<?php
// 1) Save the order in YOUR database first (status = pending),
//    keyed by a unique identifier (max 20 chars, unique forever).
$identifier = 'ORD' . time() . rand(100, 999);   // e.g. ORD1790000000123

$parameters = [
    'public_key'     => 'YOUR_PUBLIC_KEY',
    'identifier'     => $identifier,
    'currency'       => 'PKR',
    'amount'         => 500,                       // PKR
    'details'        => 'Wallet Recharge',
    'ipn_url'        => 'https://yourdomain.com/zurvapay/ipn.php',
    'success_url'    => 'https://yourdomain.com/payment/success',
    'cancel_url'     => 'https://yourdomain.com/payment/cancel',
    'site_logo'      => 'https://yourdomain.com/logo.png',  // optional
    'checkout_theme' => 'dark',                              // optional: dark | light
    'customer_name'  => 'John Doe',
    'customer_email' => 'john@mail.com',
];

$ch = curl_init('https://www.zurvapay.com/payment/initiate');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $parameters);     // form data
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 30);
$result = json_decode(curl_exec($ch), true);
curl_close($ch);

if (($result['success'] ?? '') === 'ok') {
    header('Location: ' . $result['url']);   // send the customer to checkout
    exit;
}
echo 'Payment could not be started: ' . ($result['message'] ?? 'unknown error');

curl -X POST "https://www.zurvapay.com/payment/initiate" \
  -F "public_key=YOUR_PUBLIC_KEY" \
  -F "identifier=ORD1790000000123" \
  -F "currency=PKR" \
  -F "amount=500" \
  -F "details=Wallet Recharge" \
  -F "ipn_url=https://yourdomain.com/zurvapay/ipn.php" \
  -F "success_url=https://yourdomain.com/payment/success" \
  -F "cancel_url=https://yourdomain.com/payment/cancel" \
  -F "checkout_theme=dark" \
  -F "customer_name=John Doe" \
  -F "customer_email=john@mail.com"

import time, random, requests

identifier = f"ORD{int(time.time())}{random.randint(100, 999)}"

r = requests.post("https://www.zurvapay.com/payment/initiate", data={
    "public_key": "YOUR_PUBLIC_KEY",
    "identifier": identifier,
    "currency": "PKR",
    "amount": 500,
    "details": "Wallet Recharge",
    "ipn_url": "https://yourdomain.com/zurvapay/ipn",
    "success_url": "https://yourdomain.com/payment/success",
    "cancel_url": "https://yourdomain.com/payment/cancel",
    "checkout_theme": "dark",
    "customer_name": "John Doe",
    "customer_email": "john@mail.com",
}, timeout=30)

res = r.json()
if res.get("success") == "ok":
    checkout_url = res["url"]      # redirect the customer here
else:
    print("Error:", res.get("message"))

// Node.js 18+ (built-in fetch)
const identifier = 'ORD' + Date.now().toString().slice(0, 10) + Math.floor(100 + Math.random() * 900);

const body = new URLSearchParams({
  public_key: 'YOUR_PUBLIC_KEY',
  identifier,
  currency: 'PKR',
  amount: '500',
  details: 'Wallet Recharge',
  ipn_url: 'https://yourdomain.com/zurvapay/ipn',
  success_url: 'https://yourdomain.com/payment/success',
  cancel_url: 'https://yourdomain.com/payment/cancel',
  checkout_theme: 'dark',
  customer_name: 'John Doe',
  customer_email: 'john@mail.com',
});

const res = await (await fetch('https://www.zurvapay.com/payment/initiate', { method: 'POST', body })).json();
if (res.success === 'ok') {
  // res.redirect(res.url)  -> send the customer to checkout
} else {
  console.error(res.message);
}

<?php
// ipn.php  —  ZurvaPay POSTs here (form data) when a payment is PAID.
// This is the ONLY place you should mark an order as paid.

$secret = 'YOUR_SECRET_KEY';

$status     = $_POST['status']     ?? '';
$identifier = $_POST['identifier'] ?? '';
$signature  = $_POST['signature']  ?? '';
$statusSig  = $_POST['status_signature'] ?? '';
$data       = $_POST['data']       ?? [];
$amount     = $data['amount']      ?? '';        // e.g. "500.00000000" — use AS-IS

// 1) Verify signatures (use the raw strings exactly as received)
$expected       = strtoupper(hash_hmac('sha256', $amount . $identifier, $secret));
$expectedStatus = strtoupper(hash_hmac('sha256', $status . '|' . $identifier . '|' . $amount, $secret));

if (!hash_equals($expected, $signature) || !hash_equals($expectedStatus, $statusSig) || $status !== 'success') {
    http_response_code(200);
    echo json_encode(['status' => 'failed']);
    exit;
}

// 2) Find YOUR pending order and check the amount
$order = find_order_by_identifier($identifier);           // your function
if ($order && $order['status'] === 'pending' && (float) $amount >= (float) $order['amount']) {
    // 3) Mark paid ONCE (use a DB transaction / row lock), then deliver
    mark_order_paid($order['id'], $data['payment_trx']);   // your function
}

// 4) Always answer HTTP 200 — anything else makes ZurvaPay retry
http_response_code(200);
echo json_encode(['status' => 'ok']);

# Flask example
import hmac, hashlib
from flask import Flask, request, jsonify

app = Flask(__name__)
SECRET = b"YOUR_SECRET_KEY"

def sign(msg: str) -> str:
    return hmac.new(SECRET, msg.encode(), hashlib.sha256).hexdigest().upper()

@app.post("/zurvapay/ipn")
def zurvapay_ipn():
    f = request.form
    status, identifier = f.get("status", ""), f.get("identifier", "")
    amount = f.get("data[amount]", "")                      # raw string, e.g. "500.00000000"

    ok = (hmac.compare_digest(sign(amount + identifier), f.get("signature", ""))
          and hmac.compare_digest(sign(f"{status}|{identifier}|{amount}"), f.get("status_signature", ""))
          and status == "success")

    if ok:
        order = find_pending_order(identifier)              # your function
        if order and float(amount) >= float(order.amount):
            mark_order_paid(order.id, f.get("data[payment_trx]"))   # once only
        return jsonify(status="ok"), 200
    return jsonify(status="failed"), 200

// Express example
const express = require('express');
const crypto = require('crypto');
const app = express();
app.use(express.urlencoded({ extended: true }));   // IPN is form-encoded

const SECRET = 'YOUR_SECRET_KEY';
const sign = (msg) => crypto.createHmac('sha256', SECRET).update(msg).digest('hex').toUpperCase();
const same = (a, b) => a.length === b.length && crypto.timingSafeEqual(Buffer.from(a), Buffer.from(b));

app.post('/zurvapay/ipn', async (req, res) => {
  const { status = '', identifier = '', signature = '', status_signature = '' } = req.body;
  const data = req.body.data || {};
  const amount = String(data.amount || '');           // raw string, e.g. "500.00000000"

  const valid = same(sign(amount + identifier), signature)
             && same(sign(`${status}|${identifier}|${amount}`), status_signature)
             && status === 'success';

  if (valid) {
    const order = await findPendingOrder(identifier);             // your function
    if (order && Number(amount) >= Number(order.amount)) {
      await markOrderPaid(order.id, data.payment_trx);            // once only
    }
    return res.status(200).json({ status: 'ok' });
  }
  res.status(200).json({ status: 'failed' });
});

<?php
function zurvapay_status(array $identifiers): array
{
    $ch = curl_init('https://www.zurvapay.com/payment/status');
    curl_setopt_array($ch, [
        CURLOPT_POST => true,
        CURLOPT_POSTFIELDS => http_build_query([
            'public_key'  => 'YOUR_PUBLIC_KEY',
            'secret_key'  => 'YOUR_SECRET_KEY',
            'identifiers' => $identifiers,            // max 50
        ]),
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT => 30,
    ]);
    $res = json_decode(curl_exec($ch), true);
    curl_close($ch);

    return ($res['success'] ?? '') === 'ok' ? $res['payments'] : [];
}

print_r(zurvapay_status(['ORD1790000000123', 'ORD1790000000456']));

# One payment
curl -X POST "https://www.zurvapay.com/payment/status" \
  -d "public_key=YOUR_PUBLIC_KEY" \
  -d "secret_key=YOUR_SECRET_KEY" \
  -d "identifier=ORD1790000000123"

# Up to 50 payments in one call
curl -X POST "https://www.zurvapay.com/payment/status" \
  -d "public_key=YOUR_PUBLIC_KEY" \
  -d "secret_key=YOUR_SECRET_KEY" \
  -d "identifiers[]=ORD1790000000123" \
  -d "identifiers[]=ORD1790000000456"

import requests

r = requests.post("https://www.zurvapay.com/payment/status", data={
    "public_key": "YOUR_PUBLIC_KEY",
    "secret_key": "YOUR_SECRET_KEY",
    "identifiers[]": ["ORD1790000000123", "ORD1790000000456"],
}, timeout=30)

for p in r.json().get("payments", []):
    print(p["identifier"], p["status"])

const body = new URLSearchParams();
body.append('public_key', 'YOUR_PUBLIC_KEY');
body.append('secret_key', 'YOUR_SECRET_KEY');
['ORD1790000000123', 'ORD1790000000456'].forEach(id => body.append('identifiers[]', id));

const res = await (await fetch('https://www.zurvapay.com/payment/status', { method: 'POST', body })).json();
for (const p of res.payments || []) console.log(p.identifier, p.status);

<?php
/**
 * zurvapay_cron.php — OPTIONAL. Completes orders whose customer paid but
 * the IPN never reached you (checkout error, closed browser, server down).
 * Run it every 5 minutes with a cron job (see "Schedule it" below).
 */
const PUBLIC_KEY = 'YOUR_PUBLIC_KEY';
const SECRET_KEY = 'YOUR_SECRET_KEY';
const STATUS_URL = 'https://www.zurvapay.com/payment/status';

$pdo = new PDO('mysql:host=localhost;dbname=YOUR_DB;charset=utf8mb4', 'DB_USER', 'DB_PASS', [
    PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
]);

// 1) Your ZurvaPay orders still pending, created in the last 24 hours
$rows = $pdo->query("SELECT id, identifier, amount FROM orders
                     WHERE gateway = 'zurvapay' AND status = 'pending'
                       AND created_at >= NOW() - INTERVAL 24 HOUR
                     ORDER BY id DESC LIMIT 50")->fetchAll(PDO::FETCH_ASSOC);
if (!$rows) exit("Nothing to check\n");

$orders = array_column($rows, null, 'identifier');

// 2) Ask ZurvaPay (max 50 identifiers per call)
$ch = curl_init(STATUS_URL);
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query([
        'public_key'  => PUBLIC_KEY,
        'secret_key'  => SECRET_KEY,
        'identifiers' => array_keys($orders),
    ]),
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 30,
]);
$res = json_decode(curl_exec($ch), true);
curl_close($ch);
if (($res['success'] ?? '') !== 'ok') exit('Status API error: ' . ($res['message'] ?? 'no response') . "\n");

// 3) Complete the paid ones — same checks as your IPN handler
foreach ($res['payments'] as $p) {
    if ($p['status'] !== 'success') continue;

    $expected = strtoupper(hash_hmac('sha256', $p['status'] . '|' . $p['identifier'] . '|' . $p['amount'], SECRET_KEY));
    if (!hash_equals($expected, $p['status_signature'])) continue;

    $order = $orders[$p['identifier']] ?? null;
    if (!$order || (float) $p['amount'] < (float) $order['amount']) continue;

    // Update only if STILL pending -> never double-credits (IPN may arrive at the same time)
    $pdo->beginTransaction();
    $upd = $pdo->prepare("UPDATE orders SET status = 'paid', payment_trx = ? WHERE id = ? AND status = 'pending'");
    $upd->execute([$p['payment_trx'], $order['id']]);
    if ($upd->rowCount() === 1) {
        deliver_order($pdo, $order['id']);   // your function: add balance / ship / activate ...
    }
    $pdo->commit();
    echo "Paid: {$p['identifier']}\n";
}

#!/usr/bin/env python3
# zurvapay_cron.py — OPTIONAL. Run every 5 minutes:
#   */5 * * * * /usr/bin/python3 /home/USER/zurvapay_cron.py
import hmac, hashlib, requests, pymysql

PUBLIC_KEY, SECRET_KEY = "YOUR_PUBLIC_KEY", "YOUR_SECRET_KEY"
STATUS_URL = "https://www.zurvapay.com/payment/status"

def sign(msg):
    return hmac.new(SECRET_KEY.encode(), msg.encode(), hashlib.sha256).hexdigest().upper()

db = pymysql.connect(host="localhost", user="DB_USER", password="DB_PASS", database="YOUR_DB", autocommit=False)
cur = db.cursor(pymysql.cursors.DictCursor)
cur.execute("""SELECT id, identifier, amount FROM orders
               WHERE gateway='zurvapay' AND status='pending'
                 AND created_at >= NOW() - INTERVAL 24 HOUR
               ORDER BY id DESC LIMIT 50""")
orders = {o["identifier"]: o for o in cur.fetchall()}
if not orders:
    raise SystemExit("Nothing to check")

res = requests.post(STATUS_URL, data={
    "public_key": PUBLIC_KEY, "secret_key": SECRET_KEY,
    "identifiers[]": list(orders.keys()),
}, timeout=30).json()
if res.get("success") != "ok":
    raise SystemExit(f"Status API error: {res.get('message')}")

for p in res["payments"]:
    if p["status"] != "success":
        continue
    if not hmac.compare_digest(sign(f"{p['status']}|{p['identifier']}|{p['amount']}"), p["status_signature"]):
        continue
    order = orders.get(p["identifier"])
    if not order or float(p["amount"]) < float(order["amount"]):
        continue
    # only if still pending -> no double credit
    changed = cur.execute("UPDATE orders SET status='paid', payment_trx=%s WHERE id=%s AND status='pending'",
                          (p["payment_trx"], order["id"]))
    if changed == 1:
        deliver_order(cur, order["id"])          # your function
    db.commit()
    print("Paid:", p["identifier"])

// zurvapay_cron.js — OPTIONAL. Run every 5 minutes:
//   */5 * * * * /usr/bin/node /home/USER/zurvapay_cron.js
const crypto = require('crypto');
const mysql = require('mysql2/promise');

const PUBLIC_KEY = 'YOUR_PUBLIC_KEY', SECRET_KEY = 'YOUR_SECRET_KEY';
const STATUS_URL = 'https://www.zurvapay.com/payment/status';
const sign = (m) => crypto.createHmac('sha256', SECRET_KEY).update(m).digest('hex').toUpperCase();

(async () => {
  const db = await mysql.createConnection({ host: 'localhost', user: 'DB_USER', password: 'DB_PASS', database: 'YOUR_DB' });
  const [rows] = await db.query(`SELECT id, identifier, amount FROM orders
                                 WHERE gateway='zurvapay' AND status='pending'
                                   AND created_at >= NOW() - INTERVAL 24 HOUR
                                 ORDER BY id DESC LIMIT 50`);
  if (!rows.length) return db.end();
  const orders = Object.fromEntries(rows.map(o => [o.identifier, o]));

  const body = new URLSearchParams({ public_key: PUBLIC_KEY, secret_key: SECRET_KEY });
  Object.keys(orders).forEach(id => body.append('identifiers[]', id));
  const res = await (await fetch(STATUS_URL, { method: 'POST', body })).json();
  if (res.success !== 'ok') { console.error('Status API error:', res.message); return db.end(); }

  for (const p of res.payments) {
    if (p.status !== 'success') continue;
    if (sign(`${p.status}|${p.identifier}|${p.amount}`) !== p.status_signature) continue;
    const order = orders[p.identifier];
    if (!order || Number(p.amount) < Number(order.amount)) continue;

    // only if still pending -> no double credit
    const [r] = await db.execute("UPDATE orders SET status='paid', payment_trx=? WHERE id=? AND status='pending'",
                                 [p.payment_trx, order.id]);
    if (r.affectedRows === 1) await deliverOrder(db, order.id);   // your function
    console.log('Paid:', p.identifier);
  }
  await db.end();
})();