Download the PHP package born-mt/mita-gpg-sdk without Composer
On this page you can find all versions of the php package born-mt/mita-gpg-sdk. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Informations about the package mita-gpg-sdk
Malta GPG SDK
A comprehensive PHP SDK for integrating with Malta's Government Payment Gateway (GPG) API. This package provides a clean, type-safe interface for processing payments through Malta's official payment infrastructure.
Features
- Complete API Coverage: All GPG endpoints (Hosted Payment Page, Transactions, Reporting)
- Type Safety: Full PHP 8.1+ enums and typed properties
- Payment Operations: SALE, AUTH, CAPTURE, REFUND, VOID
- Webhook Support: Built-in signature verification and payload parsing
- Exception Handling: Comprehensive error handling with specific exceptions
- Test Mode: Built-in sandbox support
- DTOs: Clean data transfer objects for requests and responses
- PSR Compliant: Follows PHP standards and best practices
- Framework Agnostic: Use with Laravel, Symfony, or any PHP project
Official Documentation
- API Documentation: https://gpgapi.redoc.ly/
- MITA GPG Info: https://mita.gov.mt/portfolio/information-systems/government-payment-gateway/
Installation
Install via Composer:
Requirements
- PHP 8.1 or higher
- ext-json
- guzzlehttp/guzzle ^7.5
Quick Start
Initialize the Client
Create a Simple Payment
Pre-Authorize and Capture
Handle Webhooks
Refund a Payment
Get Transaction Details
Get Transaction History
API Reference
GpgClient
The main client class for interacting with Malta GPG API.
Constructor
Methods
createPayment(PaymentRequest $request): PaymentResponse
Create a new Hosted Payment Page transaction.
capturePayment(string $transactionId, ?float $amount = null): PaymentResponse
Capture a pre-authorized payment (full or partial).
refundPayment(string $transactionId, ?float $amount = null): PaymentResponse
Refund a processed payment (full or partial).
voidPayment(string $transactionId): PaymentResponse
Cancel/void a pending or authorized transaction.
getTransaction(string $transactionId): array
Get details of a specific transaction.
getTransactions(array $filters = []): array
Get list of transactions with optional filters.
buildPaymentPageUrl(string $transactionId): string
Build the Hosted Payment Page URL for a transaction.
verifyWebhookSignature(string $payload, string $signature, string $secret): bool
Verify webhook signature using HMAC SHA256.
parseWebhook(string $payload, ?string $signature, ?string $secret): WebhookPayload
Parse and optionally verify webhook payload.
DTOs
PaymentRequest
Fluent Methods:
setAmount(float $amount)setCustomerEmail(string $email)setCustomerName(string $firstName, string $lastName)setDescription(string $description)setRedirectUrl(string $url)setCallbackUrl(string $url)addMetadata(string $key, mixed $value)setUdfField(int $fieldNumber, string $value)(1-5)
PaymentResponse
WebhookPayload
Enums
TransactionType
SALE- Immediate paymentAUTH- Pre-authorizationCAPTURE- Capture authorized paymentREFUND- Refund paymentVOID- Cancel transaction
TransactionStatus
PENDING- Payment initiatedPROCESSED- Payment successfulDECLINED- Payment declinedAUTHORIZED- Pre-authorizedREFUNDED- Payment refundedCANCELLED- Transaction cancelledFAILED- Technical failure
Exceptions
All exceptions extend GpgException:
- AuthenticationException (401) - Invalid API key
- ValidationException (400/422) - Request validation failed
- ApiException (4xx/5xx) - General API errors
- NetworkException - Connection/network errors
- InvalidSignatureException (403) - Webhook signature verification failed
Advanced Usage
Custom UDF Fields
Custom Metadata
Error Handling
Testing
Run the test suite:
Run with coverage:
Getting API Credentials
For Testing/Development
Contact GPG Support to request test API keys:
- Email: [email protected]
- Phone: +356 21234710
- Mention you need sandbox/test credentials
For Production
- Open merchant accounts with BOV and/or HSBC Malta
- Ensure accounts are 3D Secure enabled
- Raise an eRFS (electronic Request for Service) to MITA
- Provide your bank account details and business information
- Wait for approval (processing time varies)
- Receive production API credentials
Security Best Practices
- Never commit API keys - Use environment variables
- Always verify webhook signatures - Prevent spoofing
- Use HTTPS - Required for production
- Validate amounts - Check amounts match your records
- Log everything - Keep audit trail of transactions
- Handle errors gracefully - Don't expose internal details to users
- Test thoroughly - Use test mode before production
- Monitor webhooks - Alert on missed/failed webhooks
Payment Flow
- Customer initiates payment on your website
- Create payment via API (POST /api/HostedPaymentPage)
- Redirect customer to GPG Hosted Payment Page
- Customer enters card details on secure GPG page
- 3D Secure authentication by customer's bank
- Payment processed by acquiring bank
- Customer redirected back to your site
- Webhook sent with final transaction status
- Update your database based on webhook
Support
- GPG Support: [email protected]
- MITA: [email protected] / +356 21234710
- Documentation: https://gpgapi.redoc.ly/
- Issues: https://github.com/born-mt/mita-gpg-sdk/issues
Contributing
Contributions are welcome! Please feel free to submit a Pull Request.
License
The MIT License (MIT). Please see License File for more information.
Credits
- Born MT - https://born.mt
- Malta Information Technology Agency (MITA) - https://mita.gov.mt
- APCOPay - Payment gateway provider
Changelog
1.0.0 (2025-01-05)
- Initial release
- Full API coverage
- Webhook support
- Comprehensive documentation
Made with ❤️ in Malta