GLODIPAY SERVER-TO-SERVER CARD API SPECIFICATION

Ask AI

VERSION 2.0.0

Table of Contents

• Introduction
• Endpoints
• Signature
• POST PAYMENT
• TRANSACTION QUERY
• NOTIFICATION
• Simulating Payments

Use the Test environment. No real charges are made.

Without 3DS	4111 1111 1111 1111	01/30	029	—
Without 3DS	5555 5555 5555 4444	01/30	029	—
3DS Payment	4012 8888 8888 1881	01/30	029	Success: 123456 / Fail: 111111
3DS Payment	5111 1111 1111 1118	01/30	029	Success: 123456 / Fail: 111111
3DS Payment	4141 4141 4141 4141	12/30	123	Success: 123456 / Fail: 111111

• Appendix
  • Status Values
  • Status Codes
  • Currency Codes
  • Country Codes
  • Card Types
• Code Examples
  • PHP
  • Node.js

Introduction

This document describes the GLODIPAY Server-to-Server (S2S) Card API v2, which allows merchants to submit card payment details directly from their own server, without redirecting the buyer to a GLODIPAY-hosted page.

Key features:

• Direct card submission: Card number, expiry, and CVV are sent in the API request. The merchant is responsible for collecting card details securely on their own page (PCI DSS compliance required).
• Auto-Cascade: When enabled, the gateway automatically retries failed charges across multiple providers. Only the final outcome is returned.
• 3DS support: If the provider requires 3D Secure authentication, a redirect response is returned with a URL to complete verification. After 3DS, the result is sent via IPN and buyer is redirected.

Endpoints

Test	Get it from the API Keys page of the Sandbox Merchant Dashboard
Production	Get it from the API Keys page of the Merchant Dashboard

Signature

All requests and responses are signed using RSA with MD5 to ensure integrity and authenticity.

Generating a Signature (Merchant -> GLODIPAY)

Sign request payloads with your RSA Private Key (obtained from the Merchant Dashboard).

Steps:

• Collect all request parameters except signature as a flat key-value object.
• Sort the keys in natural ascending order (SORT_NATURAL / localeCompare with numeric: true).
• Trim whitespace from all string values (recursive).
• Serialize to JSON string with all non-ASCII Unicode characters escaped to \uXXXX (RFC 8259).
• Sign with md5WithRSAEncryption using your RSA Private Key.
• Base64-encode the binary output.

Verifying a Signature (GLODIPAY -> Merchant)

Verify GLODIPAY responses and webhooks with the RSA Public Key (available in the Portal).

Steps:

• Separate signature from the payload.
• Sort remaining keys in natural ascending order.
• Trim all string values (recursive).
• Serialize to JSON string with all non-ASCII Unicode characters escaped to \uXXXX (RFC 8259).
• Verify with md5WithRSAEncryption using your RSA Public Key.
• Return value 1 = valid.

Note (Node.js): Convert all numeric values to strings before sorting/serializing. Escape forward slashes in the JSON string: .replace(///g, '/').

Note (Unicode / RFC 8259): The JSON payload must escape all non-ASCII Unicode characters (e.g., "a with accent" must become "\u00e1") before signing -- this is required by RFC 8259. In PHP, json_encode($data) does this by default -- do not use JSON_UNESCAPED_UNICODE. In Node.js, JSON.stringify() does not escape Unicode by default -- apply: .replace(/[^\\x00-\\x7F]/g, c => "\\u" + c.charCodeAt(0).toString(16).padStart(4, "0")) after serializing.

POST PAYMENT

Submit card details directly from your server to process a card payment.

Endpoint: POST /v2/card/api Method: POST Content-Type: application/json

Request Parameters

merchantId	String(1,50)	M	Merchant's ID
orderRef	String(1,250)	M	Unique transaction reference per merchant
amount	Float	M	Invoice amount. Minimum: 1. Up to 2 decimal places
currency	String(3)	M	ISO 4217 currency code. E.g. USD
cancelUrl	String(1,300)	M	URL to redirect buyer on cancellation. Must be https
callbackUrl	String(1,300)	M	URL to redirect buyer after successful payment. Must be https
notificationUrl	String(1,300)	M	Your server endpoint to receive IPN webhooks. Must be https
errorUrl	String(1,300)	M	URL to redirect buyer on error. Must be https
orderDescription	String(max:3000)	M	Short description of the order
metadata	JSON	O	Key-value pairs attached to the session. Returned in IPN and query responses
transactionDocuments	JSON	O	Supporting documents for the transaction
paymentMethod	String	M	Must be card for S2S card payments
feeBySeller	Number(0-100)	O	Percentage of processing fee paid by merchant. 0 = buyer pays 100%. Up to 2 decimal places
billingFirstName	String(max:255)	M	Billing first name
billingLastName	String(max:255)	M	Billing last name
billingStreet1	String(max:255)	M	Billing street address line 1
billingStreet2	String(max:255)	O	Billing street address line 2
billingCity	String(max:255)	M	Billing city
billingEmail	String(max:255)	M	Buyer email address
billingState	String(min:2, max:255)	C	Billing state / province. Required when billingCountry is US or CA
billingCountry	String	M	ISO 3166-1 alpha-2 country code
billingPostalCode	String(max:25)	M	Postal / ZIP code
billingPhoneCountryCode	String(max:10)	O	Phone country code. E.g. 1 for US
billingPhoneNumber	String(max:30)	M	Phone number
cardNumber	String(12,19)	M	Card number. E.g. 4111111111111111
cardMonth	String	M	Expiry month. E.g. 12
cardYear	String	M	Expiry year (2-digit). E.g. 30
cardSecurityCode	String(3,4)	M	CVV / CVC
customerIp	String	M	IP address of the customer
websiteUrl	String(max:300)	O	Merchant website URL
signature	String(max:750)	M	RSA-MD5 signature. See Signature
expiresAt	String	O	Session expiry in ISO 8601 format. Default: 24 hours
browserDetails	JSON	M	Browser fingerprint. See browserDetails Object

M = Mandatory, O = Optional, C = Conditional

browserDetails Object

Required on every S2S card request. Can be submitted as a JSON object (nested) or a JSON-encoded string. Keys are snake_case as listed below; camelCase keys are accepted and normalized.

accept_header	String	M	Browser Accept header. E.g. text/html,application/xhtml+xml
screen_width	String	M	Screen width in pixels. E.g. 1920
screen_height	String	M	Screen height in pixels. E.g. 1080
screen_color_depth	String	M	Screen color depth in bits. E.g. 24
window_width	String	M	Viewport width in pixels. E.g. 1440
window_height	String	M	Viewport height in pixels. E.g. 900
language	String	M	Browser language. E.g. en-US
java_enabled	String	M	Whether Java is enabled. "true" or "false"
user_agent	String	M	Browser user agent string
time_zone	String	M	UTC offset in hours. E.g. 7 for UTC+7
time_zone_name	String	M	IANA timezone name. E.g. Asia/Ho_Chi_Minh
languages	Array<String>	O	Ordered list of browser preferred languages. E.g. ["vi-VN", "en-US", "en"]
platform	String(max:255)	O	Browser platform identifier. E.g. Win32, MacIntel, Linux x86_64
cookieEnabled	Boolean	O	Indicates whether cookies are enabled in the browser
online	Boolean	O	Indicates whether the browser reports an active network connection
hardwareConcurrency	Integer	O	Number of logical CPU cores available to the browser. E.g. 8, 16
deviceMemory	Number	O	Approximate device memory in GB reported by the browser. E.g. 4, 8, 16. May be unavailable on some browsers
availWidth	Integer	O	Available screen width excluding OS UI elements such as taskbars and docks
availHeight	Integer	O	Available screen height excluding OS UI elements such as taskbars and docks
currentUrl	String(max:2048)	O	Full URL of the page where the payment request originated
hostname	String(max:255)	O	Hostname (domain) of the current page. E.g. example.com

JavaScript snippet to collect browserDetails:

const browserDetails = {
  accept_header: 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
  screen_width: String(window.screen.width),
  screen_height: String(window.screen.height),
  screen_color_depth: String(window.screen.colorDepth),
  window_width: String(window.innerWidth),
  window_height: String(window.innerHeight),
  language: navigator.language || navigator.userLanguage,
  java_enabled: String(navigator.javaEnabled ? navigator.javaEnabled() : false),
  user_agent: navigator.userAgent,
  time_zone: String(-new Date().getTimezoneOffset() / 60),
  time_zone_name: Intl.DateTimeFormat().resolvedOptions().timeZone,

  // ── Recommended fields (improves approval rate) 
  languages: navigator.languages,
  platform: navigator.platform,
  cookieEnabled: navigator.cookieEnabled,
  online: navigator.onLine,
  hardwareConcurrency: navigator.hardwareConcurrency,
  deviceMemory: navigator.deviceMemory || "N/A",
  availWidth: screen.availWidth,
  availHeight: screen.availHeight,
  currentUrl: location.href,
  hostname: location.hostname,
};

Example Request

{
  "merchantId": "1100000123",
  "orderRef": "ORDER-001",
  "amount": "100.00",
  "currency": "USD",
  "paymentMethod": "card",
  "callbackUrl": "https://yoursite.com/callback",
  "notificationUrl": "https://yoursite.com/webhook",
  "cancelUrl": "https://yoursite.com/cancel",
  "errorUrl": "https://yoursite.com/error",
  "websiteUrl": "https://yoursite.com",
  "orderDescription": "Test order",
  "billingFirstName": "John",
  "billingLastName": "Doe",
  "billingStreet1": "123 Main St",
  "billingStreet2": "",
  "billingCity": "New York",
  "billingEmail": "john@example.com",
  "billingState": "NY",
  "billingCountry": "US",
  "billingPostalCode": "10001",
  "billingPhoneCountryCode": "1",
  "billingPhoneNumber": "5551234567",
  "cardNumber": "4111111111111111",
  "cardMonth": "12",
  "cardYear": "30",
  "cardSecurityCode": "123",
  "customerIp": "1.2.3.4",
  "browserDetails": {
    "accept_header": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
    "screen_width": "1920",
    "screen_height": "1080",
    "screen_color_depth": "24",
    "window_width": "1440",
    "window_height": "900",
    "language": "en-US",
    "java_enabled": "false",
    "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
    "time_zone": "7",
    "time_zone_name": "Asia/Ho_Chi_Minh"
  },
  "signature": "base64-encoded-signature"
}

Response

Content-Type: application/json

Transaction completed (no 3DS required):

{
  "status": "success",
  "message": "The transaction has been successfully completed.",
  "data": {
    "transactionId": "01jwz13qfcx4z61ded3jcj0tf2"
  }
}

3DS authentication required:

{
  "status": "redirect",
  "message": "Please redirect the user to complete the payment.",
  "data": {
    "transactionId": "01jwz0ty1640apxvmyzqpvc18a",
    "url": "https://payment.gpayprocessing.com/card/3ds/01jwz0ty1640apxvmyzqpvc18a"
  }
}

Redirect the buyer to data.url to complete 3DS. After verification, GLODIPAY processes the transaction and sends the result via IPN to notificationUrl and redirects the buyer to callbackUrl.

Pending (awaiting PSP confirmation):

{
  "status": "pending",
  "message": "pending",
  "data": {
    "transactionId": "01jwz0ty1640apxvmyzqpvc18a"
  }
}

Validation error (HTTP 422):

{
  "status": "error",
  "message": "Invalid request data.",
  "errors": [
    {
      "field": "billingEmail",
      "message": ["The billing email field is required."]
    }
  ]
}

Processing error (HTTP 400/500):

{
  "status": "error",
  "message": "No payment provider could process this transaction. Please try again or contact support.",
  "data": {
    "transactionId": "01jwz0ty1640apxvmyzqpvc18a"
  }
}

Auto-Cascade: When enabled for the merchant account, the gateway automatically retries the card charge across all active PSPs in priority order before returning a final response. Individual PSP failures are suppressed during the cascade -- only the final outcome is returned and sent via IPN.

TRANSACTION QUERY

Query the current status and full details of a transaction.

Endpoint: POST /v2/checkout/query Method: POST Content-Type: application/json

Request

transactionId	String (ULID)	M	GLODIPAY transaction ID
signature	String(max:750)	M	RSA-MD5 signature

Response

Content-Type: application/json

merchantId	String	Merchant's ID
transactionId	String	GLODIPAY transaction ID (ULID)
transactionNumber	String	GLODIPAY human-readable transaction number
ref	String	Merchant's orderRef
currency	String	ISO 4217 currency code
amount	Float	Invoice amount
paidAmount	Float	Amount actually charged to buyer (including buyer fees)
settlementAmount	Float	Amount to be settled to merchant
estimationSettlementAt	ISO 8601 datetime	Estimated settlement datetime
fees	JSON	Fee breakdown. See fees Object
status	String	Transaction status. See Status Values
statusCode	Number	Numeric status code. See Status Codes
metadata	JSON	Key-value pairs from the original session
transactionDocuments	JSON	Supporting documents
paymentMethodDetails	JSON	Payment method used. See paymentMethodDetails Object
message	String	Human-readable status message
descriptor	String	Transaction descriptor
transactionCreatedAt	ISO 8601 datetime	Transaction creation time in GLODIPAY system
originalTransactionCreatedAt	ISO 8601 datetime	Transaction creation time at the PSP
signature	String	RSA-MD5 signature -- verify with GLODIPAY public key

NOTIFICATION

GLODIPAY sends an HTTP POST to your notificationUrl when a transaction reaches a terminal state.

Method: POST Content-Type: application/json

Retry policy: GLODIPAY may re-send the IPN for transactions that have not been acknowledged. Your server should return {"returnCode":"100"} as soon as the notification is received.

Payload

merchantId	String	M	Merchant's ID
transactionId	String	M	GLODIPAY transaction ID (ULID)
transactionNumber	String	M	GLODIPAY human-readable transaction number
ref	String	M	Merchant's orderRef
currency	String	M	ISO 4217 currency code
amount	Float	M	Invoice amount
paidAmount	Float	O	Amount actually charged to buyer (including buyer fees)
settlementAmount	Float	O	Amount to be settled to merchant
estimationSettlementAt	ISO 8601 datetime	O	Estimated settlement datetime
fees	JSON	O	Fee breakdown. See fees Object
paymentMethodDetails	JSON	O	Payment method used. See paymentMethodDetails Object
status	String	M	Transaction status. See Status Values
statusCode	Number	M	Numeric status code. See Status Codes
metadata	JSON	O	Key-value pairs from the original session
transactionDocuments	JSON	O	Supporting documents
message	String	O	Human-readable status message
descriptor	String	O	Transaction descriptor
transactionCreatedAt	ISO 8601 datetime	M	Transaction creation time in GLODIPAY system
originalTransactionCreatedAt	ISO 8601 datetime	M	Transaction creation time at the PSP
signature	String	M	RSA-MD5 signature -- verify with GLODIPAY public key

fees Object

buyer	Float	Buyer-facing fee amount
seller	Float	Merchant fee amount
rolling	Float	Rolling reserve amount
operate	Float	Total operating fees (processor + GLODIPAY + partner)
estimationRollingReleaseAt	ISO 8601 datetime	Estimated rolling reserve release datetime

paymentMethodDetails Object

displayName	String	Payment method label
group	String	Payment method group type
family	String	Payment method family type
type	String	Payment method type
{type}	JSON	Optional. Payment method-specific details. Key equals the type value (e.g. card). Only present for card payments when card details are available. See card Object below.

card Object (paymentMethodDetails.card)

name	Cardholder name
firstSixDigits	First 6 digits of card number (BIN)
lastFourDigits	Last 4 digits of card number
expiryMonth	Expiry month (MM)
expiryYear	Expiry year (YY)
type	Card brand (visa, mastercard, amex, etc.)
issuer	Issuing bank name (provider-dependent)
issuerCountryCode	ISO 3166-1 alpha-2 country code of issuing bank (provider-dependent)
funding	Card funding type (credit, debit, prepaid) (provider-dependent)
authorizationCode	Authorization code from issuer (provider-dependent)
clientIP	Customer IP address at time of payment (provider-dependent)
checks	AVS/CVC verification results (provider-dependent)
threeDSecure	3D Secure authentication details (provider-dependent)

Example IPN Payload:

{
  "merchantId": "1100000123",
  "transactionId": "01jwz13qfcx4z61ded3jcj0tf2",
  "transactionNumber": "2604-1713100800",
  "ref": "ORDER-001",
  "currency": "USD",
  "amount": 100.00,
  "paidAmount": 105.00,
  "settlementAmount": 95.00,
  "estimationSettlementAt": "2026-04-16T00:00:00+00:00",
  "fees": {
    "buyer": 5.00,
    "seller": 5.00,
    "rolling": 2.00,
    "operate": 3.00,
    "estimationRollingReleaseAt": "2026-05-14T00:00:00+00:00"
  },
  "status": "successful",
  "statusCode": 6,
  "paymentMethodDetails": {
    "displayName": "Credit / Debit Card",
    "group": "card",
    "family": "card",
    "type": "card"
  },
  "metadata": { "orderId": "12345" },
  "transactionCreatedAt": "2026-04-14T10:00:00+00:00",
  "originalTransactionCreatedAt": "2026-04-14T10:00:01+00:00",
  "signature": "base64-encoded-rsa-signature"
}

Response (Merchant -> GLODIPAY)

Your server must respond within 30 seconds:

{
  "returnCode": "100",
  "description": "Received"
}

returnCode	String	R	Must be "100" to acknowledge receipt
description	String(1,1500)	O	Optional description

Simulating Payments

Use the Test environment. No real charges are made.

Without 3DS	4111 1111 1111 1111	01/30	029	—
Without 3DS	5555 5555 5555 4444	01/30	029	—
3DS Payment	4012 8888 8888 1881	01/30	029	Success: 123456 / Fail: 111111
3DS Payment	5111 1111 1111 1118	01/30	029	Success: 123456 / Fail: 111111
3DS Payment	4141 4141 4141 4141	12/30	123	Success: 123456 / Fail: 111111

Appendix

Status Values

String values returned in the status field of IPN payloads and query responses.

incomplete	Transaction initiated, awaiting action
pending	Awaiting payment confirmation
under_review	Transaction under review
successful	Payment completed successfully
failed	Payment failed
error	System error occurred
canceled	Transaction canceled
rejected	Transaction rejected
expired	Transaction expired
processed	Transaction was submitted to the payment provider
released	Funds released / settled
documents_uploaded	Supporting documents uploaded
refund_initiated	Refund request initiated
refund_under_review	Refund under review
refund_successful	Refund completed successfully
refund_failed	Refund failed
refund_partially_successful	Partial refund completed
refund_partially_failed	Partial refund failed
void_initiated	Void initiated
void_under_review	Void under review
void_successful	Void completed successfully
void_failed	Void failed
void_partially_successful	Partial void completed
void_partially_failed	Partial void failed
chargeback_alert	Chargeback alert received
chargebacked	Transaction chargebacked
dispute	Dispute opened

Status Codes

Numeric code in the statusCode field of IPN payloads and query responses.

1	incomplete	Transaction initiated
2	pending	Pending confirmation
3	error	System error
4	failed	Payment failed
5	under_review	Under review
6	successful	Payment successful
7	released	Released / settled
8	refund_initiated	Refund initiated
9	refund_failed	Refund failed
10	refund_under_review	Refund under review
11	refund_successful	Refund successful
12	refund_partially_failed	Partial refund failed
13	refund_partially_successful	Partial refund successful
14	canceled	Canceled
15	rejected	Rejected
16	expired	Expired
17	documents_uploaded	Documents uploaded
18	void_initiated	Void initiated
19	void_under_review	Void under review
20	void_successful	Void successful
21	void_failed	Void failed
22	void_partially_successful	Partial void successful
23	void_partially_failed	Partial void failed
24	chargeback_alert	Chargeback alert
25	chargebacked	Chargebacked
26	dispute	Dispute opened
27	processed	Processed

Currency Codes

GLODIPAY follows the ISO 4217 standard. The accepted currency depends on the payment provider configured for your merchant account. Common supported values:

USD	United States Dollar
EUR	Euro
GBP	Pound Sterling
AUD	Australian Dollar
AED	UAE Dirham
VND	Vietnamese Dong

Country Codes

GLODIPAY uses ISO 3166-1 alpha-2 two-letter codes for billingCountry.

AD	Andorra
AE	United Arab Emirates
AF	Afghanistan
AG	Antigua and Barbuda
AI	Anguilla
AL	Albania
AM	Armenia
AO	Angola
AQ	Antarctica
AR	Argentina
AS	American Samoa
AT	Austria
AU	Australia
AW	Aruba
AX	Åland Islands
AZ	Azerbaijan
BA	Bosnia and Herzegovina
BB	Barbados
BD	Bangladesh
BE	Belgium
BF	Burkina Faso
BG	Bulgaria
BH	Bahrain
BI	Burundi
BJ	Benin
BL	Saint Barthélemy
BM	Bermuda
BN	Brunei Darussalam
BO	Bolivia, Plurinational State of
BQ	Bonaire, Sint Eustatius and Saba
BR	Brazil
BS	Bahamas
BT	Bhutan
BV	Bouvet Island
BW	Botswana
BY	Belarus
BZ	Belize
CA	Canada
CC	Cocos (Keeling) Islands
CD	Congo, Democratic Republic of the
CF	Central African Republic
CG	Congo
CH	Switzerland
CI	Côte d'Ivoire
CK	Cook Islands
CL	Chile
CM	Cameroon
CN	China
CO	Colombia
CR	Costa Rica
CU	Cuba
CV	Cabo Verde
CW	Curaçao
CX	Christmas Island
CY	Cyprus
CZ	Czechia
DE	Germany
DJ	Djibouti
DK	Denmark
DM	Dominica
DO	Dominican Republic
DZ	Algeria
EC	Ecuador
EE	Estonia
EG	Egypt
EH	Western Sahara
ER	Eritrea
ES	Spain
ET	Ethiopia
FI	Finland
FJ	Fiji
FK	Falkland Islands (Malvinas)
FM	Micronesia, Federated States of
FO	Faroe Islands
FR	France
GA	Gabon
GB	United Kingdom of Great Britain and Northern Ireland
GD	Grenada
GE	Georgia
GF	French Guiana
GG	Guernsey
GH	Ghana
GI	Gibraltar
GL	Greenland
GM	Gambia
GN	Guinea
GP	Guadeloupe
GQ	Equatorial Guinea
GR	Greece
GS	South Georgia and the South Sandwich Islands
GT	Guatemala
GU	Guam
GW	Guinea-Bissau
GY	Guyana
HK	Hong Kong
HM	Heard Island and McDonald Islands
HN	Honduras
HR	Croatia
HT	Haiti
HU	Hungary
ID	Indonesia
IE	Ireland
IL	Israel
IM	Isle of Man
IN	India
IO	British Indian Ocean Territory
IQ	Iraq
IR	Iran, Islamic Republic of
IS	Iceland
IT	Italy
JE	Jersey
JM	Jamaica
JO	Jordan
JP	Japan
KE	Kenya
KG	Kyrgyzstan
KH	Cambodia
KI	Kiribati
KM	Comoros
KN	Saint Kitts and Nevis
KP	Korea, Democratic People's Republic of
KR	Korea, Republic of
KW	Kuwait
KY	Cayman Islands
KZ	Kazakhstan
LA	Lao People's Democratic Republic
LB	Lebanon
LC	Saint Lucia
LI	Liechtenstein
LK	Sri Lanka
LR	Liberia
LS	Lesotho
LT	Lithuania
LU	Luxembourg
LV	Latvia
LY	Libya
MA	Morocco
MC	Monaco
MD	Moldova, Republic of
ME	Montenegro
MF	Saint Martin (French part)
MG	Madagascar
MH	Marshall Islands
MK	North Macedonia
ML	Mali
MM	Myanmar
MN	Mongolia
MO	Macao
MP	Northern Mariana Islands
MQ	Martinique
MR	Mauritania
MS	Montserrat
MT	Malta
MU	Mauritius
MV	Maldives
MW	Malawi
MX	Mexico
MY	Malaysia
MZ	Mozambique
NA	Namibia
NC	New Caledonia
NE	Niger
NF	Norfolk Island
NG	Nigeria
NI	Nicaragua
NL	Netherlands, Kingdom of the
NO	Norway
NP	Nepal
NR	Nauru
NU	Niue
NZ	New Zealand
OM	Oman
PA	Panama
PE	Peru
PF	French Polynesia
PG	Papua New Guinea
PH	Philippines
PK	Pakistan
PL	Poland
PM	Saint Pierre and Miquelon
PN	Pitcairn
PR	Puerto Rico
PS	Palestine, State of
PT	Portugal
PW	Palau
PY	Paraguay
QA	Qatar
RE	Réunion
RO	Romania
RS	Serbia
RU	Russian Federation
RW	Rwanda
SA	Saudi Arabia
SB	Solomon Islands
SC	Seychelles
SD	Sudan
SE	Sweden
SG	Singapore
SH	Saint Helena, Ascension and Tristan da Cunha
SI	Slovenia
SJ	Svalbard and Jan Mayen
SK	Slovakia
SL	Sierra Leone
SM	San Marino
SN	Senegal
SO	Somalia
SR	Suriname
SS	South Sudan
ST	Sao Tome and Principe
SV	El Salvador
SX	Sint Maarten (Dutch part)
SY	Syrian Arab Republic
SZ	Eswatini
TC	Turks and Caicos Islands
TD	Chad
TF	French Southern Territories
TG	Togo
TH	Thailand
TJ	Tajikistan
TK	Tokelau
TL	Timor-Leste
TM	Turkmenistan
TN	Tunisia
TO	Tonga
TR	Türkiye
TT	Trinidad and Tobago
TV	Tuvalu
TW	Taiwan, Province of China
TZ	Tanzania, United Republic of
UA	Ukraine
UG	Uganda
UM	United States Minor Outlying Islands
US	United States of America
UY	Uruguay
UZ	Uzbekistan
VA	Holy See
VC	Saint Vincent and the Grenadines
VE	Venezuela, Bolivarian Republic of
VG	Virgin Islands (British)
VI	Virgin Islands (U.S.)
VN	Viet Nam
VU	Vanuatu
WF	Wallis and Futuna
WS	Samoa
YE	Yemen
YT	Mayotte
ZA	South Africa
ZM	Zambia
ZW	Zimbabwe

Card Types

1	VISA	visa
2	MASTERCARD	mastercard
3	AMERICAN EXPRESS	amex
4	JCB	jcb
5	MAESTRO	maestro
6	DISCOVER	discover
7	UNION PAY	union-pay
8	DINERS	diners

Code Examples

PHP

<?php

function generateSignature(array $data): string
{
    $privateKey = openssl_pkey_get_private("-----BEGIN PRIVATE KEY-----
YOUR_PRIVATE_KEY_HERE
-----END PRIVATE KEY-----
");

    foreach ($data as $k => $v) {
        if (is_array($v)) $data[$k] = json_encode($v);
    }
    ksort($data, SORT_NATURAL);
    array_walk_recursive(
        $data,
        static function (&$field) {
            $field = trim($field);
        }
    );

    openssl_sign(json_encode($data), $signature, $privateKey, 'md5WithRSAEncryption');

    return base64_encode($signature);
}

function verifySignature(array $data): bool
{
    $publicKey = openssl_pkey_get_public("-----BEGIN PUBLIC KEY-----
YOUR_GLODIPAY_PUBLIC_KEY_HERE
-----END PUBLIC KEY-----
");

    $dataWithoutSignature = array_filter($data, static function ($key) {
        return $key !== 'signature';
    }, ARRAY_FILTER_USE_KEY);

    $signature = $data['signature'];

    ksort($dataWithoutSignature, SORT_NATURAL);
    array_walk_recursive(
        $dataWithoutSignature,
        static function (&$field) {
            $field = trim($field);
        }
    );

    $result = openssl_verify(
        json_encode($dataWithoutSignature),
        base64_decode($signature),
        $publicKey,
        'md5WithRSAEncryption'
    );

    return $result === 1;
}

// Example: S2S card payment
$payload = [
    'merchantId'             => '1100000123',
    'orderRef'               => 'ORDER-' . time(),
    'amount'                 => '100.00',
    'currency'               => 'USD',
    'paymentMethod'          => 'card',
    'callbackUrl'            => 'https://yoursite.com/payment/callback',
    'notificationUrl'        => 'https://yoursite.com/payment/webhook',
    'cancelUrl'              => 'https://yoursite.com/payment/cancel',
    'errorUrl'               => 'https://yoursite.com/payment/error',
    'orderDescription'       => 'Test order',
    'billingFirstName'       => 'John',
    'billingLastName'        => 'Doe',
    'billingStreet1'         => '123 Main St',
    'billingStreet2'         => '',
    'billingCity'            => 'New York',
    'billingEmail'           => 'john@example.com',
    'billingState'           => 'NY',
    'billingCountry'         => 'US',
    'billingPostalCode'      => '10001',
    'billingPhoneCountryCode'=> '1',
    'billingPhoneNumber'     => '5551234567',
    'cardNumber'             => '4111111111111111',
    'cardMonth'              => '12',
    'cardYear'               => '30',
    'cardSecurityCode'       => '123',
    'customerIp'             => $_SERVER['REMOTE_ADDR'],
];

$payload['signature'] = generateSignature($payload);

$ch = curl_init('https://payment-sandbox.gpayprocessing.com/v2/card/api');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($payload));
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/json']);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);

$result = json_decode($response, true);

if ($result['status'] === 'redirect') {
    // Redirect buyer for 3DS
    header('Location: ' . $result['data']['url']);
    exit;
} elseif ($result['status'] === 'success') {
    // Payment completed immediately
    echo 'Payment successful. TransactionId: ' . $result['data']['transactionId'];
}

Node.js

// Save as script.mjs and run: node script.mjs
import { createSign } from 'crypto';
import https from 'https';

const PRIVATE_KEY = `-----BEGIN PRIVATE KEY-----
YOUR_PRIVATE_KEY_HERE
-----END PRIVATE KEY-----`;

function phpCast(v) {
    if (typeof v === 'number') return String(v);
    if (typeof v === 'boolean') return v ? '1' : '';
    if (typeof v === 'string') return v.trim();
    if (Array.isArray(v)) return v.map(phpCast);
    if (v && typeof v === 'object') return Object.fromEntries(Object.entries(v).map(([k, val]) => [k, phpCast(val)]));
    return v;
}

function generateSignature(data) {
    const sorted = {};
    Object.keys(data)
        .filter(k => k !== 'signature')
        .sort((a, b) => a.localeCompare(b, undefined, { numeric: true, sensitivity: 'base' }))
        .forEach(k => { sorted[k] = data[k]; });

    const canonical = JSON.stringify(phpCast(sorted))
        .replace(/\//g, '\\/')
        .replace(/[\u0080-\uffff]/g, c => '\\u' + c.charCodeAt(0).toString(16).padStart(4, '0'));

    const sign = createSign('md5WithRSAEncryption');
    sign.update(canonical);
    return sign.sign(PRIVATE_KEY, 'base64');
}

const payload = {
    merchantId: '1100000123',
    orderRef: 'ORDER-' + Date.now(),
    amount: '100.00',
    currency: 'USD',
    paymentMethod: 'card',
    callbackUrl: 'https://yoursite.com/payment/callback',
    notificationUrl: 'https://yoursite.com/payment/webhook',
    cancelUrl: 'https://yoursite.com/payment/cancel',
    errorUrl: 'https://yoursite.com/payment/error',
    orderDescription: 'Test order',
    billingFirstName: 'John',
    billingLastName: 'Doe',
    billingStreet1: '123 Main St',
    billingStreet2: '',
    billingCity: 'New York',
    billingEmail: 'john@example.com',
    billingState: 'NY',
    billingCountry: 'US',
    billingPostalCode: '10001',
    billingPhoneCountryCode: '1',
    billingPhoneNumber: '5551234567',
    cardNumber: '4111111111111111',
    cardMonth: '12',
    cardYear: '30',
    cardSecurityCode: '123',
    customerIp: '1.2.3.4',
};

payload.signature = generateSignature(payload);

const postData = JSON.stringify(payload);
const options = {
    hostname: 'payment-sandbox.gpayprocessing.com',
    path: '/v2/card/api',
    method: 'POST',
    headers: {
        'Content-Type': 'application/json',
        'Content-Length': Buffer.byteLength(postData),
    },
};

const req = https.request(options, (res) => {
    let body = '';
    res.on('data', chunk => body += chunk);
    res.on('end', () => {
        const result = JSON.parse(body);
        if (result.status === 'redirect') {
            console.log('Redirect buyer to:', result.data.url);
        } else if (result.status === 'success') {
            console.log('Payment completed. TransactionId:', result.data.transactionId);
        }
    });
});

req.on('error', console.error);
req.write(postData);
req.end();