Laravel Autopay

Autopay (formerly Blue Media) online payment gateway for Laravel: signed transaction start, ITN notifications with automatic confirmation, payment channel list and refunds. A maintained alternative to the abandoned official SDK.

Polska wersja dokumentacji

Installation

composer require beziworld/laravel-autopay
php artisan vendor:publish --tag=autopay-config   # optional

AUTOPAY_SERVICE_ID=123456
AUTOPAY_SHARED_KEY=your-shared-key
AUTOPAY_SANDBOX=true            # testpay.autopay.eu / pay.autopay.eu
AUTOPAY_HASH_ALGORITHM=sha256   # sha256 or sha512, as configured for the service

Set the ITN address of the service in the Autopay panel to https://your-app.com/autopay/itn (public HTTPS certificate required).

Payment flow

use Beziworld\Autopay\Data\TransactionRequest;
use Beziworld\Autopay\Facades\Autopay;

$request = new TransactionRequest(
    orderId: $order->number,           // 1-32 characters: letters, digits, "-" and "_"; unique per service
    amount: $order->total,             // "123.45", 123.45 or 123
    description: "Order {$order->number}",
    customerEmail: $order->email,
    gatewayId: null,                   // or a channel id from Autopay::gateways()
);

// a) background start (recommended): parameters never pass through the browser
return redirect()->away(Autopay::startTransaction($request));

// b) redirect with signed parameters
return redirect()->away(Autopay::redirectUrl($request));

// c) your own auto-submitted form
return view('pay', ['action' => Autopay::paymentUrl(), 'fields' => Autopay::parameters($request)]);

ITN

The package receives the ITN, verifies the hash and service id, dispatches events and answers with the signed confirmation XML. Authentic messages are confirmed (CONFIRMED); forged ones get NOTCONFIRMED.

use Beziworld\Autopay\Events\TransactionPaid;

Event::listen(function (TransactionPaid $event) {
    $transaction = $event->transaction;
    $order = Order::where('number', $transaction->orderId)->firstOrFail();

    if ($order->isPaid() || $transaction->amount !== number_format($order->total, 2, '.', '')) {
        return;
    }

    $order->markAsPaid(autopayRemoteId: $transaction->remoteId);
});

TransactionStatusChanged is dispatched for every status (PENDING, SUCCESS, FAILURE). Autopay repeats ITNs until confirmed and one order may have several transactions (remoteId), so listeners must be idempotent.

Return to the shop

Route::get('/payment/return', function (Request $request) {
    abort_unless(Autopay::verifyReturn($request->query()), 403);

    // The return only means the buyer came back; the status arrives with the ITN.
    return view('payment.thank-you', ['order' => $request->query('OrderID')]);
});

Payment channels and refunds

Autopay::gateways('PLN', 'PL');   // list<Gateway>: id, name, iconUrl, available, currencies; cache it for at least a minute
Autopay::refund($remoteId);                                  // full refund
Autopay::refund($remoteId, '20.00', 'PLN', $messageId);      // partial; $messageId (32 chars) makes it idempotent

Exceptions

ApiException (errorName(), e.g. INVALID_HASH, TRANSACTION_TOO_OLD_TO_REFUND), InvalidNotification and InvalidConfiguration, all extending AutopayException.

Development

composer install
composer ci   # pint --test, phpstan (level 8), pest

Author

Created and maintained by Kamil Ćwiertnia, beziworld.eu.

• E-mail: biuro@beziworld.eu
• Issues: GitHub issues
• Security vulnerabilities: see SECURITY.md

Need help integrating payments in your shop? Get in touch through beziworld.eu.

Other packages by the author

laravel-przelewy24 · laravel-tpay · laravel-payu · laravel-paynow · laravel-inpost

License

MIT. See LICENSE.md. This package is not affiliated with Autopay S.A.