Callback

General information

It is possible to view all the callbacks Paysera sent to your system and response your system provided.

bank.paysera.com -> Projects and Activities -> Received payments -> Info sign near the specific payment.

Here you can see the url that was used for a callback and your system response. You can use this url to trigger callback manually.

Always check payment status - only status 1 means successful payment.

Check whether the payment is not made for testing purposes (by status parameter), whether the service for this payment has not yet been provided (by orderid parameter), whether the amount and currency match the ones saved in the order.

Callback structure

Paysera sends the answer to your specified callbackurl. 3 additional GET parameters are added to the callbackurl:

• data - Encoded parameters from Paysera system. Same data coding algorithm is used as in generating a request for macro payments. To parse the parameters, 3 actions must be performed:
  1. Change the symbols "-" to "+", "_" to "/"
  2. Decode the string, using base64 encoding
  3. Retrieve the array of parameters from the decoded string, which is an URL-encoded parameter string
  Example in PHP language:

  $params = [];
  parse_str(base64_decode(strtr($_GET['data'], ['-' => '+', '_' => '/'])), $params);
  //use $params
  

• ss1 - Sign of data parameter, without using private-public key scheme. Sign algorithm:

  ss1 = md5(data + password)

• ss2 - Sign of data parameter, using RSA private-public key scheme with SHA-1 hashing function. Public Paysera key, which should be used to verify the signature, can be found at https://www.paysera.com/download/public.key

When you get the callback, you must check at least one signature before confirming the order. If there is a possibility, always (also) check the higher security ss2 signature.

Callback encryption

$password = 'password';

$stringToDecrypt = base64_decode(strtr($requestData['data'], '-_', '+/'), true);

$ivLength = (int) openssl_cipher_iv_length('aes-256-gcm');
$iv = substr($stringToDecrypt, 0, $ivLength);
$ciphertext = substr($stringToDecrypt, $ivLength, -16);
$tag = substr($stringToDecrypt, -16);

$decryptedText = openssl_decrypt(
    $ciphertext,
    'aes-256-gcm',
    $password,
    OPENSSL_RAW_DATA,
    $iv,
    $tag
);

Callback parameters