POST Create order

POST JSON with headers X-Merchant-Id and X-Api-Key.

curl -X POST https://www.sky-pay.shop/api/create.php \
 -H "Content-Type: application/json" \
 -H "X-Merchant-Id: M123456" -H "X-Api-Key: ak_xxx" \
 -d '{"amount":499,"order_id":"ORD1001","return_url":"https://yoursite.com/thanks"}'

Response: {"success":true,"gateway_order_id":"NP...","pay_url":"https://.../pay.php?id=NP..."} — redirect the customer to pay_url.

HOOK Webhook (auto verification)

When payment is verified we POST JSON to your webhook URL with header X-Signature = HMAC-SHA256(raw body, API secret).

{"event":"payment.paid","gateway_order_id":"NP...","order_id":"ORD1001","amount":499,"status":"paid","utr":"4126...","paid_at":"2026-10-22 11:30:00"}

// PHP verify
$raw = file_get_contents('php://input');
$ok  = hash_equals(hash_hmac('sha256', $raw, $API_SECRET), $_SERVER['HTTP_X_SIGNATURE']);

GET Check status

GET https://www.sky-pay.shop/api/status.php?order_id=ORD1001
Headers: X-Merchant-Id, X-Api-Key

INFO Errors, limits, retries

Errors return {"success":false,"message":"..."} with HTTP 400 (bad input), 401 (wrong credentials), 403 (IP not allowed), 429 (rate limit: 300 requests/min) or 503 (payment service busy - retry).

Sending the same order_id again while it is still pending returns the same pay_url (safe to retry). An already paid order_id is rejected.

Your webhook must answer HTTP 2xx. If it does not, we retry automatically (1 min, 5 min, 15 min, 1 h, 2 h). Always verify X-Signature and use order_id + status from the webhook; credit the player only once per order.

Order statuses: pending, paid, expired, failed. Late payments on expired orders are still credited and sent to your webhook.