Payment Infrastructure
for Southeast Asia

const createPayin = async () => {
  const body = {
    uid: "user_2883",
    merchantOid: crypto.randomUUID(),
    amount: 1000000,
    notifyUrl: "https://your-server.com/callback/payin",
    redirectUrl: "https://your-app.com/payment/success",
    timestamp: Math.floor(Date.now() / 1000),
    name: "Taylor", email: "taylor@example.com",
    phone: "08123456789", passage: "", type: "payin"
  };
  const sign = generateRSASignature(body, privateKey);
  const res = await fetch("https://api.onepay.vip/api/v1/payin/create", {
    method: "POST",
    headers: { "Content-Type": "application/json", "ONEPAY-SIGN": sign, "ONEPAY-MCODE": MCODE },
    body: JSON.stringify(body)
  });
  return res.json();
};

body := map[string]interface{}{
    "uid": "user_2883", "merchantOid": uuid.New().String(),
    "amount": 1000000, "notifyUrl": "https://your-server.com/callback/payin",
    "redirectUrl": "https://your-app.com/payment/success",
    "timestamp": time.Now().Unix(), "name": "Taylor",
    "email": "taylor@example.com", "phone": "08123456789",
    "type": "payin",
}
sorted := JsonToSortedString(body)
hash := sha256.Sum256([]byte(sorted))
hashHex := hex.EncodeToString(hash[:])
sig, _ := rsa.SignPKCS1v15(rand.Reader, privKey, crypto.SHA256,
    sha256.Sum256([]byte(hashHex))[:])
signB64 := base64.StdEncoding.EncodeToString(sig)

req, _ := http.NewRequest("POST", "https://api.onepay.vip/api/v1/payin/create", jsonBody)
req.Header.Set("ONEPAY-SIGN", signB64)
req.Header.Set("ONEPAY-MCODE", mcode)

body = {
    "uid": "user_2883", "merchantOid": str(uuid.uuid4()),
    "amount": 1000000, "notifyUrl": "https://your-server.com/callback/payin",
    "redirectUrl": "https://your-app.com/payment/success",
    "timestamp": int(time.time()), "name": "Taylor",
    "email": "taylor@example.com", "phone": "08123456789",
    "type": "payin"
}
sorted_str = "&".join(f"{k}={v}" for k, v in sorted(body.items()) if v)
hash_hex = hashlib.sha256(sorted_str.encode()).hexdigest()
key = RSA.import_key(open("private.pem").read())
signature = pkcs1_15.new(key).sign(SHA256.new(hash_hex.encode()))
sign_b64 = base64.b64encode(signature).decode()

resp = requests.post("https://api.onepay.vip/api/v1/payin/create",
    json=body, headers={"ONEPAY-SIGN": sign_b64, "ONEPAY-MCODE": MCODE})

Map<String, Object> body = new TreeMap<>();
body.put("uid", "user_2883");
body.put("merchantOid", UUID.randomUUID().toString());
body.put("amount", 1000000);
body.put("notifyUrl", "https://your-server.com/callback/payin");
body.put("redirectUrl", "https://your-app.com/payment/success");
body.put("timestamp", System.currentTimeMillis() / 1000);
body.put("name", "Taylor");  body.put("email", "taylor@example.com");
body.put("phone", "08123456789");  body.put("type", "payin");

String sorted = body.entrySet().stream()
    .filter(e -> !e.getValue().toString().isEmpty())
    .map(e -> e.getKey() + "=" + e.getValue()).collect(Collectors.joining("&"));
String hash = sha256Hex(sorted);
Signature sig = Signature.getInstance("SHA256withRSA");
sig.initSign(privateKey);  sig.update(hash.getBytes());
String signB64 = Base64.getEncoder().encodeToString(sig.sign());
// POST with headers ONEPAY-SIGN + ONEPAY-MCODE

$body = [
    "uid" => "user_2883",
    "merchantOid" => sprintf("%s-%s-%s-%s-%s", ...),  // UUID
    "amount" => 1000000,
    "notifyUrl" => "https://your-server.com/callback/payin",
    "redirectUrl" => "https://your-app.com/payment/success",
    "timestamp" => time(),
    "name" => "Taylor", "email" => "taylor@example.com",
    "phone" => "08123456789", "type" => "payin"
];
$sign = OnePay::sign($body, $privateKeyPem);

$ch = curl_init("https://api.onepay.vip/api/v1/payin/create");
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_HTTPHEADER => [
        "Content-Type: application/json",
        "ONEPAY-SIGN: " . $sign,
        "ONEPAY-MCODE: " . $mcode
    ],
    CURLOPT_POSTFIELDS => json_encode($body),
    CURLOPT_RETURNTRANSFER => true
]);
$result = json_decode(curl_exec($ch), true);
curl_close($ch);

const createPayout = async () => {
  const body = {
    uid: "3800", name: "John Doe",
    notifyUrl: "https://your-server.com/callback/payout",
    amount: 1500000,
    merchantOid: crypto.randomUUID(),
    bankCode: "014",  // BCA
    accountNo: "1234567890",
    email: "john@example.com",
    note: "Withdrawal request",
    type: "payout",
    feeType: "Additional",
    passage: "your_passage_code"
  };
  const sign = generateRSASignature(body, privateKey);
  const res = await fetch("https://api.onepay.vip/api/v1/payout/create", {
    method: "POST",
    headers: { "Content-Type": "application/json", "ONEPAY-SIGN": sign, "ONEPAY-MCODE": MCODE },
    body: JSON.stringify(body)
  });
  return res.json();
};

body := map[string]interface{}{
    "uid": "3800", "name": "John Doe",
    "notifyUrl":    "https://your-server.com/callback/payout",
    "amount":       1500000,
    "merchantOid":  uuid.New().String(),
    "bankCode":     "014",  // BCA
    "accountNo":    "1234567890",
    "email":        "john@example.com",
    "note":         "Withdrawal request",
    "type":         "payout",
    "feeType":      "Additional",
    "passage":      "your_passage_code",
}
sorted := JsonToSortedString(body)
hash := sha256.Sum256([]byte(sorted))
hashHex := hex.EncodeToString(hash[:])
sig, _ := rsa.SignPKCS1v15(rand.Reader, privKey, crypto.SHA256,
    sha256.Sum256([]byte(hashHex))[:])
signB64 := base64.StdEncoding.EncodeToString(sig)

req, _ := http.NewRequest("POST", "https://api.onepay.vip/api/v1/payout/create", jsonBody)
req.Header.Set("ONEPAY-SIGN", signB64)
req.Header.Set("ONEPAY-MCODE", mcode)

body = {
    "uid": "3800", "name": "John Doe",
    "notifyUrl": "https://your-server.com/callback/payout",
    "amount": 1500000,
    "merchantOid": str(uuid.uuid4()),
    "bankCode": "014",  # BCA
    "accountNo": "1234567890",
    "email": "john@example.com",
    "note": "Withdrawal request",
    "type": "payout",
    "feeType": "Additional",
    "passage": "your_passage_code"
}
sorted_str = "&".join(f"{k}={v}" for k, v in sorted(body.items()) if v)
hash_hex = hashlib.sha256(sorted_str.encode()).hexdigest()
key = RSA.import_key(open("private.pem").read())
signature = pkcs1_15.new(key).sign(SHA256.new(hash_hex.encode()))
sign_b64 = base64.b64encode(signature).decode()

resp = requests.post("https://api.onepay.vip/api/v1/payout/create",
    json=body, headers={"ONEPAY-SIGN": sign_b64, "ONEPAY-MCODE": MCODE})

Map<String, Object> body = new TreeMap<>();
body.put("uid", "3800");  body.put("name", "John Doe");
body.put("notifyUrl", "https://your-server.com/callback/payout");
body.put("amount", 1500000);
body.put("merchantOid", UUID.randomUUID().toString());
body.put("bankCode", "014");  // BCA
body.put("accountNo", "1234567890");
body.put("email", "john@example.com");
body.put("note", "Withdrawal request");
body.put("type", "payout");
body.put("feeType", "Additional");
body.put("passage", "your_passage_code");

String sorted = body.entrySet().stream()
    .filter(e -> !e.getValue().toString().isEmpty())
    .map(e -> e.getKey() + "=" + e.getValue()).collect(Collectors.joining("&"));
String hash = sha256Hex(sorted);
Signature sig = Signature.getInstance("SHA256withRSA");
sig.initSign(privateKey);  sig.update(hash.getBytes());
String signB64 = Base64.getEncoder().encodeToString(sig.sign());
// POST with headers ONEPAY-SIGN + ONEPAY-MCODE

$body = [
    "uid" => "3800", "name" => "John Doe",
    "notifyUrl" => "https://your-server.com/callback/payout",
    "amount" => 1500000,
    "merchantOid" => uniqid("", true),
    "bankCode" => "014",  // BCA
    "accountNo" => "1234567890",
    "email" => "john@example.com",
    "note" => "Withdrawal request",
    "type" => "payout",
    "feeType" => "Additional",
    "passage" => "your_passage_code"
];
$sign = OnePay::sign($body, $privateKeyPem);

$ch = curl_init("https://api.onepay.vip/api/v1/payout/create");
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_HTTPHEADER => [
        "Content-Type: application/json",
        "ONEPAY-SIGN: " . $sign,
        "ONEPAY-MCODE: " . $mcode
    ],
    CURLOPT_POSTFIELDS => json_encode($body),
    CURLOPT_RETURNTRANSFER => true
]);
$result = json_decode(curl_exec($ch), true);
curl_close($ch);

const queryOrder = async (type, merchantOid) => {
  const body = { type, merchantOid };
  const sign = generateRSASignature(body, privateKey);
  const res = await fetch("https://api.onepay.vip/api/v1/query/order", {
    method: "POST",
    headers: { "Content-Type": "application/json", "ONEPAY-SIGN": sign, "ONEPAY-MCODE": MCODE },
    body: JSON.stringify(body)
  });
  return res.json();
};
// Usage
const result = await queryOrder("payin", "9d6e7671-64b9-408b-abad-1ef4601af101");

body := map[string]interface{}{
    "type":        "payin",
    "merchantOid": "9d6e7671-64b9-408b-abad-1ef4601af101",
}
sorted := JsonToSortedString(body)
hash := sha256.Sum256([]byte(sorted))
hashHex := hex.EncodeToString(hash[:])
sig, _ := rsa.SignPKCS1v15(rand.Reader, privKey, crypto.SHA256,
    sha256.Sum256([]byte(hashHex))[:])

req, _ := http.NewRequest("POST", "https://api.onepay.vip/api/v1/query/order", jsonBody)
req.Header.Set("ONEPAY-SIGN", base64.StdEncoding.EncodeToString(sig))
req.Header.Set("ONEPAY-MCODE", mcode)

def query_order(order_type, merchant_oid):
    body = {"type": order_type, "merchantOid": merchant_oid}
    sorted_str = "&".join(f"{k}={v}" for k, v in sorted(body.items()) if v)
    hash_hex = hashlib.sha256(sorted_str.encode()).hexdigest()
    key = RSA.import_key(open("private.pem").read())
    signature = pkcs1_15.new(key).sign(SHA256.new(hash_hex.encode()))
    sign_b64 = base64.b64encode(signature).decode()

    resp = requests.post("https://api.onepay.vip/api/v1/query/order",
        json=body, headers={"ONEPAY-SIGN": sign_b64, "ONEPAY-MCODE": MCODE})
    return resp.json()

# Usage
result = query_order("payin", "9d6e7671-64b9-408b-abad-1ef4601af101")

Map<String, Object> body = new TreeMap<>();
body.put("type", "payin");
body.put("merchantOid", "9d6e7671-64b9-408b-abad-1ef4601af101");

String sorted = body.entrySet().stream()
    .map(e -> e.getKey() + "=" + e.getValue()).collect(Collectors.joining("&"));
String hash = sha256Hex(sorted);
Signature sig = Signature.getInstance("SHA256withRSA");
sig.initSign(privateKey);  sig.update(hash.getBytes());
String signB64 = Base64.getEncoder().encodeToString(sig.sign());
// POST to /query/order with headers ONEPAY-SIGN + ONEPAY-MCODE

$body = [
    "type" => "payin",
    "merchantOid" => "9d6e7671-64b9-408b-abad-1ef4601af101"
];
$sign = OnePay::sign($body, $privateKeyPem);

$ch = curl_init("https://api.onepay.vip/api/v1/query/order");
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_HTTPHEADER => [
        "Content-Type: application/json",
        "ONEPAY-SIGN: " . $sign,
        "ONEPAY-MCODE: " . $mcode
    ],
    CURLOPT_POSTFIELDS => json_encode($body),
    CURLOPT_RETURNTRANSFER => true
]);
$result = json_decode(curl_exec($ch), true);
curl_close($ch);

const queryBalance = async () => {
  // For balance query, sign the MCODE value itself
  const hash = crypto.createHash("sha256").update(MCODE).digest("hex");
  const sign = crypto.sign("sha256", Buffer.from(hash), privateKey);
  const signB64 = sign.toString("base64");

  const res = await fetch("https://api.onepay.vip/api/v1/query/balance", {
    headers: { "ONEPAY-SIGN": signB64, "ONEPAY-MCODE": MCODE }
  });
  return res.json();
  // { code: 0, amount: 50000000, settleAmount: 10000000, freezeAmount: 0 }
};

// For balance query, sign the MCODE value itself
hash := sha256.Sum256([]byte(mcode))
hashHex := hex.EncodeToString(hash[:])
sig, _ := rsa.SignPKCS1v15(rand.Reader, privKey, crypto.SHA256,
    sha256.Sum256([]byte(hashHex))[:])
signB64 := base64.StdEncoding.EncodeToString(sig)

req, _ := http.NewRequest("GET", "https://api.onepay.vip/api/v1/query/balance", nil)
req.Header.Set("ONEPAY-SIGN", signB64)
req.Header.Set("ONEPAY-MCODE", mcode)

def query_balance():
    # For balance query, sign the MCODE value itself
    hash_hex = hashlib.sha256(MCODE.encode()).hexdigest()
    key = RSA.import_key(open("private.pem").read())
    signature = pkcs1_15.new(key).sign(SHA256.new(hash_hex.encode()))
    sign_b64 = base64.b64encode(signature).decode()

    resp = requests.get("https://api.onepay.vip/api/v1/query/balance",
        headers={"ONEPAY-SIGN": sign_b64, "ONEPAY-MCODE": MCODE})
    return resp.json()
    # {"code": 0, "amount": 50000000, "settleAmount": 10000000, "freezeAmount": 0}

// For balance query, sign the MCODE value itself
String hash = sha256Hex(MCODE);
Signature sig = Signature.getInstance("SHA256withRSA");
sig.initSign(privateKey);
sig.update(hash.getBytes());
String signB64 = Base64.getEncoder().encodeToString(sig.sign());

HttpURLConnection conn = (HttpURLConnection)
    new URL("https://api.onepay.vip/api/v1/query/balance").openConnection();
conn.setRequestMethod("GET");
conn.setRequestProperty("ONEPAY-SIGN", signB64);
conn.setRequestProperty("ONEPAY-MCODE", MCODE);

// For balance query, sign the MCODE value itself
$hashHex = hash("sha256", $mcode);
$privKey = openssl_pkey_get_private($privateKeyPem);
openssl_sign($hashHex, $signature, $privKey, OPENSSL_ALGO_SHA256);
$signB64 = base64_encode($signature);

$ch = curl_init("https://api.onepay.vip/api/v1/query/balance");
curl_setopt_array($ch, [
    CURLOPT_HTTPHEADER => [
        "ONEPAY-SIGN: " . $signB64,
        "ONEPAY-MCODE: " . $mcode
    ],
    CURLOPT_RETURNTRANSFER => true
]);
$result = json_decode(curl_exec($ch), true);
// {"code": 0, "amount": 50000000, "settleAmount": 10000000, "freezeAmount": 0}

// Express.js handler
app.post("/callback/payin", async (req, res) => {
  const sign = req.headers["onepay-sign"];
  const body = req.body;

  // Sort params, hash, verify
  const sorted = Object.keys(body).sort()
    .filter(k => body[k] !== "")
    .map(k => `${k}=${body[k]}`).join("&");
  const hash = crypto.createHash("sha256").update(sorted).digest("hex");

  // Decrypt signature with private key
  const decrypted = crypto.privateDecrypt(
    { key: privateKey, padding: crypto.constants.RSA_PKCS1_PADDING },
    Buffer.from(sign, "base64")
  ).toString();

  if (decrypted !== hash) return res.status(400).send("FAIL");

  // Process order (idempotent!)
  if (body.status === "order_success") {
    await updateOrderStatus(body.merchantOid, body.status, body.settleStatus);
  }
  res.send("SUCCESS");
});

func PayinCallback(c *gin.Context) {
    sign := c.GetHeader("ONEPAY-SIGN")
    var body map[string]interface{}
    c.ShouldBindJSON(&body)

    // Sort params, hash
    sorted := JsonToSortedString(body)
    hash := sha256.Sum256([]byte(sorted))
    hashHex := hex.EncodeToString(hash[:])

    // Decrypt ONEPAY-SIGN with private key
    decrypted, err := DecryptWithPrivateKey(privKey, sign)
    if err != nil || decrypted != hashHex {
        c.String(400, "FAIL")
        return
    }

    // Process order (idempotent)
    status := body["status"].(string)
    if status == "order_success" {
        updateOrderStatus(body["merchantOid"].(string), status)
    }
    c.String(200, "SUCCESS")
}

# Flask handler
@app.route("/callback/payin", methods=["POST"])
def payin_callback():
    sign = request.headers.get("ONEPAY-SIGN")
    body = request.get_json()

    # Sort params, hash
    sorted_str = "&".join(f"{k}={v}" for k, v in sorted(body.items()) if str(v))
    hash_hex = hashlib.sha256(sorted_str.encode()).hexdigest()

    # Decrypt signature with private key
    key = RSA.import_key(open("private.pem").read())
    cipher = PKCS1_v1_5.new(key)
    decrypted = cipher.decrypt(base64.b64decode(sign), None).decode()

    if decrypted != hash_hex:
        return "FAIL", 400

    # Process order (idempotent)
    if body["status"] == "order_success":
        update_order(body["merchantOid"], body["status"], body["settleStatus"])
    return "SUCCESS"

// Spring Boot handler
@PostMapping("/callback/payin")
public String payinCallback(
    @RequestHeader("ONEPAY-SIGN") String sign,
    @RequestBody Map<String, Object> body) {

    // Sort params, hash
    String sorted = new TreeMap<>(body).entrySet().stream()
        .filter(e -> !e.getValue().toString().isEmpty())
        .map(e -> e.getKey() + "=" + e.getValue())
        .collect(Collectors.joining("&"));
    String hash = sha256Hex(sorted);

    // Decrypt signature with private key
    Cipher cipher = Cipher.getInstance("RSA/ECB/PKCS1Padding");
    cipher.init(Cipher.DECRYPT_MODE, privateKey);
    String decrypted = new String(cipher.doFinal(Base64.getDecoder().decode(sign)));

    if (!decrypted.equals(hash)) return "FAIL";

    // Process order (idempotent)
    if ("order_success".equals(body.get("status"))) {
        updateOrder(body.get("merchantOid"), body.get("status"));
    }
    return "SUCCESS";
}

// Laravel/raw PHP callback handler
$sign = $_SERVER['HTTP_ONEPAY_SIGN'] ?? '';
$body = json_decode(file_get_contents('php://input'), true);

// Sort params, hash
ksort($body);
$pairs = [];
foreach ($body as $k => $v) {
    if ((string)$v !== '') $pairs[] = "$k=$v";
}
$sorted = implode('&', $pairs);
$hashHex = hash('sha256', $sorted);

// Decrypt signature with private key
$privKey = openssl_pkey_get_private($privateKeyPem);
openssl_private_decrypt(base64_decode($sign), $decrypted, $privKey);

if ($decrypted !== $hashHex) {
    http_response_code(400);
    echo "FAIL"; exit;
}

// Process order (idempotent)
if ($body['status'] === 'order_success') {
    updateOrder($body['merchantOid'], $body['status'], $body['settleStatus']);
}
echo "SUCCESS";