PHPackages                             paynotify/paynotify-php - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Payment Processing](/categories/payments)
4. /
5. paynotify/paynotify-php

ActiveLibrary[Payment Processing](/categories/payments)

paynotify/paynotify-php
=======================

Official PHP SDK for PayNotify Webhook Engine

v1.0.2(1mo ago)01MITPHPPHP >=7.4.0

Since Jul 4Pushed 1mo agoCompare

[ Source](https://github.com/ayyappavenkatasurya/paynotify-php)[ Packagist](https://packagist.org/packages/paynotify/paynotify-php)[ RSS](/packages/paynotify-paynotify-php/feed)WikiDiscussions master Synced 1w ago

READMEChangelog (1)DependenciesVersions (4)Used By (0)

PayNotify PHP SDK
=================

[](#paynotify-php-sdk)

The official PHP Server SDK for **PayNotify** — the zero-MDR, automated, lifetime-free UPI payment gateway engine.

Designed for enterprise reliability, this SDK provides seamless integration with the PayNotify architecture, enabling **Dynamic Cent Masking** for payment concurrency management and **Cryptographic HMAC-SHA256 Webhook Verification** using stable string formatting to guarantee bank-grade security against replay and JSON mutation attacks.

---

✨ Features
----------

[](#-features)

### Dynamic Cent Masking (Penny Drop)

[](#dynamic-cent-masking-penny-drop)

Automatically resolves payment concurrency (for example, multiple users checking out with ₹49 simultaneously) by generating unique fractional amounts through an atomic database lock.

### Cryptographic Webhook Security (Stable String)

[](#cryptographic-webhook-security-stable-string)

Built-in logic validates the `X-PayNotify-Signature` using **HMAC-SHA256**. It securely signs a fixed string template:

```
orderId:amount:status:timestamp

```

This completely prevents JSON parsing drift vulnerabilities and replay attacks (via a strict 5-minute expiry window).

### Client-Side Idempotency

[](#client-side-idempotency)

Prevents duplicate orders and double-charging. The SDK requires you to pass a stable, unique string (like a cart ID or session UUID) during order creation.

---

Installation
============

[](#installation)

Using Composer:

```
composer require paynotify/paynotify-php
```

---

Quick Start
===========

[](#quick-start)

Initialization
--------------

[](#initialization)

Initialize the PayNotify client using your secret API key.

> **Security Warning:** Never expose your API key in frontend or client-side code.

```
require 'vendor/autoload.php';

use PayNotify\PayNotifyClient;

$paynotify = new PayNotifyClient('your-secure-api-key');
```

---

Creating a Payment Order
------------------------

[](#creating-a-payment-order)

When a user initiates checkout, create an order on your backend. The SDK communicates with the PayNotify Engine to lock in a concurrency-safe amount.

```
try {
    $orderData = $paynotify->createOrder(
        49.00, // baseAmount
        "Surya", // customerName
        "unique-cart-id-123" // idempotencyKey (STRICTLY REQUIRED)
    );

    // Returns: ['success' => true, 'orderId' => '...', 'amount' => 49.01, 'status' => 'PENDING']
    echo json_encode($orderData);

} catch (\PayNotify\Exceptions\PayNotifyException $e) {
    http_response_code(503);
    echo json_encode(['error' => $e->getMessage()]);
}
```

---

Securing Webhooks
-----------------

[](#securing-webhooks)

PayNotify sends real-time webhooks whenever a payment is verified. Every incoming request must be authenticated before processing.

```
try {
    $signatureHeader = $_SERVER['HTTP_X_PAYNOTIFY_SIGNATURE'] ?? null;
    $rawBody = file_get_contents('php://input');
    $payload = json_decode($rawBody, true);

    // Automatically verifies signature and prevents replay attacks
    $paynotify->verifyWebhook($signatureHeader, $payload);

    if ($payload['status'] === 'VERIFIED') {
        // Unlock user content, update database, etc.
        echo json_encode(['success' => true]);
    }

} catch (\PayNotify\Exceptions\SignatureVerificationException $e) {
    http_response_code(401);
    echo json_encode(['error' => $e->getMessage()]);
}
```

---

API Reference
=============

[](#api-reference)

`new PayNotifyClient(string $apiKey, string $gatewayUrl = 'https://paypager.vercel.app')`
-----------------------------------------------------------------------------------------

[](#new-paynotifyclientstring-apikey-string-gatewayurl--httpspaypagervercelapp)

Creates a new PayNotify client instance.

---

`createOrder(float $baseAmount, string $customerName, string $idempotencyKey): array`
-------------------------------------------------------------------------------------

[](#createorderfloat-baseamount-string-customername-string-idempotencykey-array)

Creates a new payment order atomically.

### Parameters

[](#parameters)

ParameterTypeRequiredDescription`$baseAmount``float`✅Original payment amount`$customerName``string`✅Customer name shown in dashboards`$idempotencyKey``string`✅Prevents duplicate orders during retries. Must be a unique string per transaction.---

`verifyWebhook(?string $signatureHeader, array $payload, int $toleranceSeconds = 300): bool`
--------------------------------------------------------------------------------------------

[](#verifywebhookstring-signatureheader-array-payload-int-toleranceseconds--300-bool)

Validates webhook signatures using the stable string format: `orderId:amount:status:timestamp`

- Verifies `X-PayNotify-Signature` using HMAC-SHA256
- Prevents replay attacks using `$toleranceSeconds` (defaults to 5 minutes)
- Throws `SignatureVerificationException` on failure

---

Security Best Practices
=======================

[](#security-best-practices)

- Never expose API keys in frontend applications.
- Always verify webhook signatures using the SDK.
- Store `orderId` and assigned payment amounts in your database.
- Process only payments with status `VERIFIED`.
- Use HTTPS in all production environments.

---

License
=======

[](#license)

MIT License.

```
Copyright (c) PayNotify.

```

###  Health Score

35

—

LowBetter than 77% of packages

Maintenance91

Actively maintained with recent releases

Popularity1

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity36

Early-stage or recently created project

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~0 days

Total

3

Last Release

49d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/4ab72481810d43e44fe919aa36bb39d0412803eed81b3453e4389298019a0530?d=identicon)[suryanallamothu4](/maintainers/suryanallamothu4)

---

Top Contributors

[![ayyappavenkatasurya](https://avatars.githubusercontent.com/u/155008599?v=4)](https://github.com/ayyappavenkatasurya "ayyappavenkatasurya (4 commits)")

---

Tags

webhookpayment gatewayupipaynotify

### Embed Badge

![Health badge](/badges/paynotify-paynotify-php/health.svg)

```
[![Health](https://phpackages.com/badges/paynotify-paynotify-php/health.svg)](https://phpackages.com/packages/paynotify-paynotify-php)
```

###  Alternatives

[shetabit/payment

Laravel Payment Gateway Integration Package

952352.4k5](/packages/shetabit-payment)[shetabit/multipay

PHP Payment Gateway Integration Package

298368.9k4](/packages/shetabit-multipay)[cybersource/rest-client-php

Client SDK for CyberSource REST APIs

40975.8k6](/packages/cybersource-rest-client-php)[jomweb/billplz

PHP Agnostic library for working with BillPlz API

77203.3k3](/packages/jomweb-billplz)[luigel/laravel-paymongo

A laravel wrapper for Paymongo API

7965.9k1](/packages/luigel-laravel-paymongo)[tzsk/payu

PayU India Payment Gateway Integration with Laravel

47113.3k6](/packages/tzsk-payu)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)