API reference

Verify payment

The payment result is delivered by redirect. When the customer finishes paying on the hosted checkout, QRPay sends them back to the return_url you passed to initiate payment, carrying the result payload shown on the right. There is no polling to set up — your return_url handler is the verification step.

How the redirect works

Customer pays on the hosted payment_url — QRPay collects the payment inside its own checkout.
QRPay redirects the customer to your return_url, including the payment session token in the result.
Match the token against the one you stored when you created the payment. No match, or a token you’ve already fulfilled — stop and investigate.
Mark the order paid, storing trx_id as QRPay’s transaction reference for reconciliation, refunds and support queries.

What’s in the result

tokenstringThe payment session id returned by payment/create. Your join key — look up the pending order you stored it against.

trx_idstringQRPay’s transaction reference, e.g. BP2c7sAvw75MTlrP. Save it with the order — it’s what QRPay support and your merchant panel identify the payment by.

payerobjectThe QRPay account that paid: username and email. Useful for receipts and support — don’t use it as your only customer match.

Security

Never trust client-side amounts. The redirect passes through the customer’s browser — re-check amount and currency against the order you created, never against anything the client sends.
Match on your stored token. Only fulfil an order whose token you issued yourself, and only once — ignore repeats of a token you’ve already processed.
Handle the cancel path. A customer landing on your cancel_url (or on return_url without a valid result) has not paid — leave the order pending or mark it cancelled, never paid.

Result return_url redirect

{
  "message": {
    "code": 200,
    "success": ["SUCCESS"]
  },
  "data": {
    "token": "2zMRmT3KeYT2BWMAyGhqEfuw4tOYOfGXKeyKqehZ8mF1E35hMwE69gPpyo3e",
    "trx_id": "BP2c7sAvw75MTlrP",
    "payer": {
      "username": "testuser",
      "email": "user@appdevs.net"
    }
  },
  "type": "success"
}

Handler sketch PHP

<?php
// return_url handler

$token = $result['data']['token'];
$trxId = $result['data']['trx_id'];

$order = Order::where('qrpay_token', $token)
              ->where('status', 'pending')
              ->first();

if (!$order) {
  // unknown or already-fulfilled token
  abort(404);
}

// amount/currency: trust YOUR record,
// not anything from the redirect
$order->markPaid($trxId);