YayaPay API Documentation

{
  "status": true,       // true = success, false = failed
  "msg": "Order Created Successfully",
  "data": {
    "orderId": "1234561705047510",
    "payment_url": "https://yayapay.shop/pay/..."  // redirect customer here
  }
}

{
  "status": false,
  "msg": "Missing required fields"  // read msg to find out why
}

{
  "user_token":      "your_user_token_here",
  "payout_order_id": "PAYOUT_20260302_120000",
  "amount":          500,
  "withdraw_type":   "upi",
  "upi_id":          "merchant@paytm",
  "redirect_url":    "https://yoursite.com/payout-callback",
  "remark1":         "Vendor Payment",
  "remark2":         "March Invoice"
}

{
  "user_token":      "your_user_token_here",
  "payout_order_id": "PAYOUT_20260302_120001",
  "amount":          1000,
  "withdraw_type":   "bank",
  "account_holder":  "Rahul Sharma",
  "account_number":  "123456789012",
  "ifsc_code":       "HDFC0001234",
  "bank_name":       "HDFC Bank",
  "branch_name":     "Kolkata Main Branch",
  "redirect_url":    "https://yoursite.com/payout-callback"
}

{
  "user_token":      "your_user_token_here",
  "payout_order_id": "PAYOUT_USDT_20260302_120002",
  "amount":          1180,             // INR amount — must be ≥ ₹118
  "withdraw_type":   "usdt",
  "trc20_address":   "TQn9Y2khEsLJW1ChVWFMSMeRDow5KcbLSE",  // 34-char TRC20 address
  "redirect_url":    "https://yoursite.com/payout-callback",
  "remark1":         "Crypto Withdrawal"
}

{
  "status":  true,
  "message": "Payout request created successfully",
  "result":  {
    "payout_id":               12,
    "payout_order_id":         "PAYOUT_20260302_120000",
    "withdraw_type":           "upi",
    "amount":                  500,
    "fee":                     21,
    "total_deducted":          521,
    "status":                  "PENDING",
    "available_balance_after": 4479,
    "request_date":           "2026-03-02 12:00:00"
  }
}

{
  "status":  true,
  "message": "Payout request created successfully",
  "result":  {
    "payout_id":               13,
    "payout_order_id":         "PAYOUT_USDT_20260302_120002",
    "withdraw_type":           "usdt",
    "amount":                  1180,           // INR amount requested
    "fee":                     41.4,           // 3% (₹35.40) + ₹6
    "total_deducted":          1221.4,         // deducted from INR balance
    "status":                  "PENDING",
    "available_balance_after": 3778.6,
    "trc20_address":           "TQn9Y2khEsLJW1ChVWFMSMeRDow5KcbLSE",
    "usdt_amount":             10.000000,      // USDT sent to wallet (1180 ÷ 118)
    "usdt_rate":               118,            // fixed rate used
    "usdt_rate_note":          "1 USDT = ₹118 (fixed rate)",
    "request_date":           "2026-03-02 12:00:00"
  }
}

{
  "status":  false,
  "message": "Insufficient balance",
  "details": {
    "available_balance": 300.00,
    "requested_amount":  500.00,
    "fee":               21.00,
    "total_deducted":    521.00,
    // For USDT requests, these extra fields are also returned:
    "usdt_equivalent":   4.237288,   // USDT that would have been sent
    "usdt_rate":         118
  }
}

$params = http_build_query([
    'user_token'      => 'YOUR_USER_TOKEN',
    'customer_mobile' => '9876543210',
    'amount'          => '500',
    'order_id'        => 'ORD-' . time(),
    'redirect_url'    => 'https://yoursite.com/payment-return',
    'remark1'         => 'Wallet Deposit',
]);

$ch = curl_init('https://yayapay.shop/api/create-order');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => $params,
    CURLOPT_HTTPHEADER     => ['Content-Type: application/x-www-form-urlencoded'],
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT        => 15,
    CURLOPT_SSL_VERIFYPEER => true,
]);
$response = json_decode(curl_exec($ch), true);
curl_close($ch);

if ($response['status'] === true) {
    header('Location: ' . $response['data']['payment_url']);
    exit;
} else {
    echo 'Pay-In Error: ' . $response['msg'];
}

$payload = [
    'user_token'      => 'YOUR_USER_TOKEN',
    'payout_order_id' => 'PAYOUT-' . time(),
    'amount'          => 500,
    'withdraw_type'   => 'upi',
    'upi_id'          => 'user@paytm',
    'redirect_url'    => 'https://yoursite.com/payout-callback',
    'remark1'         => 'Withdrawal',
];

$ch = curl_init('https://yayapay.shop/api/create_payout');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => json_encode($payload),
    CURLOPT_HTTPHEADER     => ['Content-Type: application/json'],
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT        => 15,
    CURLOPT_SSL_VERIFYPEER => true,
]);
$response = json_decode(curl_exec($ch), true);
curl_close($ch);

if ($response['status'] === true) {
    $result = $response['result'];
    echo 'Payout queued. ID: ' . $result['payout_id'];
    echo ' | Balance after: ₹' . $result['available_balance_after'];
} else {
    echo 'Payout Error: ' . $response['message'];
}

$payload = [
    'user_token'      => 'YOUR_USER_TOKEN',
    'payout_order_id' => 'PAYOUT-BANK-' . time(),
    'amount'          => 1000,
    'withdraw_type'   => 'bank',
    'account_holder'  => 'Rahul Sharma',
    'account_number'  => '123456789012',
    'ifsc_code'       => 'HDFC0001234',
    'bank_name'       => 'HDFC Bank',
    'branch_name'     => 'Mumbai Main Branch',
    'redirect_url'    => 'https://yoursite.com/payout-callback',
];

$ch = curl_init('https://yayapay.shop/api/create_payout');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => json_encode($payload),
    CURLOPT_HTTPHEADER     => ['Content-Type: application/json'],
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT        => 15,
    CURLOPT_SSL_VERIFYPEER => true,
]);
$response = json_decode(curl_exec($ch), true);
curl_close($ch);

if ($response['status'] === true) {
    echo 'Payout queued. ID: ' . $response['result']['payout_id'];
} else {
    echo 'Error: ' . $response['message'];
}

// Fixed rate: 1 USDT = ₹118
$inr_amount     = 1180;   // INR to withdraw (must be ≥ ₹118)
$trc20_address  = 'TQn9Y2khEsLJW1ChVWFMSMeRDow5KcbLSE';

// Validate TRC20 address before sending
if (!preg_match('/^T[1-9A-HJ-NP-Za-km-z]{33}$/', $trc20_address)) {
    die('Invalid TRC20 address');
}

$payload = [
    'user_token'      => 'YOUR_USER_TOKEN',
    'payout_order_id' => 'PAYOUT-USDT-' . time(),
    'amount'          => $inr_amount,
    'withdraw_type'   => 'usdt',
    'trc20_address'   => $trc20_address,
    'redirect_url'    => 'https://yoursite.com/payout-callback',
    'remark1'         => 'Crypto Withdrawal',
];

$ch = curl_init('https://yayapay.shop/api/create_payout');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => json_encode($payload),
    CURLOPT_HTTPHEADER     => ['Content-Type: application/json'],
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT        => 15,
    CURLOPT_SSL_VERIFYPEER => true,
]);
$response = json_decode(curl_exec($ch), true);
curl_close($ch);

if ($response['status'] === true) {
    $r = $response['result'];
    echo 'Payout queued. ID: '     . $r['payout_id'] . "\n";
    echo 'USDT to be sent: '       . $r['usdt_amount'] . ' USDT' . "\n";
    echo 'Wallet: '                . $r['trc20_address'] . "\n";
    echo 'INR deducted: ₹'         . $r['total_deducted'] . "\n";
    echo 'Balance remaining: ₹'    . $r['available_balance_after'];
} else {
    echo 'USDT Payout Error: ' . $response['message'];
}

ALTER TABLE recharge
  ADD COLUMN callback_url VARCHAR(500) DEFAULT NULL AFTER status;

-- Optional: idempotency table to prevent double-processing on gateway retries
CREATE TABLE processed_callbacks (
  id         INT AUTO_INCREMENT PRIMARY KEY,
  order_id   VARCHAR(100) NOT NULL UNIQUE,
  created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

$callbackUrl = 'https://yoursite.com/payment-callback';

$stmt = $conn->prepare(
    "INSERT INTO recharge (orderid, balance, userid, status, callback_url)
     VALUES (?, ?, ?, '0', ?)"
);
$stmt->bind_param('sdss', $orderId, $amount, $userId, $callbackUrl);
$stmt->execute();

// ── Config ──────────────────────────────────────────────────
define('DB_HOST',         'localhost');
define('DB_USERNAME',     'username');
define('DB_PASSWORD',     'password');
define('DB_NAME',         'dbname');
define('CALLBACK_SECRET', 'YOUR_SECRET_KEY_HERE'); // change this

// ── Connection ───────────────────────────────────────────────
$conn = new mysqli(DB_HOST, DB_USERNAME, DB_PASSWORD, DB_NAME);
if ($conn->connect_error) { die("Connection failed: " . $conn->connect_error); }
$conn->set_charset("utf8");

// ── Callback dispatcher ──────────────────────────────────────
// Sends a signed POST to callback_url stored on the order row.
// Failure is logged — never rolls back the DB transaction.
function sendCallback(
    string $url, string $orderId, string $status,
    float  $amount, string $userId, string $remark1
): bool {
    if (empty($url)) {
        writeLog("Callback skipped: no callback_url for order $orderId");
        return false;
    }
    $ts  = time();
    $sig = hash_hmac('sha256', $orderId . $status . $amount . $ts, CALLBACK_SECRET);
    $payload = json_encode([
        'order_id'  => $orderId,
        'status'    => $status,   // "SUCCESS" or "FAILED"
        'amount'    => $amount,
        'user_id'   => $userId,
        'remark1'   => $remark1,
        'timestamp' => $ts,
        'signature' => $sig,
    ]);
    $ch = curl_init($url);
    curl_setopt_array($ch, [
        CURLOPT_POST           => true,
        CURLOPT_POSTFIELDS     => $payload,
        CURLOPT_HTTPHEADER     => [
            'Content-Type: application/json',
            'X-Webhook-Signature: ' . $sig,
        ],
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT        => 10,
        CURLOPT_SSL_VERIFYPEER => true,
        CURLOPT_FOLLOWLOCATION => false,
    ]);
    $res  = curl_exec($ch);
    $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    $err  = curl_error($ch);
    curl_close($ch);
    if ($err) { writeLog("Callback cURL error [$orderId]: $err"); return false; }
    writeLog("Callback [$orderId] → $url | HTTP $code | " . substr($res, 0, 200));
    return ($code >= 200 && $code < 300);
}

// ── Log raw incoming data ────────────────────────────────────
writeLog("Received: " . print_r($_GET, true) . print_r($_POST, true));

// ── Collect parameters (GET or POST) ────────────────────────
$order_id = trim($_GET['order_id'] ?? $_POST['order_id'] ?? '');
$status   = trim($_GET['status']   ?? $_POST['status']   ?? '');
$remark1  = trim($_GET['remark1']  ?? $_POST['remark1']  ?? '');

if (empty($order_id) || empty($status)) {
    writeLog("Error: Missing parameters");
    echo json_encode(['status' => false, 'message' => 'Missing parameters']);
    exit;
}

if (!$checkamt) {
    writeLog("DB Error: " . $conn->error);
    echo json_encode(['status' => false, 'message' => 'Database error']);
    exit;
}
else {
    writeLog("Notice: Order $order_id not found / already done / status=$status");
    echo "ok1";
}
$conn->close();
exit;

{
  "order_id":  "ORD-1234567890",
  "status":    "SUCCESS",         // "SUCCESS" or "FAILED"
  "amount":    500.00,
  "user_id":   "USR-001",
  "remark1":   "Wallet Deposit",
  "timestamp": 1743479400,        // Unix epoch
  "signature": "a3f9c1d2e4b7..."  // HMAC-SHA256 — verify this
}

$body   = file_get_contents('php://input');
$data   = json_decode($body, true);
$secret = 'YOUR_SECRET_KEY_HERE';   // same as CALLBACK_SECRET in webhook.php

// 1. Replay-attack protection: reject if older than 5 minutes
if (abs(time() - ($data['timestamp'] ?? 0)) > 300) {
    http_response_code(400);
    exit('Expired timestamp');
}

// 2. Verify HMAC signature
$raw      = $data['order_id'] . $data['status'] . $data['amount'] . $data['timestamp'];
$expected = hash_hmac('sha256', $raw, $secret);
if (!hash_equals($expected, $data['signature'] ?? '')) {
    http_response_code(401);
    exit('Invalid signature');
}

// 3. Idempotency — prevent double-processing on gateway retries
$stmt = $conn->prepare("SELECT id FROM processed_callbacks WHERE order_id = ?");
$stmt->bind_param('s', $data['order_id']);
$stmt->execute();
if ($stmt->get_result()->num_rows > 0) {
    http_response_code(200);
    exit('Already processed');
}

// 4. Handle the payment result
if ($data['status'] === 'SUCCESS') {
    // ✅ send push notification, update UI, award bonus, etc.
}

// 5. Mark as processed (idempotency record)
$stmt = $conn->prepare("INSERT INTO processed_callbacks (order_id) VALUES (?)");
$stmt->bind_param('s', $data['order_id']);
$stmt->execute();

http_response_code(200);
echo 'ok';

{
  "event":                   "payout.approved",
  "status":                  "APPROVED",
  "payout_id":               5,
  "payout_order_id":         "PAYOUT_20260302_120000",
  "user_token":              "your_user_token_here",
  "withdraw_type":           "upi",
  "amount":                  500,
  "fee":                     21,
  "total_deducted":          521,
  "available_balance_after": 4479,
  "request_date":           "2026-03-02 12:00:00",
  "response_date":          "2026-03-02 12:05:00",
  "admin_remarks":          "Processed",
  "remark1":                 "Vendor Payment",
  "remark2":                 "March Invoice",
  "upi_id":                  "merchant@paytm",
  "message":                 "Your payout of ₹500.00 has been approved and processed successfully."
}

{
  "event":          "payout.rejected",
  "status":         "REJECTED",
  "payout_id":      6,
  "payout_order_id":"PAYOUT_20260302_130000",
  "withdraw_type":  "bank",
  "amount":         1000,
  "fee":            36,
  "total_deducted": 1036,
  "admin_remarks":  "Invalid account number",  // always check this on REJECTED
  "message":        "Your payout of ₹1000.00 has been rejected. Reason: Invalid account number"
}

{
  "event":                   "payout.approved",
  "status":                  "APPROVED",
  "payout_id":               13,
  "payout_order_id":         "PAYOUT_USDT_20260302_120002",
  "withdraw_type":           "usdt",
  "amount":                  1180,
  "fee":                     41.4,
  "total_deducted":          1221.4,
  "available_balance_after": 8778.6,
  "request_date":           "2026-03-02 12:00:00",
  "response_date":          "2026-03-02 12:08:00",
  "remark1":                 "Crypto Withdrawal",
  "trc20_address":          "TQn9Y2khEsLJW1ChVWFMSMeRDow5KcbLSE",
  "usdt_amount":            10.000000,
  "usdt_rate":              118,
  "usdt_rate_note":         "1 USDT = ₹118",
  "message":                "Your payout of ₹1180.00 (≈ 10.000000 USDT TRC20) has been approved and processed successfully."
}

curl -X GET "https://yayapay.shop/api/payout_callback.php?user_token=your_user_token_here&payout_order_id=PAYOUT_20260302_120000"

curl -X GET "https://yayapay.shop/api/payout_callback.php?user_token=your_user_token_here&payout_id=5"

{
  "status":          true,
  "payout_id":       5,
  "payout_order_id": "PAYOUT_20260302_120000",
  "payout_status":   "APPROVED",      // PENDING | APPROVED | REJECTED
  "withdraw_type":   "upi",
  "amount":          500,
  "fee":             21,
  "total_deducted":  521,
  "request_date":   "2026-03-02 12:00:00",
  "response_date":  "2026-03-02 12:05:00",
  "admin_remarks":  "Processed",
  "remark1":        "Vendor Payment",
  "remark2":        "March Invoice",
  "upi_id":         "merchant@paytm",
  "message":        "Your payout of ₹500.00 has been approved and processed successfully."
}

<?php
// ── Read raw JSON body ───────────────────────────────────────
$raw   = file_get_contents('php://input');
$data  = json_decode($raw, true);

if (empty($data)) {
    http_response_code(400);
    exit('Invalid payload');
}

// ── Extract key fields ───────────────────────────────────────
$event           = $data['event']           ?? '';   // payout.approved | payout.rejected
$payout_status   = $data['status']          ?? '';   // APPROVED | REJECTED
$payout_id       = $data['payout_id']      ?? 0;
$payout_order_id = $data['payout_order_id'] ?? '';
$withdraw_type   = $data['withdraw_type']  ?? '';
$amount          = floatval($data['amount']  ?? 0);
$admin_remarks   = $data['admin_remarks']  ?? '';
$user_token      = $data['user_token']     ?? '';

// ── Basic validation ─────────────────────────────────────────
if (empty($payout_order_id) || empty($payout_status)) {
    http_response_code(400);
    exit('Missing required fields');
}

// ── Handle USDT-specific fields ──────────────────────────────
if ($withdraw_type === 'usdt') {
    $trc20_address = $data['trc20_address'] ?? '';
    $usdt_amount   = floatval($data['usdt_amount']   ?? 0);
    $usdt_rate     = floatval($data['usdt_rate']     ?? 118);
}

// ── Act on status ────────────────────────────────────────────
switch ($payout_status) {

    case 'APPROVED':
        // Mark payout as complete in your DB
        // Notify user, update UI, trigger next workflow step
        error_log("Payout APPROVED: $payout_order_id | ₹$amount | Type: $withdraw_type");
        break;

    case 'REJECTED':
        // Notify user with rejection reason from $admin_remarks
        // Optionally restore user balance in your app
        error_log("Payout REJECTED: $payout_order_id | Reason: $admin_remarks");
        break;

    default:
        error_log("Unknown payout status: $payout_status");
        break;
}

// ── Always respond HTTP 200 within 10 seconds ────────────────
http_response_code(200);
echo 'ok';

$user_token      = 'your_user_token_here';
$payout_order_id = 'PAYOUT_20260302_120000';  // or use payout_id=5

$url = 'https://yayapay.shop/api/payout_callback.php?'
     . http_build_query([
         'user_token'      => $user_token,
         'payout_order_id' => $payout_order_id,
     ]);

$ch = curl_init($url);
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT        => 10,
    CURLOPT_SSL_VERIFYPEER => true,
]);
$response = json_decode(curl_exec($ch), true);
curl_close($ch);

if ($response['status'] === true) {
    $payout_status = $response['payout_status'];  // PENDING | APPROVED | REJECTED
    $withdraw_type = $response['withdraw_type'];

    echo "Status: $payout_status\n";
    echo "Type:   $withdraw_type\n";
    echo "Amount: ₹" . $response['amount'] . "\n";

    if ($withdraw_type === 'usdt') {
        echo "USDT: " . $response['usdt_amount'] . " to " . $response['trc20_address'] . "\n";
    }
} else {
    echo 'Error: ' . $response['message'];
}

-- ── Processed callbacks (idempotency) ─────────────────────────
CREATE TABLE IF NOT EXISTS processed_callbacks (
    id         INT AUTO_INCREMENT PRIMARY KEY,
    order_id   VARCHAR(100) NOT NULL UNIQUE,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

-- ── Sample users ──────────────────────────────────────────────
INSERT INTO balance (userid, username, balance) VALUES
    ('USR001', 'Rahul Sharma',   1500.00),
    ('USR002', 'Priya Singh',    800.50),
    ('USR003', 'Amit Verma',     0.00);

-- ── Sample pending deposit orders ─────────────────────────────
INSERT INTO recharge (orderid, balance, userid, status, callback_url) VALUES
    ('ORD-20260401-001', 500.00,  'USR001', 0, 'https://yoursite.com/payment-callback'),
    ('ORD-20260401-002', 1000.00, 'USR002', 0, 'https://yoursite.com/payment-callback'),
    ('ORD-20260401-003', 250.00,  'USR003', 0, 'https://yoursite.com/payment-callback'),
    ('ORD-20260401-004', 750.00,  'USR001', 1, 'https://yoursite.com/payment-callback'); -- already processed

<?php
// ── DB config ────────────────────────────────────────────────
$conn = new mysqli('localhost', 'dbdetails', 'dbdetails', 'dbdetails');
$conn->set_charset('utf8');

// ── Order details (in real use, get these from session/POST) ──
$userId      = 'USR001';
$amount      = 500;                     // INR
$orderId     = 'ORD-' . date('Ymd') . '-' . time();
$callbackUrl = 'https://yoursite.com/payment-callback';
$redirectUrl = 'https://yoursite.com/payment-return?order_id=' . $orderId;
$mobile      = '9876543210';

// ── Save order to DB BEFORE calling gateway ───────────────────
$stmt = $conn->prepare(
    "INSERT INTO recharge (orderid, balance, userid, status, callback_url)
     VALUES (?, ?, ?, '0', ?)"
);
$stmt->bind_param('sdss', $orderId, $amount, $userId, $callbackUrl);
$stmt->execute();

// ── Call YayaPay API ─────────────────────────────────────────
$params = http_build_query([
    'user_token'      => 'YOUR_USERTOKEN_HERE',
    'customer_mobile'  => $mobile,
    'amount'           => $amount,
    'order_id'         => $orderId,
    'redirect_url'     => $redirectUrl,
    'remark1'          => 'Wallet Deposit',
]);
$ch = curl_init('https://yayapay.shop/api/create-order');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => $params,
    CURLOPT_HTTPHEADER     => ['Content-Type: application/x-www-form-urlencoded'],
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT        => 15,
    CURLOPT_SSL_VERIFYPEER => true,
]);
$response = json_decode(curl_exec($ch), true);
curl_close($ch);

// ── Redirect user to payment page ────────────────────────────
if ($response['status'] === true) {
    header('Location: ' . $response['data']['payment_url']);
    exit;
} else {
    echo 'Order Error: ' . $response['msg'];
}

<?php
define('DB_HOST',         'localhost');
define('DB_USERNAME',     'dbdetails');
define('DB_PASSWORD',     'dbdetails');
define('DB_NAME',         'dbdetails');
define('CALLBACK_SECRET', 'ch@ng3_th1s_s3cr3t');  // must match payment-callback.php

$conn = new mysqli(DB_HOST, DB_USERNAME, DB_PASSWORD, DB_NAME);
if ($conn->connect_error) { die("DB Error: " . $conn->connect_error); }
$conn->set_charset('utf8');

function writeLog(string $msg): void {
    $dir = __DIR__ . '/logs';
    if (!file_exists($dir)) mkdir($dir, 0755, true);
    file_put_contents(
        $dir . '/log_' . date('Y-m-d') . '.txt',
        '[' . date('Y-m-d H:i:s') . '] ' . $msg . "
",
        FILE_APPEND | LOCK_EX
    );
}

function sendCallback(string $url, string $orderId, string $status,
                        float $amount, string $userId, string $remark1): bool {
    if (empty($url)) { writeLog("No callback_url for $orderId"); return false; }
    $ts      = time();
    $sig     = hash_hmac('sha256', $orderId.$status.$amount.$ts, CALLBACK_SECRET);
    $payload = json_encode([
        'order_id'  => $orderId,  'status'    => $status,
        'amount'    => $amount,   'user_id'   => $userId,
        'remark1'   => $remark1,  'timestamp' => $ts,
        'signature' => $sig,
    ]);
    $ch = curl_init($url);
    curl_setopt_array($ch, [
        CURLOPT_POST           => true,
        CURLOPT_POSTFIELDS     => $payload,
        CURLOPT_HTTPHEADER     => ['Content-Type: application/json', 'X-Webhook-Signature: '.$sig],
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT        => 10,
        CURLOPT_SSL_VERIFYPEER => true,
    ]);
    $res  = curl_exec($ch);
    $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    $err  = curl_error($ch);
    curl_close($ch);
    if ($err) { writeLog("Callback cURL error [$orderId]: $err"); return false; }
    writeLog("Callback [$orderId] HTTP $code: " . substr($res, 0, 100));
    return ($code >= 200 && $code < 300);
}

// ── Log raw input ────────────────────────────────────────────
writeLog("IN: " . json_encode(['GET' => $_GET, 'POST' => $_POST]));

$order_id = trim($_GET['order_id'] ?? $_POST['order_id'] ?? '');
$status   = trim($_GET['status']   ?? $_POST['status']   ?? '');
$remark1  = trim($_GET['remark1']  ?? $_POST['remark1']  ?? '');

if (empty($order_id) || empty($status)) {
    writeLog("Missing params");
    echo json_encode(['status' => false, 'message' => 'Missing parameters']);
    exit;
}

 else {
    writeLog("SKIP: $order_id status=$status");
    echo "ok1";
}
$conn->close();
exit;

<?php
$conn   = new mysqli('localhost', 'dbdetails', 'dbdetails', 'dbdetails');
$secret = 'ch@ng3_th1s_s3cr3t';   // must match CALLBACK_SECRET in webhook.php

$body = file_get_contents('php://input');
$data = json_decode($body, true);

if (!$data || !isset($data['order_id'], $data['signature'], $data['timestamp'])) {
    http_response_code(400); exit('Bad request');
}

// 1. Replay-attack check — reject if older than 5 minutes
if (abs(time() - (int)$data['timestamp']) > 300) {
    http_response_code(400); exit('Expired');
}

// 2. HMAC signature verification
$expected = hash_hmac(
    'sha256',
    $data['order_id'] . $data['status'] . $data['amount'] . $data['timestamp'],
    $secret
);
if (!hash_equals($expected, $data['signature'])) {
    http_response_code(401); exit('Invalid signature');
}

// 3. Idempotency — skip if already processed
$stmt = $conn->prepare("SELECT id FROM processed_callbacks WHERE order_id=?");
$stmt->bind_param('s', $data['order_id']);
$stmt->execute();
if ($stmt->get_result()->num_rows > 0) {
    http_response_code(200); exit('ok');
}

// 4. ✅ Handle result — add your app logic here
if ($data['status'] === 'SUCCESS') {
    /*
     * Example actions you can trigger here:
     *   - Send push notification to the user's mobile app
     *   - Update a "pending" UI state to "confirmed"
     *   - Award a first-deposit bonus
     *   - Log the transaction in your own audit table
     *   - Fire a socket event (Pusher, Soketi, etc.)
     */
    error_log("Deposit confirmed: Order {$data['order_id']} | ₹{$data['amount']} → User {$data['user_id']}");
}

// 5. Record as processed
$stmt = $conn->prepare("INSERT INTO processed_callbacks (order_id) VALUES (?)");
$stmt->bind_param('s', $data['order_id']);
$stmt->execute();

http_response_code(200);
echo 'ok';

# Test SUCCESS — credits ₹500 to USR001
curl -X POST "https://yoursite.com/webhook.php"   -d "order_id=ORD-20260401-001&status=SUCCESS&remark1=TestDeposit"

# Expected response: ok2
# USR001 balance: 1500.00 → 2000.00
# callback_url receives signed JSON POST automatically

# Test already-processed order (idempotency check)
curl -X POST "https://yoursite.com/webhook.php"   -d "order_id=ORD-20260401-001&status=SUCCESS"
# Expected response: ok1 (sthiti already = 1)

# Test FAILED status
curl -X POST "https://yoursite.com/webhook.php"   -d "order_id=ORD-20260401-002&status=FAILED"
# Expected response: ok1 (status != SUCCESS, no balance change)

your-project/
├── schema.sql              ← Run once: creates tables + seeds sample data
├── create-order.php        ← Step 1: user clicks "Add Funds" → creates order → redirects
├── webhook.php             ← Step 2: gateway POSTs here after payment
├── payment-callback.php    ← Step 3: your app receives signed callback
└── logs/
    └── log_YYYY-MM-DD.txt  ← Auto-created by writeLog()