Download the PHP package bayarcash/php-sdk without Composer

Bayarcash Payment Gateway PHP SDK

The Bayarcash SDK provides an expressive interface for interacting with Bayarcash's Payment Gateway API. It supports both API v2 (default) and v3, with additional features available in v3.

Table of Contents

• Requirements
• Installation
• Getting Started
  • Plain PHP
  • Laravel
  • Configuration
• Quick Start: Accept a Payment
• Payment Channels
• Payment Intents
• Handling Callbacks
• Payment & Transaction Status
• Transactions
• DuitNow QR
• FPX Direct Debit
• Manual Bank Transfer
• Portals & FPX Banks
• Error Handling
• Response Objects
• Security Recommendations
• Support

Requirements

• PHP 7.4 – 8.5
• ext-json
• Guzzle 7 (installed automatically)

Installation

Install via Composer:

Note: This package was previously published as webimpian/bayarcash-php-sdk. Existing installations using the old name continue to work, but new integrations should use bayarcash/php-sdk.

You will need two credentials from your Bayarcash console:

• API token — used to authenticate SDK requests.
• API secret key — used to generate request checksums and verify callbacks.

Getting Started

Plain PHP

Laravel

The service provider is auto-discovered. Add your credentials to .env:

Then resolve the SDK from the container:

To publish the config file:

Configuration

Call useSandbox() / setApiVersion() before making requests. Omit useSandbox() in production to hit the live gateway.

Quick Start: Accept a Payment

A complete FPX payment flow, from creating the payment to verifying the result:

After payment, Bayarcash calls your callback_url (server-to-server) and redirects the payer to your return_url. Verify both — see Handling Callbacks.

Payment Channels

Pass one of these constants (or an array of them) as payment_channel:

Payment Intents

Create a payment intent, then retrieve or cancel it later.

Request fields:

Checksum

The checksum protects the request from tampering. Generate it after building the request and append it as checksum:

The checksum is computed from payment_channel, order_number, amount, payer_name, and payer_email.

Idempotency (v3)

Pass a unique key (UUID v4) as the second argument to make a create safe to retry — a timed-out request can be re-sent with the same key without creating a duplicate intent:

Keys are scoped per portal and expire after 24 hours.

Payer identity verification (v3)

For a single FPX (Bayarcash::FPX) or FPX B2B (Bayarcash::FPX_B2B) intent, set verify_identity and add the payer's bank account number (fpx_eaccount_number) and ID — NRIC, passport, or business registration number (fpx_ebuyer_id):

The result comes back on the transaction as payerIdentityVerified (true/false/null) and fpxExtraInfo (account_type, account_number_verified, buyer_id_verified).

Retrieve or cancel (v3)

Handling Callbacks

Bayarcash sends two kinds of notification. Always verify them with your API secret key before trusting the data.

Each verifier returns true only when the checksum matches. See FPX Direct Debit for mandate-specific callback verifiers.

Payment & Transaction Status

Transaction status is an integer code. Use the Fpx helper instead of hardcoding numbers:

Transactions

The following query helpers require API v3 and throw an exception on v2:

DuitNow QR

Render a DuitNow QR on your own page instead of redirecting the payer to Bayarcash. Requires a single DuitNow QR channel and API v3.

1. Generate the QR while creating the intent (one step):

2. Poll the payment status while the payer scans:

3. Regenerate a fresh QR for an existing intent (e.g. after the previous one expired):

Both $intent->duitnowQr and regenerateDuitNowQr() return a DuitNowQrResource:

Webhooks to your callback_url are the primary notification path — polling is only a fallback. Respect next_poll_after_ms between polls and stop once the QR expires.

FPX Direct Debit

FPX Direct Debit lets you set up a recurring mandate and later maintain or terminate it. Constants live on the FpxDirectDebit class:

1. Enrolment

2. Maintenance

Update an existing mandate (identified by its mandate id):

3. Termination

Retrieving mandates & verifying mandate callbacks

Manual Bank Transfer

Submit a manual (offline) bank transfer with proof of payment:

Update the status of an existing transfer:

Portals & FPX Banks

Error Handling

Failed API calls throw typed exceptions. Catch them to handle errors gracefully:

Response Objects

API methods return typed resource objects. Common properties:

PaymentIntentResource (from createPaymentIntent / getPaymentIntent)

TransactionResource (from getTransaction / transaction queries)

Any missing field is null. Convert a resource (including nested resources) to an array:

Security Recommendations

1. Always send a checksum with payment and mandate requests.
2. Verify every callback with the provided verification methods before acting on it.
3. Store and check transaction ids to prevent duplicate processing.
4. Use HTTPS for your return_url and callback_url.
5. Keep your API token and secret key out of source control.

API Documentation

For full API details, see the Official Bayarcash API Documentation.

Support

For support questions, contact Bayarcash support or open an issue in this repository.

Changelog

See CHANGELOG.md for the version history.

License

Open-sourced software licensed under the MIT license.