PHPackages                             onepay/checkout-sdk - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Payment Processing](/categories/payments)
4. /
5. onepay/checkout-sdk

ActiveLibrary[Payment Processing](/categories/payments)

onepay/checkout-sdk
===================

Production-ready PHP SDK for the OnePay Checkout Link API

v1.0.0(2mo ago)01MITPHPPHP >=8.0

Since Apr 8Pushed 2mo agoCompare

[ Source](https://github.com/onepay-srilanka/php-checkout-sdk)[ Packagist](https://packagist.org/packages/onepay/checkout-sdk)[ RSS](/packages/onepay-checkout-sdk/feed)WikiDiscussions main Synced 1w ago

READMEChangelogDependenciesVersions (2)Used By (0)

 **PHP · OnePay · Checkout Link API**

OnePay Checkout SDK for PHP
===========================

[](#onepay-checkout-sdk-for-php)

**Server-side PHP integration for the OnePay Checkout Link API** (`api.onepay.lk`) — create payment links with correct SHA-256 hashing, strict local validation, and structured error handling. Zero framework dependencies; use from any PHP 8+ app.

 [![Latest Stable Version](https://camo.githubusercontent.com/939db05fd00edd8eea0e434d4800467d0ffe703daad227eef9ad087fdcdd9ad3/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f6f6e657061792f636865636b6f75742d73646b3f6c6162656c3d737461626c65267374796c653d666c61742d737175617265)](https://packagist.org/packages/onepay/checkout-sdk) [![Total Downloads](https://camo.githubusercontent.com/0ccf8b5fa7b1822cf628741c3227768ab25f8912cd70e96c5462f121ff290496/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f6f6e657061792f636865636b6f75742d73646b3f7374796c653d666c61742d737175617265)](https://packagist.org/packages/onepay/checkout-sdk) [![Monthly Downloads](https://camo.githubusercontent.com/16a22f6f4ae20bbde0f34d1212e33f5fdab86954d6557c971c69be2d980536d5/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f646d2f6f6e657061792f636865636b6f75742d73646b3f7374796c653d666c61742d737175617265)](https://packagist.org/packages/onepay/checkout-sdk) [![License](https://camo.githubusercontent.com/b1b67b13678e0b8658c2adcf3bbe7ff54d092b466522078c95521555ffb073c0/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f6c2f6f6e657061792f636865636b6f75742d73646b3f7374796c653d666c61742d737175617265)](LICENSE)

---

Getting started
---------------

[](#getting-started)

Works with **PHP 8.0+** and Composer. The SDK does **not** read `.env` or config files — you pass credentials **only** through the `OnePayClient` constructor (your application may load values from environment variables and pass them in).

---

Install
-------

[](#install)

```
composer require onepay/checkout-sdk
```

---

Configure
---------

[](#configure)

Create a client with your **server-side only** secrets (never expose these in frontend or mobile apps):

```
use OnePay\OnePayClient;

$client = new OnePayClient(
    appId: 'your-app-id',
    appToken: 'your-app-token',
    hashSalt: 'your-hash-salt'
);
```

ParameterRequiredDescription`appId`**Yes**OnePay application id`appToken`**Yes**Sent as the `Authorization` header`hashSalt`**Yes**Used only for SHA-256 request hashing`baseUrl`NoAPI host (default `https://api.onepay.lk`; path `/v3/checkout/link/` is appended internally)`timeout`NoHTTP timeout in seconds (default `30`)In Laravel, Symfony, or other frameworks you typically read secrets from `.env` **in your own code** and pass them into `OnePayClient` — the SDK itself stays configuration-agnostic.

---

Usage
-----

[](#usage)

### Create a checkout link

[](#create-a-checkout-link)

```
use OnePay\OnePayClient;
use OnePay\Exceptions\ApiException;
use OnePay\Exceptions\OnePayException;
use OnePay\Exceptions\ValidationException;

$client = new OnePayClient(
    appId: $appId,
    appToken: $appToken,
    hashSalt: $hashSalt,
);

try {
    $response = $client->createCheckoutLink([
        'reference' => $client->generateReference('ORD'), // required — min 10 characters
        'currency' => 'LKR',
        'amount' => '200', // or 200.5 — normalised to 2 decimals for hashing & API
        'customer_first_name' => 'John',
        'customer_last_name' => 'Doe',
        'customer_phone_number' => '+94771234567',
        'customer_email' => 'john@example.com',
        'transaction_redirect_url' => 'https://yoursite.test/payment/return',
        // optional:
        // 'additionalData' => 'extra context for the transaction',
        // 'items' => [1, 2, 3],
    ]);

    $redirectUrl = $response['redirect_url'];
    if ($redirectUrl !== null) {
        header('Location: ' . $redirectUrl);
        exit;
    }
    // inspect $response['raw_response'] if redirect_url is missing
} catch (ValidationException $e) {
    // Local validation — $e->getErrors() is field => message
} catch (ApiException $e) {
    // Non-2xx — $e->getApiError(), getApiMessage(), getStatusCode(), getRawResponse()
} catch (OnePayException $e) {
    // Transport / JSON errors
}
```

### Manual hash or reference

[](#manual-hash-or-reference)

```
$hash = $client->generateHash('LKR', '200'); // amount normalised internally
$ref  = $client->generateReference('INV');  // unique reference string
```

---

### Request fields

[](#request-fields)

FieldRequiredDescription`reference`**Yes**Unique transaction reference (**at least 10** characters). Use your order id or `generateReference()`.`currency`**Yes**e.g. `LKR``amount`**Yes**Normalised to **2** decimal places for hashing and the API.`customer_first_name`Yes`customer_last_name`Yes`customer_phone_number`Yes`customer_email`YesValid email format`transaction_redirect_url`YesValid URL — return URL after payment`additionalData`NoExtra string metadata (API key: `additionalData`)`items`NoArray if providedThe SDK injects `app_id` and `hash` automatically; you do not send `app_id` in the payload.

---

### Response shape

[](#response-shape)

`createCheckoutLink()` returns an **associative array**:

KeyDescription`success``true` when the HTTP call succeeded`reference`Echo of your payload reference`hash`Lowercase hex SHA-256 sent to the API`redirect_url`Gateway URL for the customer (from parsed API body when present)`raw_response`Full decoded JSON from OnePayUse `raw_response` if you need fields beyond `redirect_url`.

---

### Hash rules (OnePay requirement)

[](#hash-rules-onepay-requirement)

The package normalises **amount to two decimal places** and builds:

`sha256(app_id + currency + amount + hash_salt)` → **lowercase** hex (concatenation order fixed; no spaces).

---

PHP version compatibility
-------------------------

[](#php-version-compatibility)

PHPPackage status8.3Supported8.2Supported8.1Supported8.0Supported7.xNot supportedExtensions: `ext-curl`, `ext-json`, `ext-mbstring`.

---

Security
--------

[](#security)

- Keep `appToken` and `hashSalt` **only** on the server.
- Validate and **allowlist** `transaction_redirect_url` if it can be influenced by end users (open-redirect risk).
- Confirm paid orders using **OnePay’s official** callback / status flows — this SDK covers **checkout link creation** only.

---

License
-------

[](#license)

This package is open-sourced software licensed under the [MIT license](LICENSE).

---

Links
-----

[](#links)

- [Packagist — `onepay/checkout-sdk`](https://packagist.org/packages/onepay/checkout-sdk)
- OnePay Checkout Link: `POST https://api.onepay.lk/v3/checkout/link/`
- For **Laravel** integration see [`onepay/laravel-checkout`](https://packagist.org/packages/onepay/laravel-checkout) on Packagist.

###  Health Score

34

—

LowBetter than 75% of packages

Maintenance87

Actively maintained with recent releases

Popularity1

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity38

Early-stage or recently created project

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Unknown

Total

1

Last Release

62d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/cd54a472d63572925b32e2f5a6d3202c538ab2efaf3976d9c884fa3c504400dc?d=identicon)[onepay-srilanka](/maintainers/onepay-srilanka)

---

Top Contributors

[![SpemaiDev](https://avatars.githubusercontent.com/u/151663384?v=4)](https://github.com/SpemaiDev "SpemaiDev (4 commits)")

### Embed Badge

![Health badge](/badges/onepay-checkout-sdk/health.svg)

```
[![Health](https://phpackages.com/badges/onepay-checkout-sdk/health.svg)](https://phpackages.com/packages/onepay-checkout-sdk)
```

###  Alternatives

[omnipay/coinbase

Coinbase driver for the Omnipay payment processing library

18570.2k1](/packages/omnipay-coinbase)[yenepay/php-sdk

YenePay SDK for PHP

112.7k](/packages/yenepay-php-sdk)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)