Download the PHP package lahiru/laravel-solidgate without Composer

Laravel SolidGate

Laravel package for the SolidGate payment gateway. Use the facade or dependency injection, get typed responses, and call 74+ API endpoints with correct HMAC-SHA512 signing and sensible defaults.

Good for: server-side card/APM charges, subscriptions, hosted checkout, embedded payment forms, webhooks, and reporting.

Table of Contents

Getting started

• Features
• Requirements
• Installation
• Configuration
• Choose your integration
• Using the package in Laravel
• Quick Start

Checkout (customer-facing)

• Checkout integrations
  • Payment Page (hosted)
  • Payment Form (embedded)

Server-side API

• Card Payments
• Alternative Payments (APM)
• Subscriptions
• Products, Taxes & Reporting
• Webhooks

Reference

• Responses & Error Handling
• Helper Classes
• Troubleshooting
• API Reference Map
• Development
• Changelog
• License & References

Features

Requirements

• PHP 8.2+
• Laravel 10.x, 11.x, 12.x, or 13.x (Laravel 13 requires PHP 8.3+)

Installation

Publish the config (recommended):

Copy environment variables from .env.example:

Configuration

Get your keys from SolidGate Hub → Developers → Channel details:

Environment variables

Tip: Each API group uses a different base URL. Card payments go to pay.solidgate.com, subscriptions to subscriptions.solidgate.com, APM to gate.solidgate.com, and reports to reports.solidgate.com. The package routes these automatically — you only call the facade methods.

Config file (config/solidgate.php)

After publishing, keys are read from config('solidgate.public_key') and config('solidgate.secret_key') (backed by SOLIDGATE_* env vars).

Choose your integration

Pick the flow that matches your product. All options below use this package on the server; only Payment Form also needs frontend JS.

Using the package in Laravel

Facade (typical)

Dependency injection (testable)

Signing helper (Payment Form)

Uses the same HMAC-SHA512 algorithm as outbound API requests and webhook verification.

Quick Start

Three-minute path to a successful server-side charge. For hosted or embedded checkout, jump to Checkout integrations.

1. Make your first charge

platform and payment_type are auto-filled from config when omitted. Card expiry fields are normalized automatically (3 → "03", year cast to integer).

2. Full controller example

3. Recurring / token payment

Checkout integrations

Customer-facing checkout using Solidgate UI. For server-side card capture without Solidgate JS, see Card Payments.

Payment Page (hosted)

When to use: you want checkout live quickly with almost no frontend work.

Flow

1. Laravel calls SolidGate::createPaymentPage(['order' => [...], 'page_customization' => [...]]).
2. API returns a url (expires in ~24 hours).
3. Redirect the customer with redirect()->away($url).
4. After payment, Solidgate sends the user to your success_url or fail_url.

API

Minimal example

Controller + route

Subscriptions / catalog: use product_price_id in order (from SolidGate::getProductPrices()). See Create your payment page.

Checklist

• [ ] Unique order_id per checkout attempt
• [ ] Public ip_address (not 127.0.0.1 in production)
• [ ] success_url and fail_url registered and reachable
• [ ] Store id from response if you need deactivatePaymentPage() later

Payment Form (embedded)

When to use: checkout must match your site design and stay on the same URL.

Flow

1. Build a paymentIntent array (amount, currency, order_id, customer, URLs, etc.).
2. Server returns merchantData: merchant, signature, paymentIntent (encrypted).
3. Blade loads https://cdn.solidgate.com/js/solid-form.js and calls PaymentFormSdk.init({ merchantData }).

merchantData shape (passed to JS)

App helper — copy to app/Services/SolidgatePaymentForm.php (no extra Composer package):

Encryption matches Solidgate’s without-SDK PHP guide.

Controller

Field reference: paymentIntent object.

Blade

Checklist

• [ ] Never expose SOLIDGATE_SECRET_KEY to the browser
• [ ] New order_id on every payment attempt
• [ ] Public ip_address
• [ ] Load solid-form.js only once (duplicate script causes init warnings)
• [ ] Dynamic amount/plan changes: update payment form

Optional: Official solidgate/php-sdk exposes $api->formMerchantData($paymentIntent) if you prefer not to maintain the encrypt helper.

Card Payments

Server-side card processing (you send PAN/CVV from your backend). For Solidgate-hosted or embedded UI instead, see Checkout integrations.

All card endpoints use the pay API (pay.solidgate.com/api/v1/).

Required fields for charge()

For token payments, omit card fields and pass payment_type + recurring_token instead.

Available methods

Alternative Payments (APM)

APM endpoints use the gate API (gate.solidgate.com/api/), not the pay API.

Note: Card recurring uses recurring_token. APM recurring uses token. These are different field names per SolidGate API spec.

Subscriptions

All subscription endpoints use subscriptions.solidgate.com/api/v1/.

Products, Taxes & Reporting

Webhooks

Receive async events (card_gate.order.updated, chargebacks, etc.) on a Laravel route with signature verification.

Setup

The package registers POST /solidgate/webhook with signature verification middleware.

Exclude from CSRF (Laravel 11+):

Incoming headers

Handle events

Manual signature verification

Responses & Error Handling

SolidGate has two types of errors. Handle both:

Response helpers

Helper Classes

Platform — customer device

PaymentType — CIT / MIT classification

SolidGateConstants — currency formatting

RefundReason / CancelSubscriptionReason

Official reason codes — see Refund Reasons and Cancel Codes.

Troubleshooting

Payment Page or Form fails to load

Platform is empty or invalid (error 2.01)

Add platform to your request or rely on the config default:

Config default: SOLIDGATE_DEFAULT_PLATFORM=WEB

Invalid IP — private IP rejected

SolidGate rejects private IPs (127.0.0.1, 192.168.x.x, etc.). When testing locally:

In production, always pass the customer's public IP from the frontend or a trusted proxy header.

HTTP 200 but payment failed

SolidGate returns HTTP 200 with an error object for validation failures. Always check isSuccessful() — do not rely on HTTP status alone.

Wrong API base URL

Enable request logging

Logs URL, method, status, and response to Laravel's log channel at debug level.

API Reference Map

Full API spec: api-docs.solidgate.com

Development

CI runs on every push and pull request via GitHub Actions:

Changelog

See CHANGELOG.md for full history.

1.0.2 — APM gate endpoints, PaymentType/Platform helpers, error formatting, routing reports.

1.0.1 — HMAC signing fix, endpoint path corrections, webhook validation, unit tests.

License & References

MIT — see LICENSE.