依金流分類查看可串接的 API。

{
  "merchant_order_no": "ORDER202608310001",
  "amount": 2250,
  "currency": "TWD",
  "item_name": "PayCore test product",
  "payok_url": "https://merchant.example.com/webhooks/paycore",
  "success_url": "https://merchant.example.com/payment/success",
  "cancel_url": "https://merchant.example.com/payment/cancel"
}

POST /webhooks/paycore HTTP/1.1
Content-Type: application/json
X-PayCore-Event-Id: evt_20260831080530ABCDEFGH
X-PayCore-Timestamp: 1788134730
X-PayCore-Signature: v1=4d7f...

{
  "event_id": "evt_20260831080530ABCDEFGH",
  "event_type": "payment.paid",
  "payment_no": "PAY20260831080000ABCDEFGH",
  "merchant_order_no": "ORDER202608310001",
  "gateway": "paycore",
  "method": "aio",
  "amount": 2250,
  "currency": "twd",
  "status": "paid",
  "paid_at": "2026-08-31T08:05:30+08:00"
}

{
  "event_id": "evt_20260831081530DIRECT01",
  "event_type": "payment.paid",
  "payment_no": "PAY20260831081000DIRECT01",
  "merchant_order_no": "ORDER202608310002",
  "gateway": "ecpay",
  "method": "credit",
  "amount": 980,
  "currency": "twd",
  "status": "paid",
  "paid_at": "2026-08-31T08:15:30+08:00"
}

signed_payload = X-PayCore-Timestamp + "." + raw_request_body
expected_signature = "v1=" + HMAC-SHA256(signed_payload, callback_secret)

use Illuminate\Http\Request;
use Illuminate\Support\Facades\Route;

Route::post('/webhooks/paycore', function (Request $request) {
    $rawBody = $request->getContent();
    $timestamp = (string) $request->header('X-PayCore-Timestamp', '');
    $eventId = (string) $request->header('X-PayCore-Event-Id', '');
    $received = (string) $request->header('X-PayCore-Signature', '');
    $secret = (string) config('services.paycore.callback_secret');

    if (! ctype_digit($timestamp) || abs(time() - (int) $timestamp) > 300) {
        return response('Invalid timestamp', 401);
    }

    $expected = 'v1=' . hash_hmac(
        'sha256',
        $timestamp . '.' . $rawBody,
        $secret
    );

    if ($eventId === '' || ! hash_equals($expected, $received)) {
        return response('Invalid signature', 401);
    }

    $payload = json_decode($rawBody, true, 512, JSON_THROW_ON_ERROR);

    if (($payload['event_id'] ?? null) !== $eventId) {
        return response('Event ID mismatch', 422);
    }

    if (($payload['event_type'] ?? null) !== 'payment.paid'
        || ($payload['status'] ?? null) !== 'paid') {
        return response('Unsupported event', 422);
    }

    // Enforce idempotency with a UNIQUE event_id, verify the order and amount,
    // then commit the merchant transaction before returning HTTP 2xx.

    return response('OK', 200);
});

HTTP/1.1 200 OK
Content-Type: text/plain

OK