MirPay API hujjatlari

Authorization: Bearer <access_token>
Content-Type: application/json
Accept: application/json

curl -X POST https://mirpay.uz/api/v2/kassa/token \
  -H "Content-Type: application/json" \
  -d '{"kassaid": 1408, "api_key": "sizning_api_kalitingiz"}'

{
  "success": true,
  "message": "Muvaffaqiyatli!",
  "data": {
    "token_type": "Bearer",
    "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIs..."
  }
}

{
  "success": false,
  "message": "Parametrlar yaroqsiz!"
}

{
  "success": true,
  "message": "OK",
  "data": {
    "kassa_id": 1408,
    "owner_user_id": "3"
  }
}

curl -X POST https://mirpay.uz/api/v2/pay \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"summa": 250000, "info_pay": "Buyurtma #1042"}'

{
  "success": true,
  "message": "Muvaffaqiyatli",
  "data": {
    "payid": "3d86e36e-d91a-4258-9e36-8f09366c6c13",
    "payinfo": {
      "status": "Jarayonda",
      "order_info": "Buyurtma #1042",
      "summa": 250000,
      "yaratilgan": "2026-08-11T10:15:00.000000Z",
      "redirect_url": "https://mirpay.uz/pay/3d86e36e-d91a-4258-9e36-8f09366c6c13"
    }
  }
}

{
  "success": true,
  "message": "OK",
  "data": {
    "payinfo": {
      "payid": "3d86e36e-d91a-4258-9e36-8f09366c6c13",
      "summa": 250000,
      "comment": "Buyurtma #1042",
      "status": "Muvaffaqiyatli",
      "sana": "2026-08-11T10:15:00.000000Z"
    }
  }
}

{
  "success": true,
  "message": "Invoice yaratildi",
  "data": {
    "payid": "3d86e36e-d91a-4258-9e36-8f09366c6c13",
    "status": "Jarayonda",
    "amount": 250000,
    "storeid": "1408"
  }
}

{
  "success": true,
  "message": "OK",
  "data": {
    "payid": "3d86e36e-d91a-4258-9e36-8f09366c6c13",
    "status": "Muvaffaqiyatli",
    "amount": 250000,
    "comment": "Buyurtma #1042",
    "send": 1
  }
}

{
  "success": true,
  "message": "OK",
  "data": {
    "kassa_id": 1408,
    "balans": 1750000
  }
}

{"success": true, "message": "V2 API OK", "data": []}

X-MirPay-Kassa-Id: 1408
X-MirPay-Timestamp: 1786443365
X-MirPay-Signature: 5f2c9a1e...   (HMAC-SHA256, hex)

signature = HMAC_SHA256(timestamp + "." + raw_body, callback_secret)

<?php
$secret = getenv('MIRPAY_CALLBACK_SECRET');

$body = file_get_contents('php://input');
$ts   = $_SERVER['HTTP_X_MIRPAY_TIMESTAMP'] ?? '';
$sig  = $_SERVER['HTTP_X_MIRPAY_SIGNATURE'] ?? '';

$expected = hash_hmac('sha256', $ts . '.' . $body, $secret);

if (!hash_equals($expected, $sig)) {
    http_response_code(403);
    exit('bad signature');
}

// Takroriy so'rovga qarshi: 5 daqiqadan eski bo'lmasin
if (abs(time() - (int) $ts) > 300) {
    http_response_code(408);
    exit('stale');
}

parse_str($body, $data);

// $data['payid'], $data['status'], $data['summa']
// Buyurtmani shu yerda tasdiqlang — idempotent bo'lsin!

http_response_code(200);
echo 'ok';

const crypto = require('crypto');
const express = require('express');
const app = express();

app.post('/mirpay/callback',
  express.raw({ type: 'application/x-www-form-urlencoded' }),
  (req, res) => {
    const body = req.body.toString('utf8');
    const ts   = req.get('X-MirPay-Timestamp') || '';
    const sig  = req.get('X-MirPay-Signature') || '';

    const expected = crypto
      .createHmac('sha256', process.env.MIRPAY_CALLBACK_SECRET)
      .update(ts + '.' + body)
      .digest('hex');

    const ok = sig.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected));

    if (!ok) return res.status(403).send('bad signature');
    if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) {
      return res.status(408).send('stale');
    }

    const data = Object.fromEntries(new URLSearchParams(body));
    // data.payid, data.status, data.summa

    res.send('ok');
  });

import hmac, hashlib, os, time
from urllib.parse import parse_qs
from flask import request, abort

SECRET = os.environ['MIRPAY_CALLBACK_SECRET'].encode()

@app.post('/mirpay/callback')
def callback():
    body = request.get_data(as_text=True)
    ts   = request.headers.get('X-MirPay-Timestamp', '')
    sig  = request.headers.get('X-MirPay-Signature', '')

    expected = hmac.new(SECRET, f'{ts}.{body}'.encode(), hashlib.sha256).hexdigest()

    if not hmac.compare_digest(expected, sig):
        abort(403)
    if abs(time.time() - int(ts or 0)) > 300:
        abort(408)

    data = {k: v[0] for k, v in parse_qs(body).items()}
    # data['payid'], data['status'], data['summa']

    return 'ok'

{
  "success": false,
  "message": "To‘lov summasi juda katta. Ruxsat etilgan eng yuqori summa: 100 000 000 so‘m.",
  "errors": {
    "summa": ["The summa field must not be greater than 100000000."]
  }
}

POST /api/connect
{"kassaid": 1408, "api_key": "..."}

→ {"token": "eyJ0eXAi...", "natija": "Muvaffaqiyatli!"}

POST /api/create-pay
{"summa": 250000, "info_pay": "Buyurtma #1042"}

→ {
  "id": "3d86e36e-...",
  "payinfo": {
    "status": "jarayonda",
    "order_info": "Buyurtma #1042",
    "summa": 250000,
    "yaratilgan": "2026-08-11T10:15:00.000000Z",
    "redicet_url": "https://mirpay.uz/pay/3d86e36e-..."
  },
  "natija": "Muvaffaqiyatli"
}

POST /api/pay/invoice/
{"payid": "3d86e36e-..."}

→ {"payinfo": {
     "payid": "3d86e36e-...",
     "summa": "250000",
     "comment": "Buyurtma #1042",
     "status": "Muvaffaqiyatli",
     "sana": "2026-08-11T10:15:00.000000Z"
   }}

{"balans": 1750000}