FormXpert Pay
API v1

Integration Documentation

Create an order from your server, redirect the customer to checkout_url, then trust only a verified paid status or signed webhook.

Create Order

POST /api/v1/orders

$apiKey = "fxp_test_...";\n$apiSecret = "fxs_...";\n$body = json_encode([\n  "merchant_order_id" => "INV10001",\n  "amount" => "125.00",\n  "customer_phone" => "9876543210",\n  "return_url" => "https://example.com/payment-return",\n  "webhook_url" => "https://example.com/webhooks/formxpert-pay"\n], JSON_UNESCAPED_SLASHES);\n$ts=(string)time(); $nonce=bin2hex(random_bytes(16));\n$sig=hash_hmac("sha256", $ts.".".$nonce.".".$body, $apiSecret);\n// POST https://pay.formxpert.site/api/v1/orders with X-FXP-* headers

Required headers

X-FXP-Key: fxp_test_...\nX-FXP-Timestamp: UNIX_SECONDS\nX-FXP-Nonce: UNIQUE_RANDOM_VALUE\nX-FXP-Signature: HMAC_SHA256(timestamp + "." + nonce + "." + raw_json, API_SECRET)\nIdempotency-Key: unique-request-key

Get Order

GET /api/v1/orders/{merchant_order_id} uses the same signature rules with an empty body.

Webhook

Header X-FXP-Webhook-Signature is HMAC-SHA256 of the raw JSON body using your Webhook Secret. Deduplicate using event_id.

Production rule

Never fulfil an order from browser parameters, screenshots or UTR text. Fulfil only when status is paid after server verification.