Geliştirici Merkezi

<?php
$pk = 'pk_live_XXXXXXXXXXXXXXXX';
$secret = 'sk_live_XXXXXXXXXXXXXXXX'; // yalnızca sunucuda
$payload = ['amount' => 149.90, 'order' => 'ORD-' . time(), 'name' => 'Ahmet Yılmaz', 'email' => 'ahmet@ornek.com', 'currency' => 'TRY'];
$b64 = fn($x) => rtrim(strtr(base64_encode($x), '+/', '-_'), '=');
$h = $b64(json_encode(['alg' => 'HS256', 'typ' => 'JWT']));
$b = $b64(json_encode($payload, JSON_UNESCAPED_UNICODE));
$token = "$h.$b." . $b64(hash_hmac('sha256', "$h.$b", $secret, true));
header('Location: https://moneypayz.com/checkout?pk=' . urlencode($pk) . '&token=' . urlencode($token) . '&return_url=' . urlencode('https://siteniz.com/siparis-sonuc'));

# Token olmadan, parametrelerle ödeme bağlantısı (tarayıcıda açılır)
curl -I "https://moneypayz.com/checkout?pk=pk_live_XXXXXXXXXXXXXXXX&amount=149.90&order=ORD-1001&currency=TRY&return_url=https%3A%2F%2Fsiteniz.com%2Fsiparis-sonuc"

# İmzalı token (bash + openssl)
b64(){ openssl base64 -A | tr '+/' '-_' | tr -d '='; }
H=$(printf '{"alg":"HS256","typ":"JWT"}' | b64)
B=$(printf '{"amount":149.90,"order":"ORD-1001","currency":"TRY"}' | b64)
S=$(printf '%s' "$H.$B" | openssl dgst -sha256 -hmac 'sk_live_XXXXXXXXXXXXXXXX' -binary | b64)
echo "https://moneypayz.com/checkout?pk=pk_live_XXXXXXXXXXXXXXXX&token=$H.$B.$S"

const crypto = require('crypto');
const pk = 'pk_live_XXXXXXXXXXXXXXXX', secret = 'sk_live_XXXXXXXXXXXXXXXX'; // yalnızca sunucuda
const b64 = (x) => Buffer.from(x).toString('base64url');
const h = b64(JSON.stringify({ alg: 'HS256', typ: 'JWT' }));
const b = b64(JSON.stringify({ amount: 149.90, order: 'ORD-' + Date.now(), currency: 'TRY', email: 'ahmet@ornek.com' }));
const s = crypto.createHmac('sha256', secret).update(h + '.' + b).digest('base64url');
const url = 'https://moneypayz.com/checkout?pk=' + encodeURIComponent(pk) + '&token=' + `${h}.${b}.${s}` + '&return_url=' + encodeURIComponent('https://siteniz.com/siparis-sonuc');
// Express: res.redirect(url);

import base64, hashlib, hmac, json, time, urllib.parse
pk, secret = 'pk_live_XXXXXXXXXXXXXXXX', 'sk_live_XXXXXXXXXXXXXXXX'  # yalnızca sunucuda
b64 = lambda x: base64.urlsafe_b64encode(x).rstrip(b'=').decode()
h = b64(json.dumps({'alg': 'HS256', 'typ': 'JWT'}).encode())
b = b64(json.dumps({'amount': 149.90, 'order': f'ORD-{int(time.time())}', 'currency': 'TRY'}).encode())
s = b64(hmac.new(secret.encode(), f'{h}.{b}'.encode(), hashlib.sha256).digest())
url = 'https://moneypayz.com/checkout?' + urllib.parse.urlencode({'pk': pk, 'token': f'{h}.{b}.{s}', 'return_url': 'https://siteniz.com/siparis-sonuc'})
# Flask: return redirect(url)

<?php
$merchantNo = 'MAGAZA_NO'; $apiKey = 'pk_live_XXXXXXXXXXXXXXXX'; $secret = 'sk_live_XXXXXXXXXXXXXXXX';
$orderId = 'SIP-' . time(); $amount = '149.90'; $currency = 'TRY'; $inst = '1';
$ok = 'https://siteniz.com/odeme/basarili'; $fail = 'https://siteniz.com/odeme/hata'; $rnd = bin2hex(random_bytes(8));
$hash = base64_encode(hash_hmac('sha256', implode('|', [$merchantNo, $orderId, $amount, $currency, $inst, $ok, $fail, $rnd]), $secret, true));
// Bu değerleri formunuza hidden alan olarak koyun; form action="https://moneypayz.com/direct-post"

// Dönüş sayfasında (ok_url / fail_url) imza doğrulama:
$p = $_POST;
$valid = hash_equals(base64_encode(hash_hmac('sha256', implode('|', [$p['merchant_no'], $p['order_id'], $p['status'], $p['tid'], $p['amount'], $p['rnd']]), $secret, true)), $p['hash'] ?? '');

RND=$(date +%s%N)
SIG=$(printf '%s' "MAGAZA_NO|SIP-1001|149.90|TRY|1|https://siteniz.com/odeme/basarili|https://siteniz.com/odeme/hata|$RND" | openssl dgst -sha256 -hmac 'sk_live_XXXXXXXXXXXXXXXX' -binary | openssl base64 -A)
curl -X POST "https://moneypayz.com/direct-post" \
  -d merchant_no=MAGAZA_NO -d api_key=pk_live_XXXXXXXXXXXXXXXX -d order_id=SIP-1001 -d amount=149.90 -d currency=TRY -d installment=1 \
  -d ok_url=https://siteniz.com/odeme/basarili -d fail_url=https://siteniz.com/odeme/hata -d rnd=$RND -d hash="$SIG" \
  -d card_holder='ALI VELI' -d card_number=4111111111111111 -d exp=12/30 -d cvv=123

const crypto = require('crypto');
const merchantNo = 'MAGAZA_NO', apiKey = 'pk_live_XXXXXXXXXXXXXXXX', secret = 'sk_live_XXXXXXXXXXXXXXXX';
const f = { merchant_no: merchantNo, api_key: apiKey, order_id: 'SIP-' + Date.now(), amount: '149.90', currency: 'TRY', installment: '1',
  ok_url: 'https://siteniz.com/odeme/basarili', fail_url: 'https://siteniz.com/odeme/hata', rnd: crypto.randomBytes(8).toString('hex') };
f.hash = crypto.createHmac('sha256', secret).update([f.merchant_no, f.order_id, f.amount, f.currency, f.installment, f.ok_url, f.fail_url, f.rnd].join('|')).digest('base64');
// f alanlarını formunuza hidden input olarak basın; form action="https://moneypayz.com/direct-post"

// Dönüş doğrulama (Express, urlencoded body):
const verify = (p) => crypto.createHmac('sha256', secret).update([p.merchant_no, p.order_id, p.status, p.tid, p.amount, p.rnd].join('|')).digest('base64') === p.hash;

import base64, hashlib, hmac, secrets, time
merchant_no, api_key, secret = 'MAGAZA_NO', 'pk_live_XXXXXXXXXXXXXXXX', 'sk_live_XXXXXXXXXXXXXXXX'
f = {'merchant_no': merchant_no, 'api_key': api_key, 'order_id': f'SIP-{int(time.time())}', 'amount': '149.90', 'currency': 'TRY',
     'installment': '1', 'ok_url': 'https://siteniz.com/odeme/basarili', 'fail_url': 'https://siteniz.com/odeme/hata', 'rnd': secrets.token_hex(8)}
sign = lambda parts: base64.b64encode(hmac.new(secret.encode(), '|'.join(parts).encode(), hashlib.sha256).digest()).decode()
f['hash'] = sign([f[k] for k in ('merchant_no', 'order_id', 'amount', 'currency', 'installment', 'ok_url', 'fail_url', 'rnd')])
# f alanlarını formunuza hidden input olarak basın; form action="https://moneypayz.com/direct-post"

# Dönüş doğrulama:
verify = lambda p: hmac.compare_digest(sign([p['merchant_no'], p['order_id'], p['status'], p['tid'], p['amount'], p['rnd']]), p.get('hash', ''))

<?php
$pk = 'pk_live_XXXXXXXXXXXXXXXX';
$secret = 'sk_live_XXXXXXXXXXXXXXXX'; // yalnızca sunucuda
$payload = ['amount' => 149.90, 'order' => 'ORD-' . time(), 'name' => 'Ahmet Yılmaz', 'email' => 'ahmet@ornek.com', 'currency' => 'TRY'];
$b64 = fn($x) => rtrim(strtr(base64_encode($x), '+/', '-_'), '=');
$h = $b64(json_encode(['alg' => 'HS256', 'typ' => 'JWT']));
$b = $b64(json_encode($payload, JSON_UNESCAPED_UNICODE));
$token = "$h.$b." . $b64(hash_hmac('sha256', "$h.$b", $secret, true));
header('Location: https://moneypayz.com/checkout-transfer?pk=' . urlencode($pk) . '&token=' . urlencode($token) . '&return_url=' . urlencode('https://siteniz.com/siparis-sonuc'));

# Token olmadan, parametrelerle ödeme bağlantısı (tarayıcıda açılır)
curl -I "https://moneypayz.com/checkout-transfer?pk=pk_live_XXXXXXXXXXXXXXXX&amount=149.90&order=ORD-1001&currency=TRY&return_url=https%3A%2F%2Fsiteniz.com%2Fsiparis-sonuc"

# İmzalı token (bash + openssl)
b64(){ openssl base64 -A | tr '+/' '-_' | tr -d '='; }
H=$(printf '{"alg":"HS256","typ":"JWT"}' | b64)
B=$(printf '{"amount":149.90,"order":"ORD-1001","currency":"TRY"}' | b64)
S=$(printf '%s' "$H.$B" | openssl dgst -sha256 -hmac 'sk_live_XXXXXXXXXXXXXXXX' -binary | b64)
echo "https://moneypayz.com/checkout-transfer?pk=pk_live_XXXXXXXXXXXXXXXX&token=$H.$B.$S"

const crypto = require('crypto');
const pk = 'pk_live_XXXXXXXXXXXXXXXX', secret = 'sk_live_XXXXXXXXXXXXXXXX'; // yalnızca sunucuda
const b64 = (x) => Buffer.from(x).toString('base64url');
const h = b64(JSON.stringify({ alg: 'HS256', typ: 'JWT' }));
const b = b64(JSON.stringify({ amount: 149.90, order: 'ORD-' + Date.now(), currency: 'TRY', email: 'ahmet@ornek.com' }));
const s = crypto.createHmac('sha256', secret).update(h + '.' + b).digest('base64url');
const url = 'https://moneypayz.com/checkout-transfer?pk=' + encodeURIComponent(pk) + '&token=' + `${h}.${b}.${s}` + '&return_url=' + encodeURIComponent('https://siteniz.com/siparis-sonuc');
// Express: res.redirect(url);

import base64, hashlib, hmac, json, time, urllib.parse
pk, secret = 'pk_live_XXXXXXXXXXXXXXXX', 'sk_live_XXXXXXXXXXXXXXXX'  # yalnızca sunucuda
b64 = lambda x: base64.urlsafe_b64encode(x).rstrip(b'=').decode()
h = b64(json.dumps({'alg': 'HS256', 'typ': 'JWT'}).encode())
b = b64(json.dumps({'amount': 149.90, 'order': f'ORD-{int(time.time())}', 'currency': 'TRY'}).encode())
s = b64(hmac.new(secret.encode(), f'{h}.{b}'.encode(), hashlib.sha256).digest())
url = 'https://moneypayz.com/checkout-transfer?' + urllib.parse.urlencode({'pk': pk, 'token': f'{h}.{b}.{s}', 'return_url': 'https://siteniz.com/siparis-sonuc'})
# Flask: return redirect(url)

<?php
$merchantNo = 'MAGAZA_NO'; $apiKey = 'pk_live_XXXXXXXXXXXXXXXX'; $secret = 'sk_live_XXXXXXXXXXXXXXXX';
$orderId = 'SIP-' . time(); $amount = '149.90'; $currency = 'TRY'; $inst = '1';
$ok = 'https://siteniz.com/odeme/basarili'; $fail = 'https://siteniz.com/odeme/hata'; $rnd = bin2hex(random_bytes(8));
$hash = base64_encode(hash_hmac('sha256', implode('|', [$merchantNo, $orderId, $amount, $currency, $inst, $ok, $fail, $rnd]), $secret, true));
// Bu değerleri formunuza hidden alan olarak koyun; form action="https://moneypayz.com/direct-post/transfer"

// Dönüş sayfasında (ok_url / fail_url) imza doğrulama:
$p = $_POST;
$valid = hash_equals(base64_encode(hash_hmac('sha256', implode('|', [$p['merchant_no'], $p['order_id'], $p['status'], $p['tid'], $p['amount'], $p['rnd']]), $secret, true)), $p['hash'] ?? '');

RND=$(date +%s%N)
SIG=$(printf '%s' "MAGAZA_NO|SIP-1001|149.90|TRY|1|https://siteniz.com/odeme/basarili|https://siteniz.com/odeme/hata|$RND" | openssl dgst -sha256 -hmac 'sk_live_XXXXXXXXXXXXXXXX' -binary | openssl base64 -A)
curl -X POST "https://moneypayz.com/direct-post/transfer" \
  -F merchant_no=MAGAZA_NO -F api_key=pk_live_XXXXXXXXXXXXXXXX -F order_id=SIP-1001 -F amount=149.90 -F currency=TRY -F installment=1 \
  -F ok_url=https://siteniz.com/odeme/basarili -F fail_url=https://siteniz.com/odeme/hata -F rnd=$RND -F hash="$SIG" \
  -F sender_name='Ali Veli' -F iban_id=1 -F receipt=@dekont.pdf

const crypto = require('crypto');
const merchantNo = 'MAGAZA_NO', apiKey = 'pk_live_XXXXXXXXXXXXXXXX', secret = 'sk_live_XXXXXXXXXXXXXXXX';
const f = { merchant_no: merchantNo, api_key: apiKey, order_id: 'SIP-' + Date.now(), amount: '149.90', currency: 'TRY', installment: '1',
  ok_url: 'https://siteniz.com/odeme/basarili', fail_url: 'https://siteniz.com/odeme/hata', rnd: crypto.randomBytes(8).toString('hex') };
f.hash = crypto.createHmac('sha256', secret).update([f.merchant_no, f.order_id, f.amount, f.currency, f.installment, f.ok_url, f.fail_url, f.rnd].join('|')).digest('base64');
// f alanlarını formunuza hidden input olarak basın; form action="https://moneypayz.com/direct-post/transfer"

// Dönüş doğrulama (Express, urlencoded body):
const verify = (p) => crypto.createHmac('sha256', secret).update([p.merchant_no, p.order_id, p.status, p.tid, p.amount, p.rnd].join('|')).digest('base64') === p.hash;

import base64, hashlib, hmac, secrets, time
merchant_no, api_key, secret = 'MAGAZA_NO', 'pk_live_XXXXXXXXXXXXXXXX', 'sk_live_XXXXXXXXXXXXXXXX'
f = {'merchant_no': merchant_no, 'api_key': api_key, 'order_id': f'SIP-{int(time.time())}', 'amount': '149.90', 'currency': 'TRY',
     'installment': '1', 'ok_url': 'https://siteniz.com/odeme/basarili', 'fail_url': 'https://siteniz.com/odeme/hata', 'rnd': secrets.token_hex(8)}
sign = lambda parts: base64.b64encode(hmac.new(secret.encode(), '|'.join(parts).encode(), hashlib.sha256).digest()).decode()
f['hash'] = sign([f[k] for k in ('merchant_no', 'order_id', 'amount', 'currency', 'installment', 'ok_url', 'fail_url', 'rnd')])
# f alanlarını formunuza hidden input olarak basın; form action="https://moneypayz.com/direct-post/transfer"

# Dönüş doğrulama:
verify = lambda p: hmac.compare_digest(sign([p['merchant_no'], p['order_id'], p['status'], p['tid'], p['amount'], p['rnd']]), p.get('hash', ''))

<?php
$pk = 'pk_live_XXXXXXXXXXXXXXXX';
$secret = 'sk_live_XXXXXXXXXXXXXXXX'; // yalnızca sunucuda
$payload = ['amount' => 149.90, 'order' => 'ORD-' . time(), 'name' => 'Ahmet Yılmaz', 'email' => 'ahmet@ornek.com', 'currency' => 'TRY'];
$b64 = fn($x) => rtrim(strtr(base64_encode($x), '+/', '-_'), '=');
$h = $b64(json_encode(['alg' => 'HS256', 'typ' => 'JWT']));
$b = $b64(json_encode($payload, JSON_UNESCAPED_UNICODE));
$token = "$h.$b." . $b64(hash_hmac('sha256', "$h.$b", $secret, true));
header('Location: https://moneypayz.com/checkout-crypto?pk=' . urlencode($pk) . '&token=' . urlencode($token) . '&return_url=' . urlencode('https://siteniz.com/siparis-sonuc'));

# Token olmadan, parametrelerle ödeme bağlantısı (tarayıcıda açılır)
curl -I "https://moneypayz.com/checkout-crypto?pk=pk_live_XXXXXXXXXXXXXXXX&amount=149.90&order=ORD-1001&currency=TRY&return_url=https%3A%2F%2Fsiteniz.com%2Fsiparis-sonuc"

# İmzalı token (bash + openssl)
b64(){ openssl base64 -A | tr '+/' '-_' | tr -d '='; }
H=$(printf '{"alg":"HS256","typ":"JWT"}' | b64)
B=$(printf '{"amount":149.90,"order":"ORD-1001","currency":"TRY"}' | b64)
S=$(printf '%s' "$H.$B" | openssl dgst -sha256 -hmac 'sk_live_XXXXXXXXXXXXXXXX' -binary | b64)
echo "https://moneypayz.com/checkout-crypto?pk=pk_live_XXXXXXXXXXXXXXXX&token=$H.$B.$S"

const crypto = require('crypto');
const pk = 'pk_live_XXXXXXXXXXXXXXXX', secret = 'sk_live_XXXXXXXXXXXXXXXX'; // yalnızca sunucuda
const b64 = (x) => Buffer.from(x).toString('base64url');
const h = b64(JSON.stringify({ alg: 'HS256', typ: 'JWT' }));
const b = b64(JSON.stringify({ amount: 149.90, order: 'ORD-' + Date.now(), currency: 'TRY', email: 'ahmet@ornek.com' }));
const s = crypto.createHmac('sha256', secret).update(h + '.' + b).digest('base64url');
const url = 'https://moneypayz.com/checkout-crypto?pk=' + encodeURIComponent(pk) + '&token=' + `${h}.${b}.${s}` + '&return_url=' + encodeURIComponent('https://siteniz.com/siparis-sonuc');
// Express: res.redirect(url);

import base64, hashlib, hmac, json, time, urllib.parse
pk, secret = 'pk_live_XXXXXXXXXXXXXXXX', 'sk_live_XXXXXXXXXXXXXXXX'  # yalnızca sunucuda
b64 = lambda x: base64.urlsafe_b64encode(x).rstrip(b'=').decode()
h = b64(json.dumps({'alg': 'HS256', 'typ': 'JWT'}).encode())
b = b64(json.dumps({'amount': 149.90, 'order': f'ORD-{int(time.time())}', 'currency': 'TRY'}).encode())
s = b64(hmac.new(secret.encode(), f'{h}.{b}'.encode(), hashlib.sha256).digest())
url = 'https://moneypayz.com/checkout-crypto?' + urllib.parse.urlencode({'pk': pk, 'token': f'{h}.{b}.{s}', 'return_url': 'https://siteniz.com/siparis-sonuc'})
# Flask: return redirect(url)

<?php
$base = 'https://moneypayz.com'; $m = 'MAGAZA_NO'; $pk = 'pk_live_XXXXXXXXXXXXXXXX'; $secret = 'sk_live_XXXXXXXXXXXXXXXX';
$sign = fn(array $p) => base64_encode(hash_hmac('sha256', implode('|', $p), $secret, true));
$post = function ($url, $f) { $c = curl_init($url); curl_setopt_array($c, [CURLOPT_POST => 1, CURLOPT_POSTFIELDS => http_build_query($f), CURLOPT_RETURNTRANSFER => 1]); return json_decode(curl_exec($c), true); };
// 1) Kur teklifi
$rnd = bin2hex(random_bytes(8));
$q = $post("$base/direct-post/crypto/quote", ['merchant_no' => $m, 'api_key' => $pk, 'order_id' => 'SIP-1001', 'amount' => '149.90', 'currency' => 'TRY', 'coin' => 'USDT', 'rnd' => $rnd,
  'hash' => $sign([$m, 'SIP-1001', '149.90', 'TRY', 'USDT', $rnd])]);
// $q['crypto_amount'], $q['address'] müşteriye gösterilir
// 2) TXID bildirimi
$rnd2 = bin2hex(random_bytes(8)); $txid = $_POST['txid'];
$r = $post("$base/direct-post/crypto", ['merchant_no' => $m, 'api_key' => $pk, 'quote' => $q['quote'], 'txid' => $txid, 'rnd' => $rnd2, 'hash' => $sign([$m, $q['quote'], $txid, $rnd2])]);

sign(){ printf '%s' "$1" | openssl dgst -sha256 -hmac 'sk_live_XXXXXXXXXXXXXXXX' -binary | openssl base64 -A; }
RND=$(date +%s%N)
curl -s -X POST "https://moneypayz.com/direct-post/crypto/quote" -d merchant_no=MAGAZA_NO -d api_key=pk_live_XXXXXXXXXXXXXXXX -d order_id=SIP-1001 \
  -d amount=149.90 -d currency=TRY -d coin=USDT -d rnd=$RND --data-urlencode hash="$(sign "MAGAZA_NO|SIP-1001|149.90|TRY|USDT|$RND")"
# yanıttaki quote ve müşterinin TXID'si ile:
QUOTE='...'; TXID='...'; RND2=$(date +%s%N)
curl -s -X POST "https://moneypayz.com/direct-post/crypto" -d merchant_no=MAGAZA_NO -d api_key=pk_live_XXXXXXXXXXXXXXXX --data-urlencode quote="$QUOTE" \
  -d txid=$TXID -d rnd=$RND2 --data-urlencode hash="$(sign "MAGAZA_NO|$QUOTE|$TXID|$RND2")"

const crypto = require('crypto');
const base = 'https://moneypayz.com', m = 'MAGAZA_NO', pk = 'pk_live_XXXXXXXXXXXXXXXX', secret = 'sk_live_XXXXXXXXXXXXXXXX';
const sign = (p) => crypto.createHmac('sha256', secret).update(p.join('|')).digest('base64');
const post = (u, f) => fetch(base + u, { method: 'POST', body: new URLSearchParams(f) }).then(r => r.json());
(async () => {
  const rnd = crypto.randomBytes(8).toString('hex');
  const q = await post('/direct-post/crypto/quote', { merchant_no: m, api_key: pk, order_id: 'SIP-1001', amount: '149.90', currency: 'TRY', coin: 'USDT', rnd,
    hash: sign([m, 'SIP-1001', '149.90', 'TRY', 'USDT', rnd]) });
  // q.crypto_amount, q.address → müşteriye göster; ödeme sonrası:
  const txid = '...', rnd2 = crypto.randomBytes(8).toString('hex');
  const r = await post('/direct-post/crypto', { merchant_no: m, api_key: pk, quote: q.quote, txid, rnd: rnd2, hash: sign([m, q.quote, txid, rnd2]) });
})();

import base64, hashlib, hmac, secrets, requests
base, m, pk, secret = 'https://moneypayz.com', 'MAGAZA_NO', 'pk_live_XXXXXXXXXXXXXXXX', 'sk_live_XXXXXXXXXXXXXXXX'
sign = lambda p: base64.b64encode(hmac.new(secret.encode(), '|'.join(p).encode(), hashlib.sha256).digest()).decode()
rnd = secrets.token_hex(8)
q = requests.post(base + '/direct-post/crypto/quote', data={'merchant_no': m, 'api_key': pk, 'order_id': 'SIP-1001', 'amount': '149.90',
    'currency': 'TRY', 'coin': 'USDT', 'rnd': rnd, 'hash': sign([m, 'SIP-1001', '149.90', 'TRY', 'USDT', rnd])}).json()
# q['crypto_amount'], q['address'] → müşteriye göster; ödeme sonrası:
txid, rnd2 = '...', secrets.token_hex(8)
r = requests.post(base + '/direct-post/crypto', data={'merchant_no': m, 'api_key': pk, 'quote': q['quote'], 'txid': txid, 'rnd': rnd2,
    'hash': sign([m, q['quote'], txid, rnd2])}).json()

<?php
$secret = 'sk_live_XXXXXXXXXXXXXXXX';
$body = file_get_contents('php://input');
$sig = $_SERVER['HTTP_X_MONEYPAYZ_SIGNATURE'] ?? '';
if (!hash_equals('sha256=' . hash_hmac('sha256', $body, $secret), $sig)) { http_response_code(401); exit; }
$e = json_decode($body, true); // status, order_id, tid, amount, currency, method
// siparişi güncelleyin
http_response_code(200); echo 'OK';

# Kendi webhook adresinizi imzalı örnek istekle test edin
BODY='{"event":"payment.result","status":"success","order_id":"SIP-1001","amount":149.9,"currency":"TRY"}'
SIG=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac 'sk_live_XXXXXXXXXXXXXXXX' | sed 's/^.* //')
curl -X POST "https://siteniz.com/moneypayz-webhook" -H 'Content-Type: application/json' -H "X-MoneyPayz-Signature: sha256=$SIG" -d "$BODY"

const crypto = require('crypto'), express = require('express');
const secret = 'sk_live_XXXXXXXXXXXXXXXX', app = express();
app.post('/moneypayz-webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const sig = 'sha256=' + crypto.createHmac('sha256', secret).update(req.body).digest('hex');
  const got = req.get('X-MoneyPayz-Signature') || '';
  if (sig.length !== got.length || !crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(got))) return res.sendStatus(401);
  const e = JSON.parse(req.body); // status, order_id, tid, amount, currency
  res.send('OK');
});
app.listen(3000);

import hashlib, hmac, json
from flask import Flask, request
secret, app = 'sk_live_XXXXXXXXXXXXXXXX', Flask(__name__)
@app.post('/moneypayz-webhook')
def hook():
    sig = 'sha256=' + hmac.new(secret.encode(), request.get_data(), hashlib.sha256).hexdigest()
    if not hmac.compare_digest(sig, request.headers.get('X-MoneyPayz-Signature', '')):
        return '', 401
    e = json.loads(request.get_data())  # status, order_id, tid, amount, currency
    return 'OK'