Download the PHP package pongsit/scb without Composer
On this page you can find all versions of the php package pongsit/scb. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Package scb
Short Description SCB Partners API (Thai QR bill payment) — framework agnostic
License MIT
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package scb
pongsit/scb
SCB Partners API (Thai PromptPay bill-payment QR) for PHP 7.4+.
No framework, no dependencies beyond ext-curl and ext-json — drop it into a
plain-PHP app, a Laravel app, or anything else.
Why this exists
Every project that takes money re-implements the same four calls, and the same
mistake keeps coming with it: trusting the webhook body. The callback endpoint
is public and SCB signs nothing, so anyone can POST {"amount": "5000.00"}.
This package never reads the amount from the request — it re-fetches the
transaction from SCB over an authenticated call and compares that amount to
what your application says is due.
Install
Configure
env decides the host. Nothing else changes between environments, so a project
can run against sandbox until the day it goes live.
Show a QR
ref1/ref2/ref3 must be 1–20 characters of A-Z0-9; the package uppercases
and validates them instead of letting SCB reject the call later.
Creating a QR moves no money — safe to call while testing.
Take the callback
Implement three methods so the package can check the payment without knowing anything about your schema:
Then the endpoint SCB calls:
handle() returns a WebhookResult with one of:
| status | meaning | settle() called |
|---|---|---|
settled |
amount confirmed and sufficient | yes |
already_settled |
SCB retried a callback | no |
underpaid |
SCB confirms less than is due | no |
unknown_reference |
expectedAmount() returned null |
no |
not_found |
SCB has no record of the transaction | no |
invalid_payload |
body was not usable JSON | no |
The package acknowledges every case with SCB's expected resCode 00. Retrying
will not turn an underpayment into a full one, and an unacknowledged callback is
retried forever.
Verify a payment yourself
Prefer byReference(). byTransactionId() needs the payer's bank code, which
is not always 014 — a payer on another bank will not be found if you
hardcode it.
Rules the package enforces
- The amount always comes from SCB, never from the request body.
- Less than the expected amount is never settled.
- A reference the application does not recognise is never settled.
- A repeated callback settles once.
requestUIdis a fresh UUID per call, not a user id.- Credentials are never written to the log callback.
Tests
No network, no database — covers the money rules above.
All versions of scb with dependencies
ext-curl Version *
ext-json Version *