Yoursafe

Implement FlexPay

FlexPay sends the buyer to a hosted order page. Your server signs the redirect and handles postbacks. For iDEAL into a Yoursafe Business Account, follow the Yoursafe Direct skill instead. If this skill and a product page disagree, follow the product page.

Read first

  1. FlexPay — the purchase or subscription call, then postbacks, then signature calculation
  2. FlexPay plugins when the store is WooCommerce or OpenCart

Use the official PHP or Java client when you can. The library builds the signature.

Implement in this order

  1. Take shopID and the FlexPay signature key from the Control Center website.
  2. Choose the processor host for the brand: secure.verotel.com, secure.billing.creditcard, or secure.gaycharge.com.
  3. Redirect the buyer with GET /startorder. version is 4. type is purchase or subscription.
  4. Publish a postback URL that validates the signature, records the sale, and answers.
  5. Treat the browser return as a hint. The postback is the sale record.

Credentials

  • Shop ID (website ID) and FlexPay signature key from the Control Center.
  • Merchant ID when the client library selects the brand from it.
  • Postback URL saved on that website. A plugin install still needs the shop ID, signature key, and postback URL checked before go-live.

Traps

  • The signature is hex SHA-256 of a UTF-8 string. Start with the signature key, then the parameters in alphabetical order by name, joined as :name=value. Include an optional parameter only when it has a value.
  • On startorder, leave email out of the signature, even when you send it.
  • Postbacks arrive as GET. Verify the signature before you trust the fields.
  • The postback response is HTTP 200 and the plain text OK, within 30 seconds. For card payments, a missing OK starts an automatic refund.
  • version is 4. A different version is part of the signed string, so the signature no longer matches.

Done when

A signed /startorder opens the hosted page, a success postback verifies, and the handler returns OK with status 200.

Reference