API Referansı

$ts        = (string) time();
$method    = 'POST';
$path      = '/v1/orders';                       // /api öneki ve sorgu dizesi hariç
$body      = json_encode($data);                 // GET isteklerinde boş string
$signature = hash_hmac('sha256', $ts . $method . $path . $body, $apiSecret);

const ts = Math.floor(Date.now() / 1000).toString();
const body = JSON.stringify(data);              // GET isteklerinde ''
const signature = crypto.createHmac('sha256', apiSecret)
  .update(ts + 'POST' + '/v1/orders' + body)
  .digest('hex');

ts = str(int(time.time()))
body = json.dumps(data, separators=(",", ":"))   # imzaladığınız metni aynen gönderin
signature = hmac.new(api_secret.encode(), (ts + "POST" + "/v1/orders" + body).encode(), hashlib.sha256).hexdigest()

require 'DiscoPay.php';

$kp = new DiscoPay('https://discopay.windevbilisim.com.tr', 'dp_live_xxxxxxxx', 'dps_xxxxxxxx');

try {
    $order = $kp->createOrder([
        'order_id'    => '10245',              // sitenizdeki sipariş numarası
        'amount'      => 349.90,
        'currency'    => 'TRY',
        'description' => 'Premium paket (1 ay)',
        'customer'    => ['name' => 'Burak Yılmaz', 'email' => 'burak@ornek.com'],
        'return_url'  => 'https://magazam.com/siparis/10245',
        'metadata'    => ['user_id' => 812],
    ]);
    header('Location: ' . $order['payment_url']);
    exit;
} catch (RuntimeException $e) {
    echo 'Ödeme başlatılamadı: ' . $e->getMessage();
}

API_KEY="dp_live_xxxxxxxx"
API_SECRET="dps_xxxxxxxx"
TS=$(date +%s)
BODY='{"order_id":"10245","amount":349.90,"description":"Premium paket"}'
SIG=$(printf '%s' "${TS}POST/v1/orders${BODY}" | openssl dgst -sha256 -hmac "$API_SECRET" | sed 's/^.* //')

curl -X POST "https://discopay.windevbilisim.com.tr/api/v1/orders" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $API_KEY" \
  -H "X-Timestamp: $TS" \
  -H "X-Signature: $SIG" \
  -d "$BODY"

const crypto = require('crypto');

const API = 'https://discopay.windevbilisim.com.tr/api';
const KEY = 'dp_live_xxxxxxxx';
const SECRET = 'dps_xxxxxxxx';

async function discopay(method, path, body) {
  const json = body ? JSON.stringify(body) : '';
  const ts = Math.floor(Date.now() / 1000).toString();
  const sig = crypto.createHmac('sha256', SECRET).update(ts + method + path + json).digest('hex');
  const res = await fetch(API + path, {
    method,
    headers: { 'Content-Type': 'application/json', 'X-API-Key': KEY, 'X-Timestamp': ts, 'X-Signature': sig },
    body: json || undefined,
  });
  const data = await res.json();
  if (!data.success) throw new Error(data.error.message);
  return data.data;
}

const order = await discopay('POST', '/v1/orders', {
  order_id: '10245',
  amount: 349.90,
  description: 'Premium paket',
  return_url: 'https://magazam.com/siparis/10245',
});
// order.payment_url adresine yönlendirin

$order = $kp->getOrder('10245');      // veya 'DP-7H2MXQ4R'
if ($order['status'] === 'paid') {
    // siparişi tamamla
}

TS=$(date +%s)
SIG=$(printf '%s' "${TS}GET/v1/orders/10245" | openssl dgst -sha256 -hmac "$API_SECRET" | sed 's/^.* //')
curl "https://discopay.windevbilisim.com.tr/api/v1/orders/10245" -H "X-API-Key: $API_KEY" -H "X-Timestamp: $TS" -H "X-Signature: $SIG"

const order = await discopay('GET', '/v1/orders/10245');
console.log(order.status); // pending | ticket_open | paid | ...

$order = $kp->cancelOrder('10245');

TS=$(date +%s)
SIG=$(printf '%s' "${TS}POST/v1/orders/10245/cancel" | openssl dgst -sha256 -hmac "$API_SECRET" | sed 's/^.* //')
curl -X POST "https://discopay.windevbilisim.com.tr/api/v1/orders/10245/cancel" -H "X-API-Key: $API_KEY" -H "X-Timestamp: $TS" -H "X-Signature: $SIG"

<?php
// discopay-callback.php
require 'DiscoPay.php';
$kp = new DiscoPay('https://discopay.windevbilisim.com.tr', 'dp_live_xxxxxxxx', 'dps_xxxxxxxx');

$event = $kp->verifyWebhook();
if ($event === null) {
    http_response_code(400);
    exit('INVALID');
}

$o = $event['order'];
$siparis = $db->siparisBul($o['order_id']);          // kendi sipariş tablonuz

if ($siparis && (float)$siparis['tutar'] === (float)$o['amount']) {
    switch ($event['event']) {
        case 'order.paid':
            if ($siparis['durum'] !== 'odendi') {         // tekrar gelen webhook'ta iki kez işlemeyin
                $db->siparisDurum($o['order_id'], 'odendi');
            }
            break;
        case 'order.rejected':
        case 'order.cancelled':
        case 'order.expired':
            $db->siparisDurum($o['order_id'], 'iptal');
            break;
    }
}

echo 'OK';   // 2xx yanıt verdiğinizde webhook teslim edilmiş sayılır

const express = require('express');
const crypto = require('crypto');
const SECRET = 'dps_xxxxxxxx';

const app = express();
app.post('/discopay-callback', express.raw({ type: 'application/json' }), (req, res) => {
  const ts = req.get('X-DiscoPay-Timestamp');
  const sig = req.get('X-DiscoPay-Signature') || '';
  const raw = req.body.toString('utf8');
  const expected = crypto.createHmac('sha256', SECRET).update(ts + '.' + raw).digest('hex');

  const valid = sig.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected)) &&
    Math.abs(Date.now() / 1000 - Number(ts)) < 300;
  if (!valid) return res.status(400).send('INVALID');

  const { event, order } = JSON.parse(raw);
  if (event === 'order.paid') {
    // order.order_id siparişini "ödendi" yapın
  }
  res.send('OK');
});
app.listen(3000);

import hmac, hashlib, time, json
from flask import Flask, request

SECRET = b"dps_xxxxxxxx"
app = Flask(__name__)

@app.post("/discopay-callback")
def callback():
    ts = request.headers.get("X-DiscoPay-Timestamp", "")
    sig = request.headers.get("X-DiscoPay-Signature", "")
    raw = request.get_data()
    expected = hmac.new(SECRET, ts.encode() + b"." + raw, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(sig, expected) or abs(time.time() - int(ts or 0)) > 300:
        return "INVALID", 400

    data = json.loads(raw)
    if data["event"] == "order.paid":
        pass  # data["order"]["order_id"] siparişini tamamlayın
    return "OK"