MAGICPAY INR API

<?php
function rp_sign(array $p, string $key): string {
    unset($p['sign']);
    $p = array_filter($p, fn($v) => $v !== '' && $v !== null);   // empty values are not signed
    ksort($p, SORT_STRING);                                      // sort by parameter name
    $pairs = [];
    foreach ($p as $k => $v) $pairs[] = $k . '=' . $v;
    return strtoupper(md5(implode('&', $pairs) . '&key=' . $key));
}

$base = 'https://gamio.site/api/v3';
$p = [
    'mchId'      => 'YOUR_MERCHANT_ID',
    'mchOrderNo' => 'ORDER-1001',                 // your unique order number
    'amount'     => '500.00',
    'tradeType'  => 'INRUPI',                     // or 'usdt'
    'notifyUrl'  => 'https://merchant.example.com/webhook/reddypay',
    'returnUrl'  => 'https://merchant.example.com/thanks',
];
$p['sign'] = rp_sign($p, 'YOUR_API_KEY');         // mchKey

$ch = curl_init("$base/payin");
curl_setopt_array($ch, [CURLOPT_POST => true, CURLOPT_RETURNTRANSFER => true, CURLOPT_TIMEOUT => 30,
    CURLOPT_HTTPHEADER => ['Content-Type: application/json'], CURLOPT_POSTFIELDS => json_encode($p)]);
$res = json_decode(curl_exec($ch), true);
if (!empty($res['success'])) {
    header('Location: ' . $res['data']['pay_url']);   // our hosted checkout: send the customer there
} else {
    error_log($res['error'] . ': ' . $res['message']);
}

const crypto = require('crypto');
function rpSign(p, key) {
  const s = Object.keys(p)
    .filter(k => k !== 'sign' && p[k] !== '' && p[k] != null)   // empty values are not signed
    .sort()                                                      // sort by parameter name
    .map(k => `${k}=${p[k]}`).join('&');
  return crypto.createHash('md5').update(`${s}&key=${key}`).digest('hex').toUpperCase();
}

const p = {
  mchId: 'YOUR_MERCHANT_ID',
  mchOrderNo: 'ORDER-1001',                 // your unique order number
  amount: '500.00',
  tradeType: 'INRUPI',                      // or 'usdt'
  notifyUrl: 'https://merchant.example.com/webhook/reddypay',
  returnUrl: 'https://merchant.example.com/thanks',
};
p.sign = rpSign(p, 'YOUR_API_KEY');         // mchKey

const res = await fetch('https://gamio.site/api/v3/payin', {
  method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(p),
}).then(r => r.json());
if (res.success) console.log('redirect the customer to', res.data.pay_url);
else console.error(res.error, res.message);

import hashlib

def rp_sign(p, key):
    s = '&'.join(f'{k}={p[k]}' for k in sorted(p)
                 if k != 'sign' and p[k] not in ('', None))      # sorted, empty values skipped
    return hashlib.md5(f'{s}&key={key}'.encode()).hexdigest().upper()

import requests

p = {
    'mchId': 'YOUR_MERCHANT_ID',
    'mchOrderNo': 'ORDER-1001',             # your unique order number
    'amount': '500.00',
    'tradeType': 'INRUPI',                  # or 'usdt'
    'notifyUrl': 'https://merchant.example.com/webhook/reddypay',
    'returnUrl': 'https://merchant.example.com/thanks',
}
p['sign'] = rp_sign(p, 'YOUR_API_KEY')      # mchKey

res = requests.post('https://gamio.site/api/v3/payin', json=p, timeout=30).json()
if res.get('success'):
    print('redirect the customer to', res['data']['pay_url'])
else:
    print(res.get('error'), res.get('message'))

# sign: sorted "name=value" pairs joined with &, then &key=KEY -> MD5 -> upper case
rp_sign() { printf '%s' "$1&key=$2" | md5sum | cut -d' ' -f1 | tr 'a-f' 'A-F'; }   # macOS: md5 -q
MCH_ID='YOUR_MERCHANT_ID'; KEY='YOUR_API_KEY'            # mchKey
SIGN=$(rp_sign "amount=500.00&mchId=$MCH_ID&mchOrderNo=ORDER-1001&notifyUrl=https://merchant.example.com/webhook/reddypay&tradeType=INRUPI" "$KEY")

curl -sS -X POST 'https://gamio.site/api/v3/payin' -H 'Content-Type: application/json' -d "{
  \"mchId\": \"$MCH_ID\", \"mchOrderNo\": \"ORDER-1001\", \"amount\": \"500.00\", \"tradeType\": \"INRUPI\",
  \"notifyUrl\": \"https://merchant.example.com/webhook/reddypay\", \"sign\": \"$SIGN\"
}"

{
    "code": 200,
    "success": true,
    "message": "Success",
    "data": {
        "orderNo": "RP2610011449406340360",
        "mchOrderNo": "ORDER-1001",
        "amount": "500.00",
        "fee": "55.00",
        "netAmount": "445.00",
        "paidAmount": null,
        "tradeType": "INRUPI",
        "status": "pending",
        "utr": null,
        "pay_url": "https://gamio.site/pay/48568a0be2cab05e6a49",
        "payUrl": "https://gamio.site/pay/48568a0be2cab05e6a49",
        "extra": "",
        "createdAt": "2026-10-01T14:49:40+05:30",
        "expiresAt": "2026-10-01T15:19:40+05:30",
        "paidAt": null
    }
}

{
    "code": 200,
    "success": true,
    "message": "Success",
    "data": {
        "tradeType": "usdt",
        "usdtAmount": "5.640000",
        "rate": "88.6500",
        "address": "TXYZ…YourReceivingAddress",
        "network": "TRC20",
        "orderNo": "RP2610011449406340360",
        "mchOrderNo": "ORDER-1001",
        "amount": "500.00",
        "fee": "55.00",
        "netAmount": "445.00",
        "paidAmount": null,
        "status": "pending",
        "utr": null,
        "pay_url": "https://gamio.site/pay/48568a0be2cab05e6a49",
        "payUrl": "https://gamio.site/pay/48568a0be2cab05e6a49",
        "extra": "",
        "createdAt": "2026-10-01T14:49:40+05:30",
        "expiresAt": "2026-10-01T15:19:40+05:30",
        "paidAt": null
    }
}

<?php
function rp_sign(array $p, string $key): string {
    unset($p['sign']);
    $p = array_filter($p, fn($v) => $v !== '' && $v !== null);   // empty values are not signed
    ksort($p, SORT_STRING);                                      // sort by parameter name
    $pairs = [];
    foreach ($p as $k => $v) $pairs[] = $k . '=' . $v;
    return strtoupper(md5(implode('&', $pairs) . '&key=' . $key));
}

$p = ['mchId' => 'YOUR_MERCHANT_ID', 'mchOrderNo' => 'ORDER-1001'];   // or 'orderNo' => our order number
$p['sign'] = rp_sign($p, 'YOUR_API_KEY');                   // mchKey = pay-in order

$ch = curl_init('https://gamio.site/api/v3/check-order-status');
curl_setopt_array($ch, [CURLOPT_POST => true, CURLOPT_RETURNTRANSFER => true, CURLOPT_TIMEOUT => 30,
    CURLOPT_HTTPHEADER => ['Content-Type: application/json'], CURLOPT_POSTFIELDS => json_encode($p)]);
$res = json_decode(curl_exec($ch), true);
echo $res['data']['status'] ?? $res['message'];             // pending | success | failed | expired

const crypto = require('crypto');
function rpSign(p, key) {
  const s = Object.keys(p)
    .filter(k => k !== 'sign' && p[k] !== '' && p[k] != null)   // empty values are not signed
    .sort()                                                      // sort by parameter name
    .map(k => `${k}=${p[k]}`).join('&');
  return crypto.createHash('md5').update(`${s}&key=${key}`).digest('hex').toUpperCase();
}

const p = { mchId: 'YOUR_MERCHANT_ID', mchOrderNo: 'ORDER-1001' };   // or orderNo: our order number
p.sign = rpSign(p, 'YOUR_API_KEY');                         // mchKey = pay-in order
const res = await fetch('https://gamio.site/api/v3/check-order-status', {
  method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(p),
}).then(r => r.json());
console.log(res.data ? res.data.status : res.message);     // pending | success | failed | expired

import hashlib

def rp_sign(p, key):
    s = '&'.join(f'{k}={p[k]}' for k in sorted(p)
                 if k != 'sign' and p[k] not in ('', None))      # sorted, empty values skipped
    return hashlib.md5(f'{s}&key={key}'.encode()).hexdigest().upper()

import requests

p = {'mchId': 'YOUR_MERCHANT_ID', 'mchOrderNo': 'ORDER-1001'}          # or 'orderNo': our order number
p['sign'] = rp_sign(p, 'YOUR_API_KEY')                      # mchKey = pay-in order
res = requests.post('https://gamio.site/api/v3/check-order-status', json=p, timeout=30).json()
print(res['data']['status'] if res.get('success') else res.get('message'))   # pending | success | failed | expired

# sign: sorted "name=value" pairs joined with &, then &key=KEY -> MD5 -> upper case
rp_sign() { printf '%s' "$1&key=$2" | md5sum | cut -d' ' -f1 | tr 'a-f' 'A-F'; }   # macOS: md5 -q
MCH_ID='YOUR_MERCHANT_ID'; KEY='YOUR_API_KEY'            # mchKey = pay-in order
SIGN=$(rp_sign "mchId=$MCH_ID&mchOrderNo=ORDER-1001" "$KEY")
curl -sS -X POST 'https://gamio.site/api/v3/check-order-status' -H 'Content-Type: application/json' \
  -d "{\"mchId\":\"$MCH_ID\",\"mchOrderNo\":\"ORDER-1001\",\"sign\":\"$SIGN\"}"

{
    "code": 200,
    "success": true,
    "message": "Success",
    "data": {
        "status": "success",
        "paidAmount": "500.00",
        "utr": "627412345678",
        "paidAt": "2026-10-01T14:50:15+05:30",
        "type": "payin",
        "orderNo": "RP2610011449406340360",
        "mchOrderNo": "ORDER-1001",
        "amount": "500.00",
        "fee": "55.00",
        "netAmount": "445.00",
        "tradeType": "INRUPI",
        "pay_url": "https://gamio.site/pay/48568a0be2cab05e6a49",
        "payUrl": "https://gamio.site/pay/48568a0be2cab05e6a49",
        "extra": "",
        "createdAt": "2026-10-01T14:49:40+05:30",
        "expiresAt": "2026-10-01T15:19:40+05:30"
    }
}

<?php
function rp_sign(array $p, string $key): string {
    unset($p['sign']);
    $p = array_filter($p, fn($v) => $v !== '' && $v !== null);   // empty values are not signed
    ksort($p, SORT_STRING);                                      // sort by parameter name
    $pairs = [];
    foreach ($p as $k => $v) $pairs[] = $k . '=' . $v;
    return strtoupper(md5(implode('&', $pairs) . '&key=' . $key));
}

$p = [
    'mchId'         => 'YOUR_MERCHANT_ID',
    'mchOrderNo'    => 'PAYOUT-77',
    'amount'        => '1000.00',               // the beneficiary receives exactly this; our fee is added on top
    'payType'       => 'bank',                  // bank | upi | usdt
    'bankCode'      => 'HDFC Bank',             // see the Bank Codes tab
    'accountName'   => 'Test User',
    'accountNumber' => '123456789012',
    'ifsc'          => 'HDFC0001234',
];
$p['sign'] = rp_sign($p, 'YOUR_API_SECRET');    // mchSecret (NOT mchKey); the call must come from an allow-listed IP

$ch = curl_init('https://gamio.site/api/v3/payout');
curl_setopt_array($ch, [CURLOPT_POST => true, CURLOPT_RETURNTRANSFER => true, CURLOPT_TIMEOUT => 30,
    CURLOPT_HTTPHEADER => ['Content-Type: application/json'], CURLOPT_POSTFIELDS => json_encode($p)]);
print_r(json_decode(curl_exec($ch), true));

const crypto = require('crypto');
function rpSign(p, key) {
  const s = Object.keys(p)
    .filter(k => k !== 'sign' && p[k] !== '' && p[k] != null)   // empty values are not signed
    .sort()                                                      // sort by parameter name
    .map(k => `${k}=${p[k]}`).join('&');
  return crypto.createHash('md5').update(`${s}&key=${key}`).digest('hex').toUpperCase();
}

const p = {
  mchId: 'YOUR_MERCHANT_ID', mchOrderNo: 'PAYOUT-77', amount: '1000.00', payType: 'bank',
  bankCode: 'HDFC Bank', accountName: 'Test User', accountNumber: '123456789012', ifsc: 'HDFC0001234',
};
p.sign = rpSign(p, 'YOUR_API_SECRET');          // mchSecret (NOT mchKey); the call must come from an allow-listed IP
const res = await fetch('https://gamio.site/api/v3/payout', {
  method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(p),
}).then(r => r.json());
console.log(res);

import hashlib

def rp_sign(p, key):
    s = '&'.join(f'{k}={p[k]}' for k in sorted(p)
                 if k != 'sign' and p[k] not in ('', None))      # sorted, empty values skipped
    return hashlib.md5(f'{s}&key={key}'.encode()).hexdigest().upper()

import requests

p = {'mchId': 'YOUR_MERCHANT_ID', 'mchOrderNo': 'PAYOUT-77', 'amount': '1000.00', 'payType': 'bank',
     'bankCode': 'HDFC Bank', 'accountName': 'Test User', 'accountNumber': '123456789012', 'ifsc': 'HDFC0001234'}
p['sign'] = rp_sign(p, 'YOUR_API_SECRET')       # mchSecret (NOT mchKey); the call must come from an allow-listed IP
print(requests.post('https://gamio.site/api/v3/payout', json=p, timeout=30).json())

# sign: sorted "name=value" pairs joined with &, then &key=KEY -> MD5 -> upper case
rp_sign() { printf '%s' "$1&key=$2" | md5sum | cut -d' ' -f1 | tr 'a-f' 'A-F'; }   # macOS: md5 -q
MCH_ID='YOUR_MERCHANT_ID'; SECRET='YOUR_API_SECRET'      # mchSecret
SIGN=$(rp_sign "accountName=Test User&accountNumber=123456789012&amount=1000.00&bankCode=HDFC Bank&ifsc=HDFC0001234&mchId=$MCH_ID&mchOrderNo=PAYOUT-77&payType=bank" "$SECRET")
curl -sS -X POST 'https://gamio.site/api/v3/payout' -H 'Content-Type: application/json' -d "{
  \"mchId\":\"$MCH_ID\",\"mchOrderNo\":\"PAYOUT-77\",\"amount\":\"1000.00\",\"payType\":\"bank\",\"bankCode\":\"HDFC Bank\",
  \"accountName\":\"Test User\",\"accountNumber\":\"123456789012\",\"ifsc\":\"HDFC0001234\",\"sign\":\"$SIGN\"}"

{
    "code": 200,
    "success": true,
    "message": "Success",
    "data": {
        "orderNo": "WD26100112345678",
        "mchOrderNo": "PAYOUT-77",
        "amount": "1000.00",
        "fee": "75.00",
        "totalDebit": "1075.00",
        "status": "pending",
        "payType": "bank",
        "txid": null,
        "createdAt": "2026-10-01T15:01:02+05:30",
        "paidAt": null
    }
}

<?php
function rp_sign(array $p, string $key): string {
    unset($p['sign']);
    $p = array_filter($p, fn($v) => $v !== '' && $v !== null);   // empty values are not signed
    ksort($p, SORT_STRING);                                      // sort by parameter name
    $pairs = [];
    foreach ($p as $k => $v) $pairs[] = $k . '=' . $v;
    return strtoupper(md5(implode('&', $pairs) . '&key=' . $key));
}

$p = ['mchId' => 'YOUR_MERCHANT_ID', 'mchOrderNo' => 'PAYOUT-77'];     // or 'orderNo' => our payout number (WD…)
$p['sign'] = rp_sign($p, 'YOUR_API_SECRET');                  // mchSecret = withdrawal

$ch = curl_init('https://gamio.site/api/v3/check-order-status');
curl_setopt_array($ch, [CURLOPT_POST => true, CURLOPT_RETURNTRANSFER => true, CURLOPT_TIMEOUT => 30,
    CURLOPT_HTTPHEADER => ['Content-Type: application/json'], CURLOPT_POSTFIELDS => json_encode($p)]);
$res = json_decode(curl_exec($ch), true);
echo $res['data']['status'] ?? $res['message'];               // pending | processing | success | failed

# sign: sorted "name=value" pairs joined with &, then &key=KEY -> MD5 -> upper case
rp_sign() { printf '%s' "$1&key=$2" | md5sum | cut -d' ' -f1 | tr 'a-f' 'A-F'; }   # macOS: md5 -q
MCH_ID='YOUR_MERCHANT_ID'; SECRET='YOUR_API_SECRET'      # mchSecret = withdrawal
SIGN=$(rp_sign "mchId=$MCH_ID&mchOrderNo=PAYOUT-77" "$SECRET")
curl -sS -X POST 'https://gamio.site/api/v3/check-order-status' -H 'Content-Type: application/json' \
  -d "{\"mchId\":\"$MCH_ID\",\"mchOrderNo\":\"PAYOUT-77\",\"sign\":\"$SIGN\"}"

{
    "code": 200,
    "success": true,
    "message": "Success",
    "data": {
        "orderNo": "WD26100112345678",
        "mchOrderNo": "PAYOUT-77",
        "amount": "1000.00",
        "fee": "75.00",
        "totalDebit": "1075.00",
        "status": "success",
        "payType": "bank",
        "txid": null,
        "createdAt": "2026-10-01T15:01:02+05:30",
        "paidAt": "2026-10-01T15:20:11+05:30",
        "type": "payout"
    }
}

<?php
function rp_sign(array $p, string $key): string {
    unset($p['sign']);
    $p = array_filter($p, fn($v) => $v !== '' && $v !== null);   // empty values are not signed
    ksort($p, SORT_STRING);                                      // sort by parameter name
    $pairs = [];
    foreach ($p as $k => $v) $pairs[] = $k . '=' . $v;
    return strtoupper(md5(implode('&', $pairs) . '&key=' . $key));
}

$p = ['mchId' => 'YOUR_MERCHANT_ID'];
$p['sign'] = rp_sign($p, 'YOUR_API_SECRET');    // mchSecret
$ch = curl_init('https://gamio.site/api/v3/check-gateway-balance');
curl_setopt_array($ch, [CURLOPT_POST => true, CURLOPT_RETURNTRANSFER => true, CURLOPT_TIMEOUT => 30,
    CURLOPT_HTTPHEADER => ['Content-Type: application/json'], CURLOPT_POSTFIELDS => json_encode($p)]);
$res = json_decode(curl_exec($ch), true);
echo $res['data']['balance'] ?? $res['message'];

const crypto = require('crypto');
function rpSign(p, key) {
  const s = Object.keys(p)
    .filter(k => k !== 'sign' && p[k] !== '' && p[k] != null)   // empty values are not signed
    .sort()                                                      // sort by parameter name
    .map(k => `${k}=${p[k]}`).join('&');
  return crypto.createHash('md5').update(`${s}&key=${key}`).digest('hex').toUpperCase();
}

const p = { mchId: 'YOUR_MERCHANT_ID' };
p.sign = rpSign(p, 'YOUR_API_SECRET');          // mchSecret
const res = await fetch('https://gamio.site/api/v3/check-gateway-balance', {
  method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(p),
}).then(r => r.json());
console.log(res.data ? res.data.balance : res.message);

import hashlib

def rp_sign(p, key):
    s = '&'.join(f'{k}={p[k]}' for k in sorted(p)
                 if k != 'sign' and p[k] not in ('', None))      # sorted, empty values skipped
    return hashlib.md5(f'{s}&key={key}'.encode()).hexdigest().upper()

import requests

p = {'mchId': 'YOUR_MERCHANT_ID'}
p['sign'] = rp_sign(p, 'YOUR_API_SECRET')       # mchSecret
res = requests.post('https://gamio.site/api/v3/check-gateway-balance', json=p, timeout=30).json()
print(res['data']['balance'] if res.get('success') else res.get('message'))

# sign: sorted "name=value" pairs joined with &, then &key=KEY -> MD5 -> upper case
rp_sign() { printf '%s' "$1&key=$2" | md5sum | cut -d' ' -f1 | tr 'a-f' 'A-F'; }   # macOS: md5 -q
MCH_ID='YOUR_MERCHANT_ID'; SECRET='YOUR_API_SECRET'      # mchSecret
SIGN=$(rp_sign "mchId=$MCH_ID" "$SECRET")
curl -sS -X POST 'https://gamio.site/api/v3/check-gateway-balance' -H 'Content-Type: application/json' -d "{\"mchId\":\"$MCH_ID\",\"sign\":\"$SIGN\"}"

{
    "code": 200,
    "success": true,
    "message": "Success",
    "data": {
        "balance": "12450.00",
        "available": "12450.00",
        "frozen": "1075.00",
        "total": "13525.00",
        "currency": "INR"
    }
}

function rp_sign(array $p, string $key): string {
    unset($p['sign']);
    $p = array_filter($p, fn($v) => $v !== '' && $v !== null);   // empty values are not signed
    ksort($p, SORT_STRING);                                      // sort by parameter name
    $pairs = [];
    foreach ($p as $k => $v) $pairs[] = $k . '=' . $v;
    return strtoupper(md5(implode('&', $pairs) . '&key=' . $key));
}

const crypto = require('crypto');
function rpSign(p, key) {
  const s = Object.keys(p)
    .filter(k => k !== 'sign' && p[k] !== '' && p[k] != null)   // empty values are not signed
    .sort()                                                      // sort by parameter name
    .map(k => `${k}=${p[k]}`).join('&');
  return crypto.createHash('md5').update(`${s}&key=${key}`).digest('hex').toUpperCase();
}

import hashlib

def rp_sign(p, key):
    s = '&'.join(f'{k}={p[k]}' for k in sorted(p)
                 if k != 'sign' and p[k] not in ('', None))      # sorted, empty values skipped
    return hashlib.md5(f'{s}&key={key}'.encode()).hexdigest().upper()

import java.security.MessageDigest;
import java.nio.charset.StandardCharsets;
import java.util.*;

static String rpSign(Map<String, String> p, String key) throws Exception {
    StringBuilder sb = new StringBuilder();
    for (String k : new TreeMap<>(p).keySet()) {                  // sorted by name
        String v = p.get(k);
        if (k.equals("sign") || v == null || v.isEmpty()) continue;
        sb.append(k).append('=').append(v).append('&');
    }
    sb.append("key=").append(key);
    byte[] d = MessageDigest.getInstance("MD5").digest(sb.toString().getBytes(StandardCharsets.UTF_8));
    StringBuilder hex = new StringBuilder();
    for (byte b : d) hex.append(String.format("%02X", b));
    return hex.toString();
}

# sign: sorted "name=value" pairs joined with &, then &key=KEY -> MD5 -> upper case
rp_sign() { printf '%s' "$1&key=$2" | md5sum | cut -d' ' -f1 | tr 'a-f' 'A-F'; }   # macOS: md5 -q

{
    "mchId": "123456789",
    "merchant_id": "123456789",
    "mchOrderNo": "ORDER-1001",
    "merchant_order_no": "ORDER-1001",
    "orderNo": "RP2610011449406340360",
    "gateway_order_no": "RP2610011449406340360",
    "amount": "500.00",
    "paidAmount": "500.00",
    "fee": "55.00",
    "netAmount": "445.00",
    "tradeType": "INRUPI",
    "status": "success",
    "utr": "627412345678",
    "payTime": "2026-10-01T14:50:15+05:30",
    "extra": "",
    "sign": "2B60E30809FDA5D9D5752EED2DAEB84E"
}

<?php
function rp_sign(array $p, string $key): string {
    unset($p['sign']);
    $p = array_filter($p, fn($v) => $v !== '' && $v !== null);   // empty values are not signed
    ksort($p, SORT_STRING);                                      // sort by parameter name
    $pairs = [];
    foreach ($p as $k => $v) $pairs[] = $k . '=' . $v;
    return strtoupper(md5(implode('&', $pairs) . '&key=' . $key));
}

// Your notifyUrl endpoint. We send JSON or form fields (your choice in Basic Information).
$data = json_decode(file_get_contents('php://input'), true) ?: $_POST;
$received = $data['sign'] ?? '';
if (!hash_equals(rp_sign($data, 'YOUR_API_KEY'), strtoupper($received))) {   // mchKey; for payout callbacks use mchSecret
    http_response_code(400); exit('invalid sign');
}
// Idempotent: the same callback can arrive more than once (retries, manual re-send).
if ($data['status'] === 'success' && !order_already_paid($data['mchOrderNo'])) {
    mark_order_paid($data['mchOrderNo'], $data['paidAmount']);
}
echo 'success';          // plain text "success" with HTTP 200, otherwise we retry

const crypto = require('crypto');
function rpSign(p, key) {
  const s = Object.keys(p)
    .filter(k => k !== 'sign' && p[k] !== '' && p[k] != null)   // empty values are not signed
    .sort()                                                      // sort by parameter name
    .map(k => `${k}=${p[k]}`).join('&');
  return crypto.createHash('md5').update(`${s}&key=${key}`).digest('hex').toUpperCase();
}

const express = require('express');
const app = express();
app.use(express.json()); app.use(express.urlencoded({ extended: false }));
app.post('/webhook/reddypay', (req, res) => {
  const d = req.body;
  const ok = (d.sign || '').toUpperCase() === rpSign(d, 'YOUR_API_KEY');     // mchKey; payout callbacks: mchSecret
  if (!ok) return res.status(400).send('invalid sign');
  if (d.status === 'success' && !orderAlreadyPaid(d.mchOrderNo)) markOrderPaid(d.mchOrderNo, d.paidAmount);   // idempotent
  res.send('success');       // plain text "success" with HTTP 200, otherwise we retry
});

import hashlib

def rp_sign(p, key):
    s = '&'.join(f'{k}={p[k]}' for k in sorted(p)
                 if k != 'sign' and p[k] not in ('', None))      # sorted, empty values skipped
    return hashlib.md5(f'{s}&key={key}'.encode()).hexdigest().upper()

from flask import Flask, request

app = Flask(__name__)

@app.post('/webhook/reddypay')
def webhook():
    d = request.get_json(silent=True) or request.form.to_dict()
    if d.get('sign', '').upper() != rp_sign(d, 'YOUR_API_KEY'):               # mchKey; payout callbacks: mchSecret
        return 'invalid sign', 400
    if d.get('status') == 'success' and not order_already_paid(d['mchOrderNo']):   # idempotent
        mark_order_paid(d['mchOrderNo'], d['paidAmount'])
    return 'success'           # plain text "success" with HTTP 200, otherwise we retry

import java.security.MessageDigest;
import java.nio.charset.StandardCharsets;
import java.util.*;

static String rpSign(Map<String, String> p, String key) throws Exception {
    StringBuilder sb = new StringBuilder();
    for (String k : new TreeMap<>(p).keySet()) {                  // sorted by name
        String v = p.get(k);
        if (k.equals("sign") || v == null || v.isEmpty()) continue;
        sb.append(k).append('=').append(v).append('&');
    }
    sb.append("key=").append(key);
    byte[] d = MessageDigest.getInstance("MD5").digest(sb.toString().getBytes(StandardCharsets.UTF_8));
    StringBuilder hex = new StringBuilder();
    for (byte b : d) hex.append(String.format("%02X", b));
    return hex.toString();
}

// Spring example: verify, then answer the text "success".
@PostMapping("/webhook/reddypay")
String webhook(@RequestBody Map<String, String> d) throws Exception {
    if (!rpSign(d, "YOUR_API_KEY").equalsIgnoreCase(d.getOrDefault("sign", ""))) {   // mchKey; payout callbacks: mchSecret
        throw new ResponseStatusException(HttpStatus.BAD_REQUEST, "invalid sign");
    }
    if ("success".equals(d.get("status")) && !orderAlreadyPaid(d.get("mchOrderNo"))) markOrderPaid(d.get("mchOrderNo"), d.get("paidAmount"));
    return "success";
}

{
    "mchId": "123456789",
    "merchant_id": "123456789",
    "mchOrderNo": "PAYOUT-77",
    "merchant_order_no": "PAYOUT-77",
    "orderNo": "WD26100112345678",
    "gateway_order_no": "WD26100112345678",
    "amount": "1000.00",
    "fee": "75.00",
    "totalDebit": "1075.00",
    "status": "success",
    "txid": "",
    "payTime": "2026-10-01T15:20:11+05:30",
    "message": "",
    "sign": "…"
}

# sign: sorted "name=value" pairs joined with &, then &key=KEY -> MD5 -> upper case
rp_sign() { printf '%s' "$1&key=$2" | md5sum | cut -d' ' -f1 | tr 'a-f' 'A-F'; }   # macOS: md5 -q
MCH_ID='YOUR_MERCHANT_ID'; KEY='YOUR_API_KEY'            # mchKey
SIGN=$(rp_sign "amount=500.00&mchId=$MCH_ID&mchOrderNo=ORDER-1001&notifyUrl=https://merchant.example.com/webhook/reddypay&tradeType=INRUPI" "$KEY")

curl -sS -X POST 'https://gamio.site/api/v3/payin' -H 'Content-Type: application/json' -d "{
  \"mchId\": \"$MCH_ID\", \"mchOrderNo\": \"ORDER-1001\", \"amount\": \"500.00\", \"tradeType\": \"INRUPI\",
  \"notifyUrl\": \"https://merchant.example.com/webhook/reddypay\", \"sign\": \"$SIGN\"
}"

# sign: sorted "name=value" pairs joined with &, then &key=KEY -> MD5 -> upper case
rp_sign() { printf '%s' "$1&key=$2" | md5sum | cut -d' ' -f1 | tr 'a-f' 'A-F'; }   # macOS: md5 -q
MCH_ID='YOUR_MERCHANT_ID'; KEY='YOUR_API_KEY'            # mchKey = pay-in order
SIGN=$(rp_sign "mchId=$MCH_ID&mchOrderNo=ORDER-1001" "$KEY")
curl -sS -X POST 'https://gamio.site/api/v3/check-order-status' -H 'Content-Type: application/json' \
  -d "{\"mchId\":\"$MCH_ID\",\"mchOrderNo\":\"ORDER-1001\",\"sign\":\"$SIGN\"}"

# sign: sorted "name=value" pairs joined with &, then &key=KEY -> MD5 -> upper case
rp_sign() { printf '%s' "$1&key=$2" | md5sum | cut -d' ' -f1 | tr 'a-f' 'A-F'; }   # macOS: md5 -q
MCH_ID='YOUR_MERCHANT_ID'; SECRET='YOUR_API_SECRET'      # mchSecret
SIGN=$(rp_sign "accountName=Test User&accountNumber=123456789012&amount=1000.00&bankCode=HDFC Bank&ifsc=HDFC0001234&mchId=$MCH_ID&mchOrderNo=PAYOUT-77&payType=bank" "$SECRET")
curl -sS -X POST 'https://gamio.site/api/v3/payout' -H 'Content-Type: application/json' -d "{
  \"mchId\":\"$MCH_ID\",\"mchOrderNo\":\"PAYOUT-77\",\"amount\":\"1000.00\",\"payType\":\"bank\",\"bankCode\":\"HDFC Bank\",
  \"accountName\":\"Test User\",\"accountNumber\":\"123456789012\",\"ifsc\":\"HDFC0001234\",\"sign\":\"$SIGN\"}"

# sign: sorted "name=value" pairs joined with &, then &key=KEY -> MD5 -> upper case
rp_sign() { printf '%s' "$1&key=$2" | md5sum | cut -d' ' -f1 | tr 'a-f' 'A-F'; }   # macOS: md5 -q
MCH_ID='YOUR_MERCHANT_ID'; SECRET='YOUR_API_SECRET'      # mchSecret
SIGN=$(rp_sign "mchId=$MCH_ID" "$SECRET")
curl -sS -X POST 'https://gamio.site/api/v3/check-gateway-balance' -H 'Content-Type: application/json' -d "{\"mchId\":\"$MCH_ID\",\"sign\":\"$SIGN\"}"

{
    "code": 401,
    "success": false,
    "message": "Invalid merchant ID or signature. Sign every parameter (except sign) with the right key — see the API documentation.",
    "error": "invalid_signature"
}

curl -X POST https://gamio.site/api/v1/create-link.php \
  -H "Content-Type: application/json" \
  -d '{"api_key":"YOUR_API_KEY","amount":"500.00","client_ref":"ORDER-1042","notify_url":"https://merchant.example.com/hook","sign":"COMPUTED_SIGNATURE"}'

{
    "ok": true,
    "data": {
        "link_code": "48568a0be2cab05e6a49",
        "client_ref": "ORDER-1042",
        "amount": "500.00",
        "currency": "INR",
        "status": "pending",
        "pay_url": "https://gamio.site/pay/48568a0be2cab05e6a49",
        "created_at": "2026-10-01T14:49:40+05:30",
        "expires_at": "2026-10-01T15:19:40+05:30"
    }
}