EkstraPAY V2 is a payment gateway integration system that supports both deposit and withdraw operations. This documentation covers the complete integration process using Postman, including payment creation, transaction status checking, and callback handling.
\nThe API returns a status field (success or error) and a data.type field that indicates the transaction state. Use both fields together to determine the correct action.
$result = json_decode($response, true);\n$type = $result['data']['type'] ?? null;\nif ($result['status'] === 'success' && $type === 'new') {\n // New transaction created successfully.\n // Display bank details to the customer so they can complete the transfer.\n $iban = $result['data']['bank']['account_iban'];\n $holder = $result['data']['bank']['account_holder'];\n $amount = $result['data']['bank']['amount'];\n $txId = $result['data']['customer']['transaction_id'];\n} elseif ($result['status'] === 'error' && $type === 'on_process') {\n // Customer already has an active transaction.\n // Do not create a new request. Wait for the current one to complete or expire.\n $txId = $result['data']['customer']['transaction_id'];\n} elseif ($result['status'] === 'error' && $type === 'update') {\n // Amount changed — the existing transaction has been updated.\n // No new transaction was created. The same transaction_id is preserved.\n $txId = $result['data']['customer']['transaction_id'];\n $amount = $result['data']['bank']['amount'];\n} elseif ($result['status'] === 'error' && $type === null) {\n // Validation error. No transaction was created or modified.\n // Example: \"Amount must be between 100.00 ₺ and 100,000,000,000.00 ₺\"\n $errorMessage = $result['message'];\n}\n\n\n\nNote: When
\nstatusiserrorbutdatais present, it does not indicate a failure — it means the system returned an existing or updated transaction instead of creating a new one. Always checkdata.typeto determine the actual outcome.
{\n \"status\": true,\n \"message\": \"Callback Received\"\n}\n\n $hash = implode(\":\", array_filter([\n transaction_id,\n customer_fullname,\n customer_username,\n customer_id,\n customer_description,\n floatval(request_amount),\n floatval(request_final_amount)\n ], function($value) {\n return $value !== null && $value !== '';\n }));\n// Export. hashing encode\nhash = hash = hash(\"sha256\",$hash) \n\n/**\n * Validates transaction hash\n * \n * @param array $transactionDetail Transaction detail array\n * @param string $hashToValidate Hash value to validate\n * @return bool Returns true if hash is valid, false otherwise\n */\nfunction validateTransactionHash(array $transactionDetail, string $hashToValidate): bool\n{\n // Prepare values for hash generation\n $hashComponents = array_filter([\n $transactionDetail['transaction_id'] ?? null,\n $transactionDetail['customer_fullname'] ?? null,\n $transactionDetail['customer_username'] ?? null,\n $transactionDetail['customer_id'] ?? null,\n $transactionDetail['customer_description'] ?? null,\n isset($transactionDetail['request_amount']) ? floatval($transactionDetail['request_amount']) : null,\n isset($transactionDetail['request_final_amount']) ? floatval($transactionDetail['request_final_amount']) : null\n ], function($value) {\n return $value !== null && $value !== '';\n });\n // Join values with \":\"\n $hashString = implode(\":\", $hashComponents);\n // Generate SHA-256 hash\n $calculatedHash = hash(\"sha256\", $hashString);\n // Compare hashes (timing attack safe)\n return hash_equals($calculatedHash, $hashToValidate);\n}\n// Usage example:\n$transactionData = [\n 'transaction_id' => 'TRX-2024-001',\n 'customer_fullname' => 'John Smith',\n 'customer_username' => 'jsmith',\n 'customer_id' => 'CUST-789456',\n 'customer_description' => 'Monthly subscription payment',\n 'request_amount' => 250.00,\n 'request_final_amount' => 262.50\n];\n// Hash to validate (received from API or stored in DB)\n$receivedHash = '7f3a2b9c8d4e5f6a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4';\n// Validate the hash\nif (validateTransactionHash($transactionData, $receivedHash)) {\n echo \"Hash validation successful - Transaction is authentic!\";\n} else {\n echo \"Hash validation failed - Transaction may be tampered!\";\n}\n\nAfter the payment process, you needed to provide us with Deposit and Withdrawal Callback URLs to notify you of the payment status. Additionally, please send us your Whitelist IP addresses for access.
\nFor a complete integration, you must provide EkstraPAY with your callback URLs to receive real-time transaction updates:
\nDeposit Callback URL - Endpoint to receive deposit transaction status updates
\nWithdraw Callback URL - Endpoint to receive withdrawal transaction status updates
\nAfter creating a payment request, transactions go through the following status stages:
\n📝 Note: Sample PHP code for this request is included in the request page notes. Please refer to the PHP examples provided in the Postman collection or check the Pre-request Script tab for implementation details.
\nAll requests require the following authentication headers:
\nhttp
\nX-API-Key: your_api_key\nX-Timestamp: unix_timestamp\nX-Nonce: random_32_char_hex\nX-Signature: hmac_sha256_signature\nContent-Type: application/json\n\nThe Postman collection includes Pre-request Scripts that automatically:
\nGenerate timestamps and nonces
\nCalculate HMAC-SHA256 signatures
\nSet authentication headers
\nImportant: Review the Pre-request Script tab in Postman for each request to understand the signature generation process. The scripts contain comments explaining each step.
\nThe Postman collection includes an \"Example Callbacks\" folder containing:
\nSample deposit callback request
\nSample withdraw callback request
\nResponse validation examples
\nThe same endpoint handles both deposit and withdraw operations. The only difference between them is the JSON body — the URL, headers, and signature logic are identical for both.
\nEndpoint
\nPOST https://v2.ekstrapay.com/api/v1/payment/create\n\nHow the signature is built
\nEvery request must be signed. The signing process is the same regardless of programming language:
\nGet the current Unix timestamp in seconds (not milliseconds)
\nGenerate a random 32-character hex string as nonce
\nTake your raw JSON body and remove all fields that are empty string, null, or undefined
\nSerialize the cleaned object to a compact JSON string (no extra whitespace)
\nConcatenate the following four values separated by pipe |:
apiKey|timestamp|nonce|jsonString\n\nCompute HMAC-SHA256 of that string using your API secret as the key
\nThe resulting hex digest is your signature
\nRequired headers
\nRequest body — Deposit
\nRequest body — Withdraw
\nImplementation notes — critical
\nEmpty field stripping — Before signing, remove every field whose value is an empty string, null, or undefined. The server applies the same logic. If your JSON includes empty fields that the server stripped (or vice versa), the JSON strings won't match and the signature will fail.
\nJSON serialization — Serialize with Unicode characters unescaped. Characters like ş, ğ, ü, ı must appear as-is in the JSON string, not as \\uXXXX escape sequences. Both sides must produce byte-for-byte identical JSON.
Timestamp unit — Must be in seconds, not milliseconds. Using milliseconds will cause timestamp validation to fail on the server.
\nHMAC output format — The signature must be a lowercase hex string. Most HMAC libraries output this by default, but verify this in your language of choice.
\nPipe delimiter order is strict — The payload must be exactly apiKey|timestamp|nonce|jsonString. Any reordering or extra characters will produce a mismatched signature.
Replay attack protection — The combination of timestamp and nonce ensures each request is unique. Even if a valid signed request is intercepted, it cannot be reused because the timestamp will be considered stale and the nonce is single-use on the server side.
\nLanguage-specific HMAC-SHA256 references
\n","schema":"https://schema.getpostman.com/json/collection/v2.0.0/collection.json","toc":[{"content":"Response Handling","slug":"response-handling"},{"content":"Request Structure","slug":"request-structure"}],"owner":"14352549","collectionId":"da0ba46b-336c-4dd3-88d2-b8adfa5fef73","publishedId":"2sB3QMKUGL","public":true,"customColor":{"top-bar":"FFFFFF","right-sidebar":"303030","highlight":"303030"},"publishDate":"2025-10-12T16:57:46.000Z"},"item":[{"name":"Create Deposit","event":[{"listen":"prerequest","script":{"id":"73f44db9-da3b-432e-b10c-e96bd1ac1f31","exec":["const apiKey = pm.variables.get(\"apiKey\");","const apiSecret = pm.variables.get(\"apiSecret\");"," ","const timestamp = Math.floor(Date.now() / 1000);","const nonce = CryptoJS.lib.WordArray.random(16).toString();"," ","let requestBody = {};","if (pm.request.body && pm.request.body.raw) {"," try {"," requestBody = JSON.parse(pm.request.body.raw);"," } catch(e) {"," console.error(\"JSON parse error:\", e);"," requestBody = {};"," }","}"," ","const cleanedBody = {};","Object.keys(requestBody).forEach(key => {"," if (requestBody[key] !== \"\" && requestBody[key] !== null && requestBody[key] !== undefined) {"," cleanedBody[key] = requestBody[key];"," }","});"," ","const jsonString = JSON.stringify(cleanedBody);","","const payload = [ apiKey, timestamp, nonce, jsonString ].join('|');","","const signature = CryptoJS.HmacSHA256(payload, apiSecret).toString();","","pm.request.headers.add({key: 'X-API-Key', value: apiKey});","pm.request.headers.add({key: 'X-Timestamp', value: timestamp.toString()});","pm.request.headers.add({key: 'X-Nonce', value: nonce});","pm.request.headers.add({key: 'X-Signature', value: signature});","pm.request.headers.add({key: 'Content-Type', value: 'application/json'});"],"type":"text/javascript","packages":{},"requests":{}}}],"id":"604e7f58-ba2a-4f37-aa98-e21fc20aee01","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"noauth","isInherited":false},"method":"POST","header":[{"key":"Content-Type","value":"application/json","type":"text"},{"key":"X-API-Key","value":"","type":"text"},{"key":"X-Timestamp","value":"","type":"text"},{"key":"X-Nonce","value":"","type":"text"},{"key":"X-Signature","value":"","type":"text"}],"body":{"mode":"raw","raw":"{\n \"operation\": \"deposit\",\n \"order_id\": \"\",\n \"amount\": 100,\n \"customer_fullname\": \"Lorem IPSUM\",\n \"customer_username\": \"required12\",\n \"customer_id\": \"required12\",\n \"customer_email\": \"\",\n \"customer_description\": \"\",\n \"customer_hash\": \"\",\n \"customer_phone\": \"\",\n \"customer_gender\": \"\",\n \"customer_site\": \"\"\n}\n"},"url":"/api/v1/payment/create","description":"Following the Pre-request Script tab in Postman or check the below the example
\noperation: Transaction type - must be \"deposit\" for payment collection
amount: Deposit amount (decimal number)
customer_id: Unique customer identifier in your system
customer_fullname: Customer's full name
customer_username: Customer's username in your platform
customer_description: Additional notes about the transaction
customer_hash: Custom verification hash for extra security
customer_phone: Customer's phone number
customer_email: Customer's email address
customer_gender: Customer gender (M/F)
customer_site: Platform or site identifier
order_id: This is custom and optional your transaction or order ID must be string
Please add : api_key and api_secret
EXAMPLE :
\n/**\n * EKSTRAPAY API - DEPOSIT OPERATION\n * \n * Complete PHP implementation for deposit (payment collection) transactions\n * This example shows how to create a deposit request with Ekstrapay API\n * \n * @version 1.0\n * @api https://v2.ekstrapay.com/api/v1/payment/create\n */\n/**\n * Function to send DEPOSIT request to Ekstrapay API\n * \n * This function handles the complete process of creating a deposit request\n * including authentication signature generation and API communication\n * \n * @param string $apiKey The API key provided by Ekstrapay\n * @param string $apiSecret The API secret key for HMAC signature generation\n * @param array $data Deposit data to be sent to the API\n * @return array Returns array with success status and response data or error details\n */\nfunction ekstrapayDepositCreate($apiKey, $apiSecret, $data) {\n // Define the API endpoint URL for payment creation\n $url = 'https://v2.ekstrapay.com/api/v1/payment/create';\n // Generate current timestamp in seconds (Unix timestamp)\n // This is used for request validation and replay attack prevention\n $timestamp = time();\n // Generate a unique nonce (number used once) - 16 bytes converted to hex string\n // Nonce ensures each request is unique, preventing replay attacks\n $nonce = bin2hex(random_bytes(16));\n // Remove empty values from the data array\n // This ensures we don't send empty or null fields to the API\n $cleanedData = array_filter($data, function($value) {\n return $value !== \"\" && $value !== null;\n });\n // Convert the cleaned data array to JSON string format\n $jsonString = json_encode($cleanedData,JSON_UNESCAPED_UNICODE);\n // Create the payload for signature generation\n // The payload consists of: API key | timestamp | nonce | JSON data\n // Pipe character (|) is used as delimiter between components\n $payload = implode('|', [\n $apiKey,\n $timestamp,\n $nonce,\n $jsonString\n ]);\n // Generate HMAC-SHA256 signature using the payload and API secret\n // This signature verifies the authenticity and integrity of the request\n $signature = hash_hmac('sha256', $payload, $apiSecret);\n // Prepare HTTP headers for the API request\n // These headers include authentication credentials and content type\n $headers = [\n 'X-API-Key: ' . $apiKey, // API key for identification\n 'X-Timestamp: ' . $timestamp, // Request timestamp\n 'X-Nonce: ' . $nonce, // Unique request identifier\n 'X-Signature: ' . $signature, // HMAC signature for verification\n 'Content-Type: application/json' // Specify JSON content type\n ];\n // Initialize cURL session for HTTP communication\n $ch = curl_init();\n // Configure cURL options for the API request\n curl_setopt($ch, CURLOPT_URL, $url); // Set target URL\n curl_setopt($ch, CURLOPT_POST, 1); // Enable POST method\n curl_setopt($ch, CURLOPT_POSTFIELDS, $jsonString); // Attach JSON payload\n curl_setopt($ch, CURLOPT_HTTPHEADER, $headers); // Set custom headers\n curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); // Return response as string\n curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true); // Enable SSL verification for production\n curl_setopt($ch, CURLOPT_TIMEOUT, 30); // Set 30 seconds timeout\n // Execute the API request and capture the response\n $response = curl_exec($ch);\n // Check for cURL execution errors\n if (curl_errno($ch)) {\n // Get the error message\n $error = curl_error($ch);\n // Close the cURL session\n curl_close($ch);\n // Return error information in standardized format\n return [\n 'success' => false,\n 'error' => 'cURL Error: ' . $error\n ];\n }\n // Get the HTTP response status code\n $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);\n // Close the cURL session to free resources\n curl_close($ch);\n // Parse the JSON response into PHP array\n $decodedResponse = json_decode($response, true);\n // Check HTTP status code and return appropriate response\n if ($httpCode == 200) {\n // Success - HTTP 200 OK\n return [\n 'success' => true,\n 'data' => $decodedResponse\n ];\n } else {\n // Error - Return error details with HTTP code\n return [\n 'success' => false,\n 'http_code' => $httpCode,\n 'response' => $decodedResponse ?: $response\n ];\n }\n}\n// ===========================================================================================\n// USAGE EXAMPLE FOR DEPOSIT\n// ===========================================================================================\n// API credentials (store these securely in environment variables in production)\n$apiKey = \"YOUR_API_KEY_HERE\"; // Replace with your actual Ekstrapay API key\n$apiSecret = \"YOUR_API_SECRET_HERE\"; // Replace with your actual Ekstrapay API secret\n// Prepare deposit data with all required and optional fields\n$depositData = [\n // REQUIRED FIELDS\n \"operation\" => \"deposit\", // Transaction type - MUST be \"deposit\"\n \"amount\" => 250.00, // Deposit amount (decimal number)\n \"customer_id\" => \"USR_20251012_001\", // Unique customer ID in your system\n \"customer_fullname\" => \"John Smith\", // Customer's full name\n \"customer_username\" => \"johnsmith123\", // Customer's username in your platform\n // OPTIONAL FIELDS\n \"customer_description\" => \"Premium account deposit\", // Transaction description\n \"customer_hash\" => \"abc123xyz789\", // Custom verification hash\n \"customer_phone\" => \"+1234567890\", // Customer's phone number\n \"customer_email\" => \"john.smith@email.com\", // Customer's email address\n \"customer_gender\" => \"male\", // Customer gender (male/female)\n \"customer_site\" => \"Main Platform\" , // Platform or site identifier\n \"order_id\" => \"custom_your_id\" // Custom Order ID\n];\n// Execute the deposit request\n$result = ekstrapayDepositCreate($apiKey, $apiSecret, $depositData);\n// Handle the response\nprint_r($result);\n\nFollowing the Pre-request Script tab in Postman or check the below the example
\noperation: Transaction type - must be \"withdraw\" for payment collection
amount: Deposit amount (decimal number)
customer_id: Unique customer identifier in your system
customer_fullname: Customer's full name
customer_username: Customer's username in your platform
account_holder: Receiver iban owner
account_iban: Receiver iban number
customer_description: Additional notes about the transaction
customer_hash: Custom verification hash for extra security
customer_phone: Customer's phone number
customer_email: Customer's email address
customer_gender: Customer gender (M/F)
customer_site: Platform or site identifier
order_id: This is custom and optional your transaction or order ID must be string
Please add : api_key and api_secret
EXAMPLE :
\n/**\n * EKSTRAPAY API - WITHDRAW OPERATION\n * \n * Complete PHP implementation for withdraw (payout) transactions\n * This example shows how to create a withdraw request with Ekstrapay API\n * \n * @version 1.0\n * @api https://v2.ekstrapay.com/api/v1/payment/create\n */\n/**\n * Function to send WITHDRAW request to Ekstrapay API\n * \n * This function handles the complete process of creating a withdraw request\n * including authentication signature generation and API communication\n * \n * @param string $apiKey The API key provided by Ekstrapay\n * @param string $apiSecret The API secret key for HMAC signature generation\n * @param array $data Withdraw data to be sent to the API\n * @return array Returns array with success status and response data or error details\n */\nfunction ekstrapayWithdrawCreate($apiKey, $apiSecret, $data) {\n // Define the API endpoint URL for payment creation\n $url = 'https://v2.ekstrapay.com/api/v1/payment/create';\n // Generate current timestamp in seconds (Unix timestamp)\n // This is used for request validation and replay attack prevention\n $timestamp = time();\n // Generate a unique nonce (number used once) - 16 bytes converted to hex string\n // Nonce ensures each request is unique, preventing replay attacks\n $nonce = bin2hex(random_bytes(16));\n // Remove empty values from the data array\n // This ensures we don't send empty or null fields to the API\n $cleanedData = array_filter($data, function($value) {\n return $value !== \"\" && $value !== null;\n });\n // Convert the cleaned data array to JSON string format\n $jsonString = json_encode($cleanedData,JSON_UNESCAPED_UNICODE);\n // Create the payload for signature generation\n // The payload consists of: API key | timestamp | nonce | JSON data\n // Pipe character (|) is used as delimiter between components\n $payload = implode('|', [\n $apiKey,\n $timestamp,\n $nonce,\n $jsonString\n ]);\n // Generate HMAC-SHA256 signature using the payload and API secret\n // This signature verifies the authenticity and integrity of the request\n $signature = hash_hmac('sha256', $payload, $apiSecret);\n // Prepare HTTP headers for the API request\n // These headers include authentication credentials and content type\n $headers = [\n 'X-API-Key: ' . $apiKey, // API key for identification\n 'X-Timestamp: ' . $timestamp, // Request timestamp\n 'X-Nonce: ' . $nonce, // Unique request identifier\n 'X-Signature: ' . $signature, // HMAC signature for verification\n 'Content-Type: application/json' // Specify JSON content type\n ];\n // Initialize cURL session for HTTP communication\n $ch = curl_init();\n // Configure cURL options for the API request\n curl_setopt($ch, CURLOPT_URL, $url); // Set target URL\n curl_setopt($ch, CURLOPT_POST, 1); // Enable POST method\n curl_setopt($ch, CURLOPT_POSTFIELDS, $jsonString); // Attach JSON payload\n curl_setopt($ch, CURLOPT_HTTPHEADER, $headers); // Set custom headers\n curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); // Return response as string\n curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true); // Enable SSL verification for production\n curl_setopt($ch, CURLOPT_TIMEOUT, 30); // Set 30 seconds timeout\n // Execute the API request and capture the response\n $response = curl_exec($ch);\n // Check for cURL execution errors\n if (curl_errno($ch)) {\n // Get the error message\n $error = curl_error($ch);\n // Close the cURL session\n curl_close($ch);\n // Return error information in standardized format\n return [\n 'success' => false,\n 'error' => 'cURL Error: ' . $error\n ];\n }\n // Get the HTTP response status code\n $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);\n // Close the cURL session to free resources\n curl_close($ch);\n // Parse the JSON response into PHP array\n $decodedResponse = json_decode($response, true);\n // Check HTTP status code and return appropriate response\n if ($httpCode == 200) {\n // Success - HTTP 200 OK\n return [\n 'success' => true,\n 'data' => $decodedResponse\n ];\n } else {\n // Error - Return error details with HTTP code\n return [\n 'success' => false,\n 'http_code' => $httpCode,\n 'response' => $decodedResponse ?: $response\n ];\n }\n}\n// ===========================================================================================\n// USAGE EXAMPLE FOR WITHDRAW\n// ===========================================================================================\n// API credentials (store these securely in environment variables in production)\n$apiKey = \"YOUR_API_KEY_HERE\"; // Replace with your actual Ekstrapay API key\n$apiSecret = \"YOUR_API_SECRET_HERE\"; // Replace with your actual Ekstrapay API secret\n// Prepare withdraw data with all required and optional fields\n$withdrawData = [\n // REQUIRED FIELDS\n \"operation\" => \"withdraw\", // Transaction type - MUST be \"withdraw\"\n \"amount\" => 500.00, // Withdraw amount (decimal number)\n \"customer_id\" => \"USR_20251012_002\", // Unique customer ID in your system\n \"customer_fullname\" => \"Jane Doe\", // Customer's full name\n \"customer_username\" => \"janedoe456\", // Customer's username in your platform\n \"account_holder\" => \"Jane Elizabeth Doe\", // IBAN account holder's full name\n \"account_iban\" => \"TR330006100519786457841326\", // Receiver's IBAN number\n // OPTIONAL FIELDS\n \"customer_description\" => \"Withdraw request - Earnings payout\", // Transaction description\n \"customer_hash\" => \"xyz789abc123\", // Custom verification hash\n \"customer_phone\" => \"+9876543210\", // Customer's phone number\n \"customer_email\" => \"jane.doe@email.com\", // Customer's email address\n \"customer_gender\" => \"male\", // Customer gender (male/female)\n \"customer_site\" => \"Main Platform\" , // Platform or site identifier\n \"order_id\" => \"custom_your_id\" // Custom Order ID\n];\n// Execute the withdraw request\n$result = ekstrapayWithdrawCreate($apiKey, $apiSecret, $withdrawData);\n// Handle the response\nprint_r($result);\n?>\n\nFollowing the Pre-request Script tab in Postman or check the below the example
\noperation: Transaction type - must be \"withdraw/deposit\" for payment collection
transaction_id: Customer transaction id
Please add : api_key and api_secret
EXAMPLE :
\n/**\n * EKSTRAPAY API - PAYMENT STATUS CHECK\n * \n * Automatic Signature Generation with Pre-request Script\n * Following the Pre-request Script tab in Postman or check the below example\n * \n * 📝 Field Descriptions for Payment Check Operation\n * \n * Required Fields:\n * - operation: Transaction type - \"deposit\" or \"withdraw\" \n * - transaction_id: The transaction ID returned from payment creation\n * \n * Please add: api_key and api_secret\n * \n * @version 1.0\n * @api https://v2.ekstrapay.com/api/v1/payment/check\n */\n/**\n * Function to check payment status from Ekstrapay API\n * \n * This function handles the complete process of checking payment status\n * including authentication signature generation and API communication\n * \n * @param string $apiKey The API key provided by Ekstrapay\n * @param string $apiSecret The API secret key for HMAC signature generation\n * @param array $data Payment check data to be sent to the API\n * @return array Returns array with success status and response data or error details\n */\nfunction ekstrapayPaymentCheck($apiKey, $apiSecret, $data) {\n // Define the API endpoint URL for payment status check\n $url = 'https://v2.ekstrapay.com/api/v1/payment/check';\n // Generate current timestamp in seconds (Unix timestamp)\n // This is used for request validation and replay attack prevention\n $timestamp = time();\n // Generate a unique nonce (number used once) - 16 bytes converted to hex string\n // Nonce ensures each request is unique, preventing replay attacks\n $nonce = bin2hex(random_bytes(16));\n // Remove empty values from the data array\n // This ensures we don't send empty or null fields to the API\n $cleanedData = array_filter($data, function($value) {\n return $value !== \"\" && $value !== null;\n });\n // Convert the cleaned data array to JSON string format\n $jsonString = json_encode($cleanedData);\n // Create the payload for signature generation\n // The payload consists of: API key | timestamp | nonce | JSON data\n // Pipe character (|) is used as delimiter between components\n $payload = implode('|', [\n $apiKey,\n $timestamp,\n $nonce,\n $jsonString\n ]);\n // Generate HMAC-SHA256 signature using the payload and API secret\n // This signature verifies the authenticity and integrity of the request\n $signature = hash_hmac('sha256', $payload, $apiSecret);\n // Prepare HTTP headers for the API request\n // These headers include authentication credentials and content type\n $headers = [\n 'X-API-Key: ' . $apiKey, // API key for identification\n 'X-Timestamp: ' . $timestamp, // Request timestamp\n 'X-Nonce: ' . $nonce, // Unique request identifier\n 'X-Signature: ' . $signature, // HMAC signature for verification\n 'Content-Type: application/json' // Specify JSON content type\n ];\n // Initialize cURL session for HTTP communication\n $ch = curl_init();\n // Configure cURL options for the API request\n curl_setopt($ch, CURLOPT_URL, $url); // Set target URL\n curl_setopt($ch, CURLOPT_POST, 1); // Enable POST method\n curl_setopt($ch, CURLOPT_POSTFIELDS, $jsonString); // Attach JSON payload\n curl_setopt($ch, CURLOPT_HTTPHEADER, $headers); // Set custom headers\n curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); // Return response as string\n curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // Disable SSL verification (use with caution in production)\n curl_setopt($ch, CURLOPT_TIMEOUT, 30); // Set 30 seconds timeout\n // Execute the API request and capture the response\n $response = curl_exec($ch);\n // Check for cURL execution errors\n if (curl_errno($ch)) {\n // Get the error message\n $error = curl_error($ch);\n // Close the cURL session\n curl_close($ch);\n // Return error information in standardized format\n return [\n 'success' => false,\n 'error' => 'cURL Error: ' . $error\n ];\n }\n // Get the HTTP response status code\n $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);\n // Close the cURL session to free resources\n curl_close($ch);\n // Parse the JSON response into PHP array\n $decodedResponse = json_decode($response, true);\n // Check HTTP status code and return appropriate response\n if ($httpCode == 200) {\n // Success - HTTP 200 OK\n return [\n 'success' => true,\n 'data' => $decodedResponse\n ];\n } else {\n // Error - Return error details with HTTP code\n return [\n 'success' => false,\n 'http_code' => $httpCode,\n 'response' => $decodedResponse ?: $response // Return decoded JSON or raw response if JSON decode fails\n ];\n }\n}\n// Usage example demonstrating how to use the function\n// API credentials (these should be stored securely, not hardcoded)\n$apiKey = \"\"; // Your Ekstrapay API key\n$apiSecret = \"\"; // Your Ekstrapay API secret\n// ===========================================================================================\n// EXAMPLE 1: CHECK DEPOSIT TRANSACTION STATUS\n// ===========================================================================================\n// Prepare payment check data for DEPOSIT transaction\n$depositCheckData = [\n \"operation\" => \"deposit\", // Operation type (deposit)\n \"transaction_id\" => \"5b35ddae-a492-49d2-8957-47504df22b10\" // Transaction ID from payment creation\n];\n// Call the payment check function for deposit\n$depositResult = ekstrapayPaymentCheck($apiKey, $apiSecret, $depositCheckData);\n// Output the deposit check result for debugging/verification\necho \"DEPOSIT STATUS CHECK RESULT:\\n\";\necho \"============================\\n\";\nprint_r($depositResult);\n\nCancels an open transaction. Automatic signature generation with a Pre-request Script — follow the Pre-request Script tab in Postman, or use the example below.
\nEndpoint
\nPOST https://v2.ekstrapay.com/api/v1/payment/cancel\n\nRequired fields
\nAdd your api_key and api_secret to the example before running it.
Only transactions that have not reached a final state can be cancelled.
\nAdditional notes:
\nWithdraw is not supported. Sending \"operation\": \"withdraw\" returns an error. Withdrawals cannot be cancelled over the API.
Transactions under review cannot be cancelled. If a transaction has been flagged for internal review, the request is rejected and you should contact support.
\nCredit refund. When your API service runs in credit mode, the full request_amount is returned to your credit balance as part of the cancellation. The refund and the status change happen together — either both apply or neither does.
A cancellation callback is dispatched to your configured callback URL, the same way approvals and rejections are.
\nConcurrency. A transaction can only be processed by one operation at a time. If the transaction is being acted on at that moment, the request is rejected and can be retried after a few seconds. Cancelling an already-cancelled transaction never refunds credit twice.
\nThe response envelope matches /payment/check. The data object contains:
When the status is final, the error payload also carries the current status and \"type\": \"not_cancellable\", so you can branch on it without a separate /payment/check call.
/**\n * EKSTRAPAY API - PAYMENT CANCEL\n *\n * Automatic Signature Generation with Pre-request Script\n * Following the Pre-request Script tab in Postman or check the below example\n *\n * Required Fields:\n * - operation: Transaction type - \"deposit\"\n * - transaction_id: The transaction ID returned from payment creation\n *\n * Please add: api_key and api_secret\n *\n * @version 1.0\n * @api https://v2.ekstrapay.com/api/v1/payment/cancel\n */\n/**\n * Function to cancel an open payment via the Ekstrapay API\n *\n * This function handles the complete process of cancelling a transaction\n * including authentication signature generation and API communication\n *\n * @param string $apiKey The API key provided by Ekstrapay\n * @param string $apiSecret The API secret key for HMAC signature generation\n * @param array $data Cancellation data to be sent to the API\n * @return array Returns array with success status and response data or error details\n */\nfunction ekstrapayPaymentCancel($apiKey, $apiSecret, $data) {\n // Define the API endpoint URL for payment cancellation\n $url = 'https://v2.ekstrapay.com/api/v1/payment/cancel';\n // Generate current timestamp in seconds (Unix timestamp)\n // This is used for request validation and replay attack prevention\n $timestamp = time();\n // Generate a unique nonce (number used once) - 16 bytes converted to hex string\n // Nonce ensures each request is unique, preventing replay attacks\n $nonce = bin2hex(random_bytes(16));\n // Remove empty values from the data array\n // This ensures we don't send empty or null fields to the API\n $cleanedData = array_filter($data, function($value) {\n return $value !== \"\" && $value !== null;\n });\n // Convert the cleaned data array to JSON string format\n $jsonString = json_encode($cleanedData);\n // Create the payload for signature generation\n // The payload consists of: API key | timestamp | nonce | JSON data\n // Pipe character (|) is used as delimiter between components\n $payload = implode('|', [\n $apiKey,\n $timestamp,\n $nonce,\n $jsonString\n ]);\n // Generate HMAC-SHA256 signature using the payload and API secret\n // This signature verifies the authenticity and integrity of the request\n $signature = hash_hmac('sha256', $payload, $apiSecret);\n // Prepare HTTP headers for the API request\n $headers = [\n 'X-API-Key: ' . $apiKey, // API key for identification\n 'X-Timestamp: ' . $timestamp, // Request timestamp\n 'X-Nonce: ' . $nonce, // Unique request identifier\n 'X-Signature: ' . $signature, // HMAC signature for verification\n 'Content-Type: application/json' // Specify JSON content type\n ];\n // Initialize cURL session for HTTP communication\n $ch = curl_init();\n // Configure cURL options for the API request\n curl_setopt($ch, CURLOPT_URL, $url); // Set target URL\n curl_setopt($ch, CURLOPT_POST, 1); // Enable POST method\n curl_setopt($ch, CURLOPT_POSTFIELDS, $jsonString); // Attach JSON payload\n curl_setopt($ch, CURLOPT_HTTPHEADER, $headers); // Set custom headers\n curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); // Return response as string\n curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true); // Keep SSL verification enabled\n curl_setopt($ch, CURLOPT_TIMEOUT, 30); // Set 30 seconds timeout\n // Execute the API request and capture the response\n $response = curl_exec($ch);\n // Check for cURL execution errors\n if (curl_errno($ch)) {\n $error = curl_error($ch);\n curl_close($ch);\n return [\n 'success' => false,\n 'error' => 'cURL Error: ' . $error\n ];\n }\n // Get the HTTP response status code\n $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);\n // Close the cURL session to free resources\n curl_close($ch);\n // Parse the JSON response into PHP array\n $decodedResponse = json_decode($response, true);\n // Check HTTP status code and return appropriate response\n if ($httpCode == 200) {\n return [\n 'success' => true,\n 'data' => $decodedResponse\n ];\n }\n return [\n 'success' => false,\n 'http_code' => $httpCode,\n 'response' => $decodedResponse ?: $response\n ];\n}\n// ===========================================================================================\n// Usage example\n// ===========================================================================================\n// API credentials (these should be stored securely, not hardcoded)\n$apiKey = \"\"; // Your Ekstrapay API key\n$apiSecret = \"\"; // Your Ekstrapay API secret\n// ===========================================================================================\n// EXAMPLE 1: CANCEL A DEPOSIT TRANSACTION\n// ===========================================================================================\n$depositCancelData = [\n \"operation\" => \"deposit\", // Operation type (deposit)\n \"transaction_id\" => \"5b35ddae-a492-49d2-8957-47504df22b10\" // Transaction ID from payment creation\n];\n$depositResult = ekstrapayPaymentCancel($apiKey, $apiSecret, $depositCancelData);\necho \"DEPOSIT CANCEL RESULT:\\n\";\necho \"======================\\n\";\nprint_r($depositResult);\n\nRetry behaviour. If the request times out on your side, do not assume it failed. Retry the cancel call — a transaction already in PAY_CANCELLED returns the not_cancellable error rather than refunding a second time, so a retry is safe. If you need the outcome without triggering an error, call /payment/check instead.
Cancel vs. abandon. Cancelling releases the credit reserved for the transaction back to your balance. Leaving a transaction open until it times out does not, so cancel any transaction the customer walks away from.
\nRace with approval. A transaction sitting in PAY_PROCESSING may be approved by an operator at the same moment you cancel it. Whichever arrives first wins; the other receives an error. Always treat the response of the cancel call as authoritative rather than assuming the cancellation succeeded.