.payments || []) console.log(p.identifier, p.status);

<?php
/**
 * zurvapay_cron.php — OPTIONAL. Completes orders whose customer paid but
 * the IPN never reached you (checkout error, closed browser, server down).
 * Run it every 5 minutes with a cron job (see "Schedule it" below).
 */
const PUBLIC_KEY = 'YOUR_PUBLIC_KEY';
const SECRET_KEY = 'YOUR_SECRET_KEY';
const STATUS_URL = 'https://zurvapay.com/payment/status';

$pdo = new PDO('mysql:host=localhost;dbname=YOUR_DB;charset=utf8mb4', 'DB_USER', 'DB_PASS', [
    PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
]);

// 1) Your ZurvaPay orders still pending, created in the last 24 hours
$rows = $pdo->query("SELECT id, identifier, amount FROM orders
                     WHERE gateway = 'zurvapay' AND status = 'pending'
                       AND created_at >= NOW() - INTERVAL 24 HOUR
                     ORDER BY id DESC LIMIT 50")->fetchAll(PDO::FETCH_ASSOC);
if (!$rows) exit("Nothing to check\n");

$orders = array_column($rows, null, 'identifier');

// 2) Ask ZurvaPay (max 50 identifiers per call)
$ch = curl_init(STATUS_URL);
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query([
        'public_key'  => PUBLIC_KEY,
        'secret_key'  => SECRET_KEY,
        'identifiers' => array_keys($orders),
    ]),
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 30,
]);
$res = json_decode(curl_exec($ch), true);
curl_close($ch);
if (($res['success'] ?? '') !== 'ok') exit('Status API error: ' . ($res['message'] ?? 'no response') . "\n");

// 3) Complete the paid ones — same checks as your IPN handler
foreach ($res['payments'] as $p) {
    if ($p['status'] !== 'success') continue;

    $expected = strtoupper(hash_hmac('sha256', $p['status'] . '|' . $p['identifier'] . '|' . $p['amount'], SECRET_KEY));
    if (!hash_equals($expected, $p['status_signature'])) continue;

    $order = $orders[$p['identifier']] ?? null;
    if (!$order || (float) $p['amount'] < (float) $order['amount']) continue;

    // Update only if STILL pending -> never double-credits (IPN may arrive at the same time)
    $pdo->beginTransaction();
    $upd = $pdo->prepare("UPDATE orders SET status = 'paid', payment_trx = ? WHERE id = ? AND status = 'pending'");
    $upd->execute([$p['payment_trx'], $order['id']]);
    if ($upd->rowCount() === 1) {
        deliver_order($pdo, $order['id']);   // your function: add balance / ship / activate ...
    }
    $pdo->commit();
    echo "Paid: {$p['identifier']}\n";
}

#!/usr/bin/env python3
# zurvapay_cron.py — OPTIONAL. Run every 5 minutes:
#   */5 * * * * /usr/bin/python3 /home/USER/zurvapay_cron.py
import hmac, hashlib, requests, pymysql

PUBLIC_KEY, SECRET_KEY = "YOUR_PUBLIC_KEY", "YOUR_SECRET_KEY"
STATUS_URL = "https://zurvapay.com/payment/status"

def sign(msg):
    return hmac.new(SECRET_KEY.encode(), msg.encode(), hashlib.sha256).hexdigest().upper()

db = pymysql.connect(host="localhost", user="DB_USER", password="DB_PASS", database="YOUR_DB", autocommit=False)
cur = db.cursor(pymysql.cursors.DictCursor)
cur.execute("""SELECT id, identifier, amount FROM orders
               WHERE gateway='zurvapay' AND status='pending'
                 AND created_at >= NOW() - INTERVAL 24 HOUR
               ORDER BY id DESC LIMIT 50""")
orders = {o["identifier"]: o for o in cur.fetchall()}
if not orders:
    raise SystemExit("Nothing to check")

res = requests.post(STATUS_URL, data={
    "public_key": PUBLIC_KEY, "secret_key": SECRET_KEY,
    "identifiers[]": list(orders.keys()),
}, timeout=30).json()
if res.get("success") != "ok":
    raise SystemExit(f"Status API error: {res.get('message')}")

for p in res["payments"]:
    if p["status"] != "success":
        continue
    if not hmac.compare_digest(sign(f"{p['status']}|{p['identifier']}|{p['amount']}"), p["status_signature"]):
        continue
    order = orders.get(p["identifier"])
    if not order or float(p["amount"]) < float(order["amount"]):
        continue
    # only if still pending -> no double credit
    changed = cur.execute("UPDATE orders SET status='paid', payment_trx=%s WHERE id=%s AND status='pending'",
                          (p["payment_trx"], order["id"]))
    if changed == 1:
        deliver_order(cur, order["id"])          # your function
    db.commit()
    print("Paid:", p["identifier"])

// zurvapay_cron.js — OPTIONAL. Run every 5 minutes:
//   */5 * * * * /usr/bin/node /home/USER/zurvapay_cron.js
const crypto = require('crypto');
const mysql = require('mysql2/promise');

const PUBLIC_KEY = 'YOUR_PUBLIC_KEY', SECRET_KEY = 'YOUR_SECRET_KEY';
const STATUS_URL = 'https://zurvapay.com/payment/status';
const sign = (m) => crypto.createHmac('sha256', SECRET_KEY).update(m).digest('hex').toUpperCase();

(async () => {
  const db = await mysql.createConnection({ host: 'localhost', user: 'DB_USER', password: 'DB_PASS', database: 'YOUR_DB' });
  const [rows] = await db.query(`SELECT id, identifier, amount FROM orders
                                 WHERE gateway='zurvapay' AND status='pending'
                                   AND created_at >= NOW() - INTERVAL 24 HOUR
                                 ORDER BY id DESC LIMIT 50`);
  if (!rows.length) return db.end();
  const orders = Object.fromEntries(rows.map(o => [o.identifier, o]));

  const body = new URLSearchParams({ public_key: PUBLIC_KEY, secret_key: SECRET_KEY });
  Object.keys(orders).forEach(id => body.append('identifiers[]', id));
  const res = await (await fetch(STATUS_URL, { method: 'POST', body })).json();
  if (res.success !== 'ok') { console.error('Status API error:', res.message); return db.end(); }

  for (const p of res.payments) {
    if (p.status !== 'success') continue;
    if (sign(`${p.status}|${p.identifier}|${p.amount}`) !== p.status_signature) continue;
    const order = orders[p.identifier];
    if (!order || Number(p.amount) < Number(order.amount)) continue;

    // only if still pending -> no double credit
    const [r] = await db.execute("UPDATE orders SET status='paid', payment_trx=? WHERE id=? AND status='pending'",
                                 [p.payment_trx, order.id]);
    if (r.affectedRows === 1) await deliverOrder(db, order.id);   // your function
    console.log('Paid:', p.identifier);
  }
  await db.end();
})();

<?php
// Server-side only. Never put the secret key in browser / app code.
$publicKey = 'YOUR_PUBLIC_KEY';
$secretKey = 'YOUR_SECRET_KEY';

// 1) Save the order in YOUR database first (status = pending) under a unique identifier.
$identifier = 'ORD' . time() . rand(100, 999);

$payload = [
    'identifier'     => $identifier,
    'amount'         => 500,                       // PKR
    'currency'       => 'PKR',
    'channel'        => 'dqrc',                    // jazzcash | easypaisa | dqrc
    'details'        => 'Order #1001',
    'customer_name'  => 'Ali Khan',
    'customer_email' => 'ali@example.com',
    'customer_phone' => '03001234567',             // required for jazzcash / easypaisa
    'ipn_url'        => 'https://yourshop.com/zurvapay_ipn.php',   // optional (see below)
];

$ch = curl_init('https://zurvapay.com/api/v1/payments');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => json_encode($payload),
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT        => 170,                 // JazzCash / EasyPaisa wait for the customer (up to ~2 min)
    CURLOPT_HTTPHEADER     => [
        'Content-Type: application/json',
        'Accept: application/json',
        'X-Public-Key: ' . $publicKey,
        'X-Secret-Key: ' . $secretKey,
    ],
]);
$body = curl_exec($ch);
$http = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
$res = json_decode($body, true);

if (($res['success'] ?? '') === 'ok') {
    $p = $res['payment'];                          // status: success | pending
    if ($p['channel'] === 'dqrc') {
        $qrText = $p['qr']['text'];                // draw this as a QR code on YOUR page
    }
    // success  -> mark the order paid (after checking the signature, see "Verify the result")
    // pending  -> keep the order pending; the IPN / status API will tell you the result
} else {
    // $res['code'] and $res['message'] say what is wrong; $http is 4xx / 5xx
    // payment_failed (402): the customer declined / wrong number / no balance - create a NEW identifier to retry
}

# DQRC (Raast QR)
curl -X POST "https://zurvapay.com/api/v1/payments" \
  -H "Content-Type: application/json" \
  -H "X-Public-Key: YOUR_PUBLIC_KEY" \
  -H "X-Secret-Key: YOUR_SECRET_KEY" \
  --max-time 170 \
  -d '{
    "identifier": "ORD1790000000123",
    "amount": 500,
    "currency": "PKR",
    "channel": "dqrc",
    "details": "Order 1001",
    "customer_name": "Ali Khan",
    "customer_email": "ali@example.com",
    "ipn_url": "https://yourshop.com/zurvapay_ipn.php"
  }'

# JazzCash / EasyPaisa: same call with  "channel": "jazzcash"  (or "easypaisa")  and  "customer_phone": "03001234567"

import time, random, requests

PUBLIC_KEY = "YOUR_PUBLIC_KEY"
SECRET_KEY = "YOUR_SECRET_KEY"          # server only

payload = {
    "identifier": f"ORD{int(time.time())}{random.randint(100, 999)}",
    "amount": 500,
    "currency": "PKR",
    "channel": "dqrc",                  # jazzcash | easypaisa | dqrc
    "details": "Order 1001",
    "customer_name": "Ali Khan",
    "customer_email": "ali@example.com",
    "customer_phone": "03001234567",    # required for jazzcash / easypaisa
    "ipn_url": "https://yourshop.com/zurvapay_ipn",
}

r = requests.post(
    "https://zurvapay.com/api/v1/payments",
    json=payload,
    headers={"X-Public-Key": PUBLIC_KEY, "X-Secret-Key": SECRET_KEY},
    timeout=170,                        # wallet channels wait for the customer
)
res = r.json()

if res.get("success") == "ok":
    p = res["payment"]
    if p["channel"] == "dqrc":
        qr_text = p["qr"]["text"]       # draw it as a QR code on your page
else:
    print(r.status_code, res.get("code"), res.get("message"))

// Node.js 18+ (built-in fetch). Server only.
const PUBLIC_KEY = 'YOUR_PUBLIC_KEY';
const SECRET_KEY = 'YOUR_SECRET_KEY';

const payload = {
  identifier: 'ORD' + Date.now() + Math.floor(Math.random() * 900 + 100),
  amount: 500,
  currency: 'PKR',
  channel: 'dqrc',                 // jazzcash | easypaisa | dqrc
  details: 'Order 1001',
  customer_name: 'Ali Khan',
  customer_email: 'ali@example.com',
  customer_phone: '03001234567',   // required for jazzcash / easypaisa
  ipn_url: 'https://yourshop.com/zurvapay-ipn',
};

const r = await fetch('https://zurvapay.com/api/v1/payments', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json', 'X-Public-Key': PUBLIC_KEY, 'X-Secret-Key': SECRET_KEY },
  body: JSON.stringify(payload),
  signal: AbortSignal.timeout(170000),   // wallet channels wait for the customer
});
const res = await r.json();

if (res.success === 'ok') {
  const p = res.payment;
  if (p.channel === 'dqrc') { /* draw p.qr.text as a QR code */ }
} else {
  console.log(r.status, res.code, res.message);
}

<!-- YOUR checkout page. qrText comes from YOUR server (the "payment.qr.text" you got from ZurvaPay). -->
<div id="qr"></div>
<div id="state">Scan with any banking app (Raast QR)</div>

<script src="https://cdn.jsdelivr.net/npm/qrcodejs@1.0.0/qrcode.min.js"></script>
<script>
  // any QR library works: qrcode.js, node-qrcode, endroid/qr-code (PHP), python-qrcode ...
  new QRCode(document.getElementById('qr'), { text: qrText, width: 280, height: 280, correctLevel: QRCode.CorrectLevel.M });

  // poll YOUR server (never ZurvaPay directly - the secret key stays on your server) every 4 seconds
  const timer = setInterval(async () => {
    const r = await fetch('/check_order.php?identifier=' + encodeURIComponent(identifier));
    const s = await r.json();                       // your own endpoint, see the PHP example below
    if (s.status === 'success') { clearInterval(timer); document.getElementById('state').textContent = 'Paid. Thank you!'; }
    if (s.status === 'failed')  { clearInterval(timer); document.getElementById('state').textContent = 'QR expired. Please try again.'; }
  }, 4000);
</script>

<?php
// check_order.php - YOUR endpoint called by your page's JavaScript. It asks ZurvaPay (server to server).
$identifier = $_GET['identifier'] ?? '';
$ch = curl_init('https://zurvapay.com/api/v1/payments/' . rawurlencode($identifier));
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT        => 20,
    CURLOPT_HTTPHEADER     => ['X-Public-Key: YOUR_PUBLIC_KEY', 'X-Secret-Key: YOUR_SECRET_KEY'],
]);
$res = json_decode(curl_exec($ch), true);
curl_close($ch);

$p = $res['payment'] ?? null;
if ($p && $p['status'] === 'success') {
    // verify the signature (see "Verify the result"), compare the amount with YOUR order, then mark it paid ONCE
}
header('Content-Type: application/json');
echo json_encode(['status' => $p['status'] ?? 'unknown']);

# One payment
curl "https://zurvapay.com/api/v1/payments/ORD1790000000123" \
  -H "X-Public-Key: YOUR_PUBLIC_KEY" -H "X-Secret-Key: YOUR_SECRET_KEY"

# Up to 50 payments at once
curl -X POST "https://zurvapay.com/api/v1/payments/status" \
  -H "Content-Type: application/json" \
  -H "X-Public-Key: YOUR_PUBLIC_KEY" -H "X-Secret-Key: YOUR_SECRET_KEY" \
  -d '{"identifiers": ["ORD1790000000123", "ORD1790000000124"]}'

<?php
$ch = curl_init('https://zurvapay.com/api/v1/payments/status');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => json_encode(['identifiers' => ['ORD1790000000123', 'ORD1790000000124']]),
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT        => 30,
    CURLOPT_HTTPHEADER     => ['Content-Type: application/json', 'X-Public-Key: YOUR_PUBLIC_KEY', 'X-Secret-Key: YOUR_SECRET_KEY'],
]);
$res = json_decode(curl_exec($ch), true);
curl_close($ch);

foreach (($res['payments'] ?? []) as $p) {
    echo $p['identifier'], ' => ', $p['status'], "\n";   // success | pending | failed | not_found
}

<?php
// Works for the create response, the status API AND the IPN: all carry the same two signatures.
function zurvapay_verify(array $p, string $secretKey): bool
{
    $amount = $p['amount'];                           // use the RAW string exactly as received (e.g. "500.00000000")
    $sig    = strtoupper(hash_hmac('sha256', $amount . $p['identifier'], $secretKey));
    $stat   = strtoupper(hash_hmac('sha256', 'success|' . $p['identifier'] . '|' . $amount, $secretKey));
    return hash_equals($sig, strtoupper($p['signature'])) && hash_equals($stat, strtoupper($p['status_signature']));
}

// In the IPN (form POST) the same values arrive as: signature, status_signature, identifier, data[amount] ...
//   $p = ['amount' => $_POST['data']['amount'], 'identifier' => $_POST['identifier'],
//         'signature' => $_POST['signature'], 'status_signature' => $_POST['status_signature']];
//   if ($_POST['status'] === 'success' && zurvapay_verify($p, SECRET)) { ...complete the order ONCE... }
// Always answer the IPN with HTTP 200.

<?php
/**
 * zurvapay_cron.php — OPTIONAL. Completes orders whose customer paid but
 * the IPN never reached you (checkout error, closed browser, server down).
 * Run it every 5 minutes with a cron job (see "Schedule it" below).
 */
const PUBLIC_KEY = 'YOUR_PUBLIC_KEY';
const SECRET_KEY = 'YOUR_SECRET_KEY';
const STATUS_URL = 'https://zurvapay.com/api/v1/payments/status';

$pdo = new PDO('mysql:host=localhost;dbname=YOUR_DB;charset=utf8mb4', 'DB_USER', 'DB_PASS', [
    PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
]);

// 1) Your ZurvaPay orders still pending, created in the last 24 hours
$rows = $pdo->query("SELECT id, identifier, amount FROM orders
                     WHERE gateway = 'zurvapay' AND status = 'pending'
                       AND created_at >= NOW() - INTERVAL 24 HOUR
                     ORDER BY id DESC LIMIT 50")->fetchAll(PDO::FETCH_ASSOC);
if (!$rows) exit("Nothing to check\n");

$orders = array_column($rows, null, 'identifier');

// 2) Ask ZurvaPay (max 50 identifiers per call)
$ch = curl_init(STATUS_URL);
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => json_encode(['identifiers' => array_keys($orders)]),
    CURLOPT_HTTPHEADER => ['Content-Type: application/json', 'X-Public-Key: ' . PUBLIC_KEY, 'X-Secret-Key: ' . SECRET_KEY],
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 30,
]);
$res = json_decode(curl_exec($ch), true);
curl_close($ch);
if (($res['success'] ?? '') !== 'ok') exit('Status API error: ' . ($res['message'] ?? 'no response') . "\n");

// 3) Complete the paid ones — same checks as your IPN handler
foreach ($res['payments'] as $p) {
    if ($p['status'] !== 'success') continue;

    $expected = strtoupper(hash_hmac('sha256', $p['status'] . '|' . $p['identifier'] . '|' . $p['amount'], SECRET_KEY));
    if (!hash_equals($expected, strtoupper($p['status_signature']))) continue;

    $order = $orders[$p['identifier']] ?? null;
    if (!$order || (float) $p['amount'] < (float) $order['amount']) continue;

    // Update only if STILL pending -> never double-credits (IPN may arrive at the same time)
    $pdo->beginTransaction();
    $upd = $pdo->prepare("UPDATE orders SET status = 'paid', payment_trx = ? WHERE id = ? AND status = 'pending'");
    $upd->execute([$p['payment_trx'] ?? '', $order['id']]);
    if ($upd->rowCount() === 1) {
        deliver_order($pdo, $order['id']);   // your function: add balance / ship / activate ...
    }
    $pdo->commit();
    echo "Paid: {$p['identifier']}\n";
}

#!/usr/bin/env python3
# zurvapay_cron.py — OPTIONAL. Run every 5 minutes:
#   */5 * * * * /usr/bin/python3 /home/USER/zurvapay_cron.py
import hmac, hashlib, requests, pymysql

PUBLIC_KEY, SECRET_KEY = "YOUR_PUBLIC_KEY", "YOUR_SECRET_KEY"
STATUS_URL = "https://zurvapay.com/api/v1/payments/status"

def sign(msg):
    return hmac.new(SECRET_KEY.encode(), msg.encode(), hashlib.sha256).hexdigest().upper()

db = pymysql.connect(host="localhost", user="DB_USER", password="DB_PASS", database="YOUR_DB", autocommit=False)
cur = db.cursor(pymysql.cursors.DictCursor)
cur.execute("""SELECT id, identifier, amount FROM orders
               WHERE gateway='zurvapay' AND status='pending'
                 AND created_at >= NOW() - INTERVAL 24 HOUR
               ORDER BY id DESC LIMIT 50""")
orders = {o["identifier"]: o for o in cur.fetchall()}
if not orders:
    raise SystemExit("Nothing to check")

res = requests.post(STATUS_URL, json={"identifiers": list(orders.keys())},
                    headers={"X-Public-Key": PUBLIC_KEY, "X-Secret-Key": SECRET_KEY}, timeout=30).json()
if res.get("success") != "ok":
    raise SystemExit(f"Status API error: {res.get('message')}")

for p in res["payments"]:
    if p["status"] != "success":
        continue
    if not hmac.compare_digest(sign(f"{p['status']}|{p['identifier']}|{p['amount']}"), p["status_signature"].upper()):
        continue
    order = orders.get(p["identifier"])
    if not order or float(p["amount"]) < float(order["amount"]):
        continue
    # only if still pending -> no double credit
    changed = cur.execute("UPDATE orders SET status='paid', payment_trx=%s WHERE id=%s AND status='pending'",
                          (p.get("payment_trx", ""), order["id"]))
    if changed == 1:
        deliver_order(cur, order["id"])          # your function
    db.commit()
    print("Paid:", p["identifier"])

// zurvapay_cron.js — OPTIONAL. Run every 5 minutes:
//   */5 * * * * /usr/bin/node /home/USER/zurvapay_cron.js
const crypto = require('crypto');
const mysql = require('mysql2/promise');

const PUBLIC_KEY = 'YOUR_PUBLIC_KEY', SECRET_KEY = 'YOUR_SECRET_KEY';
const STATUS_URL = 'https://zurvapay.com/api/v1/payments/status';
const sign = (m) => crypto.createHmac('sha256', SECRET_KEY).update(m).digest('hex').toUpperCase();

(async () => {
  const db = await mysql.createConnection({ host: 'localhost', user: 'DB_USER', password: 'DB_PASS', database: 'YOUR_DB' });
  const [rows] = await db.query(`SELECT id, identifier, amount FROM orders
                                 WHERE gateway='zurvapay' AND status='pending'
                                   AND created_at >= NOW() - INTERVAL 24 HOUR
                                 ORDER BY id DESC LIMIT 50`);
  if (!rows.length) return db.end();
  const orders = Object.fromEntries(rows.map(o => [o.identifier, o]));

  const res = await (await fetch(STATUS_URL, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json', 'X-Public-Key': PUBLIC_KEY, 'X-Secret-Key': SECRET_KEY },
    body: JSON.stringify({ identifiers: Object.keys(orders) }),
  })).json();
  if (res.success !== 'ok') { console.error('Status API error:', res.message); return db.end(); }

  for (const p of res.payments) {
    if (p.status !== 'success') continue;
    if (sign(`${p.status}|${p.identifier}|${p.amount}`) !== String(p.status_signature).toUpperCase()) continue;
    const order = orders[p.identifier];
    if (!order || Number(p.amount) < Number(order.amount)) continue;

    // only if still pending -> no double credit
    const [r] = await db.execute("UPDATE orders SET status='paid', payment_trx=? WHERE id=? AND status='pending'",
                                 [p.payment_trx || '', order.id]);
    if (r.affectedRows === 1) await deliverOrder(db, order.id);   // your function
    console.log('Paid:', p.identifier);
  }
  await db.end();
})();