Developer Quickstart: Integrate OwnPay in 5 Minutes

composer require ownpay/php-sdk

npm install ownpay

<?php

use OwnPay\SDK\Client;

$client = new Client(
    publicKey: $_ENV['OWNPAY_PUBLIC_KEY'],
    secretKey: $_ENV['OWNPAY_SECRET_KEY'],
    baseUrl:   $_ENV['OWNPAY_BASE_URL'] . '/api/v1'
);

import OwnPay from 'ownpay';

const ownpay = new OwnPay({
  publicKey: process.env.OWNPAY_PUBLIC_KEY,
  secretKey: process.env.OWNPAY_SECRET_KEY,
  baseUrl:   process.env.OWNPAY_BASE_URL,
});

$payment = $client->payments()->create([
    'amount'         => 5000,              // amount in minor units (e.g. 5000 = $50.00)
    'currency'       => 'USD',
    'customer_email' => 'customer@example.com',
    'description'    => 'Order #123',
    'redirect_url'   => 'https://your-store.com/payment/callback',
    'cancel_url'     => 'https://your-store.com/payment/cancel',
]);

// Redirect the customer to complete payment
header('Location: ' . $payment['data']['checkout_url'], true, 302);
exit;

const payment = await ownpay.payments.create({
  amount:         5000,   // in minor units
  currency:       'USD',
  customer_email: 'customer@example.com',
  description:    'Order #123',
  redirect_url:   `${process.env.APP_URL}/payment/callback`,
  cancel_url:     `${process.env.APP_URL}/payment/cancel`,
});

// Redirect the customer
res.redirect(payment.data.checkout_url);

curl -X POST https://pay.your-domain.com/api/v1/payments \
  -H "Authorization: Bearer op_live_xxx..." \
  -H "Content-Type: application/json" \
  -d '{
    "amount": "5000",
    "currency": "USD",
    "customer_email": "customer@example.com",
    "description": "Order #123",
    "redirect_url": "https://your-store.com/payment/callback",
    "cancel_url": "https://your-store.com/payment/cancel"
  }'

<?php

declare(strict_types=1);

$payload   = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_OWNPAY_SIGNATURE'] ?? '';
$timestamp = $_SERVER['HTTP_X_OWNPAY_TIMESTAMP']  ?? '';
$secret    = getenv('OWNPAY_WEBHOOK_SECRET');

// Replay protection: reject events older than 5 minutes
if (abs(time() - (int) $timestamp) > 300) {
    http_response_code(400);
    exit('Timestamp too old');
}

$expected = 'sha256=' . hash_hmac('sha256', $timestamp . '.' . $payload, $secret);

if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    exit('Unauthorized');
}

$event = json_decode($payload, true, 512, JSON_THROW_ON_ERROR);

match ($event['event']) {
    'payment.paid'     => handlePaymentPaid($event['data']),
    'payment.failed'   => handlePaymentFailed($event['data']),
    'payment.refunded' => handlePaymentRefunded($event['data']),
    default            => null,
};

http_response_code(200);
echo 'OK';

import crypto from 'node:crypto';

// Use express.raw() to preserve the raw body for signature verification
app.post('/webhooks/ownpay', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-ownpay-signature'];
  const timestamp = req.headers['x-ownpay-timestamp'];
  const secret    = process.env.OWNPAY_WEBHOOK_SECRET;

  // Replay protection: reject events older than 5 minutes
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) {
    return res.status(400).send('Timestamp too old');
  }

  const hmac     = crypto.createHmac('sha256', secret)
    .update(`${timestamp}.${req.body.toString()}`)
    .digest('hex');
  const expected = `sha256=${hmac}`;

  if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature))) {
    return res.status(401).send('Unauthorized');
  }

  const event = JSON.parse(req.body.toString());

  switch (event.event) {
    case 'payment.paid':
      handlePaymentPaid(event.data);
      break;
    case 'payment.failed':
      handlePaymentFailed(event.data);
      break;
  }

  res.status(200).send('OK');
});