Callback Verification

PhonePe sends asynchronous payment status updates to your webhook URL via webhooks.  It’s crucial to implement this to ensure reliable payment confirmation.

This is used to verify whether the callback received is valid or not.

Create a PHP script that listens for incoming POST requests from PhonePe at your configured callbackUrl.

You need to pass 4 parameters to the validateCallback() function

Example usage :

<?php

require_once "vendor/autoload.php";

use PhonePe\payments\v2\standardCheckout\StandardCheckoutClient;
use PhonePe\common\exceptions\PhonePeException;

// Retrieve headers and request body
$headers = getallheaders();
$requestBody = file_get_contents("php://input");

// Your username and password for callback verification
$username = "YOUR_USERNAME";
$password = "YOUR_PASSWORD";

// Initialize PhonePe Client
$clientId = "YOUR_CLIENT_ID"; // Replace with your Client ID
$clientVersion = 2; // Replace with your Client Version
$clientSecret = "YOUR_CLIENT_SECRET"; // Replace with your Client Secret
$env = \PhonePe\Env::PRODUCTION; // Replace with your Environment

$standardCheckoutClient = StandardCheckoutClient::getInstance(
    $clientId,
    $clientVersion,
    $clientSecret,
    $env
);

try {
    $callbackResponse = $standardCheckoutClient->verifyCallbackResponse(
        $headers,
        json_decode($requestBody, true),
        $username,
        $password
    ); // Process the callback response
} catch (\PhonePe\common\exceptions\PhonePeException $e) {
    // Handle exceptions (e.g., log the error)
    echo "Error validating callback response: " . $e->getMessage();
}

?>

Key Notes

• Authentication: The PhonePe authenticates the merchant on the callback using Basic Authentication. The merchant needs to verify the authenticity of the callbacks from PhonePe by validating the username and password in the authorization header.
• Get all the headers using getallheaders().
• Read the request body using file_get_contents(‘php://input’).
• Call verifyCallbackResponse() to verify the callback and parse the response.
• Use appropriate HTTP status codes to acknowledge the callback:
  • 200 OK: Indicates successful processing of the callback.  The PhonePe system will retry callbacks that don’t receive a 200 OK response.
  • 400 Bad Request: Indicates an error in the request or verification failure.
  • 500 Internal Server Error: Indicates a server-side error.
• Log all errors for debugging purposes.

Returns :

The function returns a CallbackResponse if the callback is valid, otherwise throws a PhonePeException.

Callback Response:

Callback Types

CallbackData Properties :

PaymentDetail Object :