https://aifo.pro/docs/swagger

POST https://aifo.pro/api/v2/invoices/create

function buildHmacSignature(
    string $method,
    string $path,
    int    $timestamp,
    string $nonce,
    array  $params,
    string $secretKey
): string {
    // Remove auth fields from params before signing
    $authFields = ['sign', 'signature', 'timestamp', 'nonce', 'idempotency_key',
                   'aifo_signature', 'aifo_timestamp', 'aifo_nonce'];
    foreach ($authFields as $f) {
        unset($params[$f]);
    }

    ksort($params); // sort by key — required
    $canonical = http_build_query($params, '', '&');

    $base = $method . "\n" . $path . "\n" . $timestamp . "\n" . $nonce . "\n" . $canonical;
    return hash_hmac('sha256', $base, $secretKey);
}

// -------- Create Invoice example --------
$secretKey  = 'YOUR_SECRET_KEY'; // from merchant panel → secret key
$shopId     = 123;               // your shop_id
$externalId = 'ORDER-456';       // your unique order ID
$amount     = '100.50';          // invoice amount

$timestamp  = time();
$nonce      = bin2hex(random_bytes(16)); // unique per request, 8-128 chars

$params = [
    'shop_id'     => $shopId,
    'amount'      => $amount,
    'external_id' => $externalId,
];

$signature = buildHmacSignature('POST', '/api/v2/invoices/create', $timestamp, $nonce, $params, $secretKey);

// Add auth fields to POST body
$postData = array_merge($params, [
    'timestamp' => $timestamp,
    'nonce'     => $nonce,
    'signature' => $signature,
]);

// Send request
$ctx = stream_context_create(['http' => [
    'method'  => 'POST',
    'header'  => 'Content-Type: application/x-www-form-urlencoded',
    'content' => http_build_query($postData),
    'timeout' => 10,
]]);
$response = file_get_contents('https://aifo.pro/api/v2/invoices/create', false, $ctx);
$result   = json_decode($response, true);

if ($result['status'] === 'success') {
    $paymentUrl = $result['data']['payment_url'];
    $invoiceId  = $result['data']['invoice_id'];
    // Redirect the user: header('Location: ' . $paymentUrl);
}

{
  "status": "success",
  "message": "Invoice created",
  "data": {
    "api_version": "v2",
    "invoice_id": 456,
    "external_id": "ORDER-456",
    "amount": "100.50",
    "amount_minor": 10050,
    "currency": "UAH",
    "status": 0,
    "status_text": "pending",
    "merchant_type": "domain",
    "checkout_endpoint": "/pay",
    "payment_url": "https://aifo.pro/pay?shop_id=123&pay_id=456&amount=100.50&sign=...",
    "created_at": "2024-01-15 10:30:00",
    "expires_at": 1705309800,
    "lifetime_minutes": 60,
    "auth_mode": "hmac",
    "key_status": "active"
  }
}

GET https://aifo.pro/api/v2/invoices/status?shop_id=123&invoice_id=456&timestamp=...&nonce=...&signature=...

$params = [
    'shop_id'    => $shopId,
    'invoice_id' => 456, // or 'external_id' => 'ORDER-456'
];

$timestamp = time();
$nonce     = bin2hex(random_bytes(16));
$signature = buildHmacSignature('GET', '/api/v2/invoices/status', $timestamp, $nonce, $params, $secretKey);

$queryString = http_build_query(array_merge($params, [
    'timestamp' => $timestamp,
    'nonce'     => $nonce,
    'signature' => $signature,
]));

$response = file_get_contents('https://aifo.pro/api/v2/invoices/status?' . $queryString);
$result   = json_decode($response, true);

if ($result['status'] === 'success') {
    $statusText = $result['data']['status_text']; // 'pending', 'paid', 'expired', 'test'
    $isPaid     = ($statusText === 'paid');
}

https://aifo.pro/pay/?shop_id=ID&pay_id=ORDER_ID&amount=AMOUNT&sign=SIGN

function getIP() {
    if (isset($_SERVER['HTTP_CF_CONNECTING_IP'])) {
        $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_CF_CONNECTING_IP'];
    }
    return $_SERVER['REMOTE_ADDR'];
}
$allowed = array('77.83.102.155');
if (!in_array(getIP(), $allowed)) die('hacking attempt!');

<?php
// webhook.php — handler for payment notifications

function getIP() {
    if (isset($_SERVER['HTTP_X_REAL_IP']))        return $_SERVER['HTTP_X_REAL_IP'];
    if (isset($_SERVER['HTTP_CF_CONNECTING_IP'])) return $_SERVER['HTTP_CF_CONNECTING_IP'];
    return $_SERVER['REMOTE_ADDR'];
}

// 1. IP whitelist check (get actual IPs from the "IP Check" section above)
$allowed = array('77.83.102.155');
if (!in_array(getIP(), $allowed)) {
    http_response_code(403);
    die('Forbidden');
}

// 2. Incoming data
$sum        = $_POST['sum']                ?? '';
$invoice    = $_POST['invoice']            ?? '';
$legacySig  = $_POST['http_auth_signature'] ?? '';
$aifoSig    = $_POST['aifo_signature']     ?? '';

$shop_id    = 123;               // your shop_id
$secret_key = 'YOUR_SECRET_KEY'; // secret key from merchant panel

// 3. Verify legacy signature
$expected = hash('sha256', $shop_id . ':' . $sum . ':' . $secret_key . ':' . $invoice);
if (!hash_equals($expected, $legacySig)) {
    http_response_code(400);
    die('Error signature');
}

// 4. (Optional) Verify aifo_signature for extra security
if ($aifoSig !== '') {
    $payload = $_POST;
    unset($payload['aifo_signature']);
    ksort($payload);
    $expectedHmac = hash_hmac('sha256', http_build_query($payload, '', '&'), $secret_key);
    if (!hash_equals($expectedHmac, $aifoSig)) {
        http_response_code(400);
        die('Error HMAC signature');
    }
}

// 5. Check the invoice has not already been paid (prevent duplicate processing)
// $order = DB::find('orders', ['external_id' => $invoice]);
// if ($order && $order->status === 'paid') { echo 'ok'; exit; }

// 6. Update order status in your database
// DB::update('orders', ['status' => 'paid', 'paid_amount' => $sum], ['external_id' => $invoice]);

// IMPORTANT: Return "ok" (HTTP 200) — otherwise the server will retry the notification
echo 'ok';