Validate Payment with IPN
Remember, We have set an IPN URL in first step so that your server can listen at the right moment when payment is done at Bank End. So, It is important to validate the transaction notification to maintain security and standard.
Grab the Notification
As IPN URL already set in panel. All the payment notification will reach through IPN prior to user return back. So it needs validation for amount and transaction properly.
The IPN will send a POST REQUEST with below parameters. Grab the post notification with your desired platform ( PHP: $_POST)
| Param Name | Data Type | Description |
|---|---|---|
status |
string (20) |
Transaction Status - as VALID / FAILED / CANCELLED / EXPIRED / UNATTEMPTED This parameter needs to be checked before update your database
|
tran_date |
datetime | Transaction date - Payment completion date as 2016-05-08 15:53:49 ( PHP date('Y-m-d H:i:s') ) |
tran_id |
string (30) | Transaction ID (Unique) that was sent by you during initiation. This parameter needs to be validated with your system database for security |
val_id |
string (50) | A Validation ID against the Transaction which is provided by SSLCOMMERZ. |
amount |
decimal (10,2) | The total amount sent by you. However, it could be changed based on currency type. This parameter needs to be validated with your system database for security |
store_amount |
decimal (10,2) | The amount what you will get in your account after bank charge ( Example: 100 BDT will be your store amount of 96 BDT after 4% Bank Commission ) |
card_type |
string (50) | The Bank Gateway Name that customer selected |
bank_tran_id |
string (80) | The transaction ID at Banks End |
verify_sign |
string (255) | Data Validation Key |
Sample IPN Request
POST <YOUR IPN LISTENER>
$ curl -X POST <YOUR IPN LISTENER>
-d
'tran_id=5a16c68b23783&
val_id=1711231900331kHP17lnrr9T8Gt&
amount=100&
card_type=VISA-Dutch Bangla&
store_amount=97&
status=VALID&
tran_date=2017-11-23 18:59:55&
currency=BDT&
verify_sign=8070c0cefed9e629b01100d8a92afda2'
Security Tip: Your IPN Listener should only accept POST requests from SSLCommerz IP ranges or validate the verify_sign parameter.