SyncroPay API
приём и выплаты

https://pay.syncropay.tech/api

x-api-token: sk_live_ваш_секретный_токен
Content-Type: application/json

curl -X POST https://pay.syncropay.tech/api/v4/order/create \
  -H "x-api-token: sk_live_ваш_токен" \
  -H "Content-Type: application/json" \
  -d '{
    "order_id": "ORDER-10245",
    "amount": 1500,
    "cred_type": 1,
    "return_url": "https://shop.example/success"
  }'

const res = await fetch("https://pay.syncropay.tech/api/v4/order/create", {
  method: "POST",
  headers: {
    "x-api-token": process.env.SYNCROPAY_TOKEN,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    order_id: "ORDER-10245", amount: 1500, cred_type: 1,
    return_url: "https://shop.example/success",
  }),
});
const data = await res.json();
// data.redirect_url → редирект клиента; data.cred_formatted → карта

import os, requests

res = requests.post(
    "https://pay.syncropay.tech/api/v4/order/create",
    headers={"x-api-token": os.environ["SYNCROPAY_TOKEN"]},
    json={
        "order_id": "ORDER-10245",
        "amount": 1500,
        "cred_type": 1,
    },
)
data = res.json()  # data["redirect_url"], data["cred_formatted"]

{
  "status": "ok",
  "order_id": "ORDER-10245",
  "transaction_id": 100251,
  "amount": 1500,
  "amount_initial": 1500,
  "usdt_amount": 36.14,
  "usdt_rate": 41.5,
  "status_id": 2,
  "bank_name": "Mono",
  "receiver_name": "IVAN P.",
  "cred": "5375411234567890",
  "cred_formatted": "5375 41** **** 7890",
  "cred_type": 1,
  "redirect_url": "https://pay.syncropay.tech/checkout/pk_9f3c...e1",
  "deadline": "2026-07-09T12:20:00.000Z"
}

{
  "status": "ok",
  "order_data": {
    "order_id": "ORDER-10245",
    "transaction_id": "100251",
    "amount": "1500.00",
    "amount_initial": "1500.00",
    "commission": "30.00",
    "merch_amount": "1470.00",
    "usdt_amount": "36.14",
    "usdt_rate": "41.5",
    "cred": "5375411234567890",
    "cred_formatted": "5375 41** **** 7890",
    "receiver_name": "IVAN P.",
    "receiver_bank": "Mono",
    "status_id": "5",
    "deadline": "2026-07-09T12:20:00.000Z"
  }
}

curl -X POST https://pay.syncropay.tech/api/v2/payout/create \
  -H "x-api-token: sk_live_ваш_токен" \
  -H "Content-Type: application/json" \
  -d '{
    "order_id": "PAYOUT-556",
    "amount": 3200,
    "cred": "5375411234567890",
    "cred_type": 1,
    "recipient_name": "Іван Петренко",
    "receiver_bank": "ПриватБанк"
  }'

const res = await fetch("https://pay.syncropay.tech/api/v2/payout/create", {
  method: "POST",
  headers: {
    "x-api-token": process.env.SYNCROPAY_TOKEN,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    order_id: "PAYOUT-556", amount: 3200,
    cred: "5375411234567890", cred_type: 1,
    recipient_name: "Іван Петренко",
  }),
});

{
  "status": "ok",
  "payout_id": "100252",
  "payout_type": "CARD",
  "amount": "3200.00",
  "commission": "48.00",
  "final_amount": "3248.00",
  "cred_formatted": "5375 41** **** 7890",
  "currency": { "id": "1", "code": "UAH", "title": "UAH" },
  "receiver_country": "UA",
  "receiver_bank": "ПриватБанк"
}

{
  "order_id": "ORDER-10245",
  "transaction_id": 100251,
  "amount": "1500.00",
  "amount_initial": "1500.00",
  "commission": "30.00",
  "merch_amount": "1470.00",
  "status_id": 5,
  "cred": "5375411234567890",
  "cred_type": "1",
  "receiver_name": "IVAN P.",
  "receiver_bank": "Mono"
}

{
  "status": "ok",
  "payout_id": "100252",
  "order_id": "PAYOUT-556",
  "type": "CARD",
  "amount": "3200.00",
  "commission": "48.00",
  "final_amount": "3248.00",
  "payout_status": "COMPLETED",
  "cred_formatted": "5375 41** **** 7890",
  "currency": { "id": "1", "code": "UAH", "title": "UAH" },
  "country_iso": "UA"
}

import crypto from "node:crypto";

// нужно СЫРОЕ тело — express.raw({ type: "application/json" })
app.post("/callback", express.raw({ type: "*/*" }), (req, res) => {
  const got = req.headers["x-signature"];
  const exp = crypto.createHmac("sha256", process.env.SYNCROPAY_SECRET)
                     .update(req.body).digest("hex");
  const a = Buffer.from(got || ""), b = Buffer.from(exp);
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b))
    return res.sendStatus(401);

  const cb = JSON.parse(req.body);
  if (cb.status_id === 5) markOrderPaid(cb.order_id);
  res.sendStatus(200);
});

// $raw — сырое тело: file_get_contents("php://input")
$raw = file_get_contents("php://input");
$got = $_SERVER["HTTP_X_SIGNATURE"] ?? "";
$exp = hash_hmac("sha256", $raw, getenv("SYNCROPAY_SECRET"));

if (!hash_equals($exp, $got)) { http_response_code(401); exit; }

$cb = json_decode($raw, true);
if ((int)$cb["status_id"] === 5) markOrderPaid($cb["order_id"]);
http_response_code(200);