Developer Documentation

Documentation for SSLCOMMERZ (Version: 4.00). Integrate our payment gateway and start accepting payments in minutes.

Overview

Checkpoint Tips:
  • For registration in Sandbox, click Create Sandbox Account
  • For registration in Production, visit https://signup.sslcommerz.com/register
  • There are two processes of integration:
    1. SSLCOMMERZ Easy Checkout in your checkout page
    2. Redirect the customer from your checkout page to the SSLCOMMERZ Hosted page
  • You will use three APIs of SSLCOMMERZ to complete the integration:
    1. Create and Get Session
    2. Receive Payment Notification (IPN)
    3. Order Validation API
  • You must validate your transaction and amount by calling our Order Validation API
  • You must develop the IPN URL to receive the payment notification
  • Sometimes you will get risky payments (in the response you will get a risk property, value 0 for safe, 1 for risky). It depends on you whether to provide the service or not.
Notification! We accept only TLS 1.2 or upper version
  • To test: run the following from your server host in command line
  • Command: root@server# curl "https://sandbox.sslcommerz.com/public/tls/" -v
  • Output: TLS is okay
  • Remarks: if you get the output as "TLS is okay", then your server supports updated TLS

SSLCOMMERZ is the first payment gateway in Bangladesh, opening doors for merchants to receive payments on the internet via their online stores. Customers can buy products online using their credit cards as well as bank accounts. Enhance your business by integrating SSLCOMMERZ into your online store and facilitating online payment in Bangladeshi Taka. Your customers will be able to pay using local credit/debit cards like VISA, MasterCard, DBBL Nexus Card and any kind of credit card or bank account right from your online store. SSLCOMMERZ uses industry-standard Secure Sockets Layer (SSL) technology, used worldwide for securing data encryption.

There are two ways to display the SSLCOMMERZ payment page for your customer.

1. Easy Checkout Integration

An embedded JS integration within your site which will display the payment channels on your page.

2. Hosted Payment Integration

Here, you redirect the customer to the SSLCOMMERZ Hosted page to display the payment channels.

Technical or Backend Integration Process

For both Easy Checkout and Hosted Payment Integration, the backend API communication is executed the same way. Due to security and to avoid data tampering, you must call the SSLCOMMERZ APIs from your server.

The process breaks down into three stages:

Transaction Initiate

After getting checkout confirmation from the customer, the merchant server sends a request to the SSLCOMMERZ server to get a Session ID. If all credentials and mandatory fields are valid, SSLCOMMERZ provides a Session ID to the Merchant System, which then redirects the customer to the payment page with that Session ID.

Handling Payment Notification

For any notification, SSLCOMMERZ sends an HTTP POST message (IPN Message) to the Listener configured in the Merchant's SSLCOMMERZ Administrator Panel. After receiving the message, you must validate it with the Order Validation API.

Service Confirmation

SSLCOMMERZ redirects the customer to the merchant's side, where the merchant displays the service confirmation.

Payment Process Environment

We have both a Live environment and a Test/Sandbox environment. You just need to use the proper URL and Store ID for each. We provide a separate Store ID for live and test.

Live Environment

All transactions made using this environment count as real transactions. URL starts with https://securepay.sslcommerz.com

Sandbox Environment

All transactions made using this environment count as test transactions and have no effect on accounting. URL starts with https://sandbox.sslcommerz.com.

Test Credit Card Account Numbers

CardNumberExpiryCVV
VISA411111111111111112/26111
Mastercard511111111111111112/26111
American Express37111111111111112/26111

Mobile OTP: 111111 or 123456

V4 API

Initiate Payment

Before initiating payment processing, enable your HTTP IPN Listener so it can update your database even if the customer has a connectivity issue returning to your site.

Ready the Parameters

Some mandatory parameters need to be passed to SSLCOMMERZ to identify your customer and order. You must also pass the success, fail, and cancel URLs to redirect your customer after payment.

API Endpoint (Sandbox/Test): POST https://sandbox-gw.sslcommerz.com/gwprocess/v4/api.php
API Endpoint (Live): POST https://securepay.sslcommerz.com/gwprocess/v4/api.php
Method: POST

Request Parameters

Param NameData TypeDescription
Integration Required Parameters
store_idstring (30)Mandatory - Your SSLCOMMERZ Store ID, the integration credential collected through our managers.
store_passwdstring (30)Mandatory - Your SSLCOMMERZ Store Password, the integration credential collected through our managers.
total_amountdecimal (10,2)Mandatory - The amount processed by SSLCOMMERZ, e.g. 55.40. Must be from 10.00 BDT to 500,000.00 BDT.
currencystring (3)Mandatory - Three-character currency code, e.g. BDT, USD, EUR, SGD, INR, MYR. Non-BDT currencies convert to BDT at the current rate.
tran_idstring (30)Mandatory - Unique transaction ID identifying your order on both your end and SSLCOMMERZ's.
product_categorystring (50)Mandatory - Open field for product category, e.g. clothing, shoes, watches, gift, healthcare, jewellery, top up, toys, baby care, pants, laptop, donation.
success_urlstring (255)Mandatory - Callback URL where the user is redirected after successful payment.
fail_urlstring (255)Mandatory - Callback URL where the user is redirected after a failed payment.
cancel_urlstring (255)Mandatory - Callback URL where the user is redirected if the transaction is cancelled.
ipn_urlstring (255)Important, not mandatory - Instant Payment Notification URL where SSLCOMMERZ sends the transaction's status server-to-server (no customer session involved). Important for catching pending/lost-session transactions.
multi_card_namestring (30)Do not use unless customizing the gateway list - Controls which gateways display on the selection page. Comma-separate keys such as brac_visa, dbbl_visa, city_visa, ebl_visa, sbl_visa, brac_master, dbbl_master, city_master, ebl_master, sbl_master, city_amex, qcash, dbbl_nexus, bankasia, abbank, ibbl, mtbl, bkash, dbblmobilebanking, city, upay, tapnpay, or group keys internetbank, mobilebank, othercard, visacard, mastercard, amexcard.
allowed_binstring (255)Do not use unless controlling by BIN - Restrict the transaction to a comma-separated list of card BINs, e.g. 371598,371599,376947,376948,376949.
Parameters to Handle EMI Transactions
emi_optioninteger (1)Mandatory if EMI-enabled - Value 1/0. 1 means the customer gets the EMI facility for this transaction.
emi_max_inst_optioninteger (2)Max instalment option - customer gets 3, 6, or 9 instalments at the gateway page.
emi_selected_instinteger (2)Instalment already selected on your site, so no instalment option is displayed at the gateway page.
emi_allow_onlyinteger (1)Value 1/0 - if 1, only EMI transactions are possible on the payment page (no mobile/internet banking). Depends on emi_option and emi_selected_inst.
Customer Information
cus_namestring (50)Mandatory - Customer name, used to address them in the payment receipt email.
cus_emailstring (50)Mandatory - Valid customer email to send the payment receipt.
cus_add1string (50)Mandatory - Customer address.
cus_add2string (50)Address line 2.
cus_citystring (50)Mandatory - Customer city.
cus_statestring (50)Customer state.
cus_postcodestring (30)Mandatory - Customer postcode.
cus_countrystring (50)Mandatory - Customer country.
cus_phonestring (20)Mandatory - Customer phone/mobile number. Required for SSLCOMMERZ_LOGISTIC
cus_faxstring (20)Customer fax number.
Shipment Information
shipping_methodstring (50)Mandatory - e.g. YES, NO, Courier, or SSLCOMMERZ_LOGISTIC. Required for SSLCOMMERZ_LOGISTIC
num_of_iteminteger (1)Mandatory - Number of items to ship. Required for SSLCOMMERZ_LOGISTIC
weight_of_itemsdecimal (10,2)Mandatory - Weight of the shipment in kg, e.g. 0.5 or 2.00. Required for SSLCOMMERZ_LOGISTIC
logistic_pickup_idstring (50)Mandatory - Pickup ID from where SSLCOMMERZ logistic partners collect your product, set in your merchant portal. Required for SSLCOMMERZ_LOGISTIC
logistic_delivery_typestring (50)Mandatory - Required by SSLCOMMERZ logistic partners before pickup. Required for SSLCOMMERZ_LOGISTIC
ship_namestring (50)Mandatory if shipping_method is YES - Shipping recipient name. Required for SSLCOMMERZ_LOGISTIC
ship_add1string (50)Mandatory if shipping_method is YES - Shipping address. Required for SSLCOMMERZ_LOGISTIC
ship_add2string (50)Additional shipping address. Required for SSLCOMMERZ_LOGISTIC
ship_areastring (50)Mandatory if shipping_method is YES - Shipping area. Required for SSLCOMMERZ_LOGISTIC
ship_citystring (50)Mandatory if shipping_method is YES - Shipping city. Required for SSLCOMMERZ_LOGISTIC
ship_sub_citystring (50)Mandatory if shipping_method is YES - Shipping sub-city/thana. Required for SSLCOMMERZ_LOGISTIC
ship_statestring (50)Shipping state.
ship_postcodestring (50)Mandatory if shipping_method is YES - Shipping postcode. Required for SSLCOMMERZ_LOGISTIC
ship_countrystring (50)Mandatory if shipping_method is YES - Shipping country.
Product Information
product_namestring (255)Mandatory - Product name(s), comma-separated, e.g. Computer,Speaker.
product_categorystring (100)Mandatory - e.g. Electronic, topup, bus ticket, air ticket.
product_profilestring (100)Mandatory - Goods vertical, necessary to avoid chargeback. One of: general, physical-goods, non-physical-goods, airline-tickets, travel-vertical, telecom-vertical.
hours_till_departurestring (30)Mandatory if product_profile is airline-tickets - Remaining time until departure at purchase time, e.g. 12 hrs or 36 hrs.
flight_typestring (30)Mandatory if product_profile is airline-tickets - Oneway, Return, or Multistop.
pnrstring (50)Mandatory if product_profile is airline-tickets - Passenger Name Record.
journey_from_tostring (255)Mandatory if product_profile is airline-tickets - Journey route, e.g. DAC-CGP or DAC-CGP CGP-DAC.
third_party_bookingstring (20)Mandatory if product_profile is airline-tickets - No/Yes, whether booked via a third-party system.
hotel_namestring (255)Mandatory if product_profile is travel-vertical - e.g. Sheraton.
length_of_staystring (30)Mandatory if product_profile is travel-vertical - e.g. 2 days.
check_in_timestring (30)Mandatory if product_profile is travel-vertical - e.g. 24 hrs.
hotel_citystring (50)Mandatory if product_profile is travel-vertical - e.g. Dhaka.
product_typestring (30)Mandatory if product_profile is telecom-vertical - Prepaid or Postpaid.
topup_numberstring (150)Mandatory if product_profile is telecom-vertical - Mobile number(s) to recharge, e.g. 8801700000000 or comma-separated for multiple.
country_topupstring (30)Mandatory if product_profile is telecom-vertical - e.g. Bangladesh.
cartjsonJSON array with product (max 255 chars), quantity, and amount (decimal 12,2) per line item. Required for SSLCOMMERZ_LOGISTIC
product_amountdecimal (10,2)Product price shown in your merchant panel, for reconciliation.
vatdecimal (10,2)VAT included in the product price, for reconciliation.
discount_amountdecimal (10,2)Discount given on the invoice, for reconciliation.
convenience_feedecimal (10,2)Any convenience fee imposed on the invoice, for reconciliation.
Customized or Additional Parameters
value_astring (255)Extra metadata field, not mandatory.
value_bstring (255)Extra metadata field, not mandatory.
value_cstring (255)Extra metadata field, not mandatory.
value_dstring (255)Extra metadata field, not mandatory.

Note: parameters marked Required for SSLCOMMERZ_LOGISTIC became required for the logistic support SSLCOMMERZ introduced on 1st October 2022.

Returned Parameters

Param NameData TypeDescription
statusstring (10)API connectivity status - SUCCESS if all required data is provided, otherwise FAILED.
failedreasonstring (255)Reason for failure, if status is FAILED.
sessionkeystring (50)Unique session key - save it to query the transaction status later if needed.
gwstringAll active gateways, classified into visa, master, amex, othercards, internetbanking, and mobilebanking.
GatewayPageURLstring (255)The main URL you'll use for integration - redirect the customer here to pay.
storeBannerstring (255)Image URL if a banner is uploaded against the store.
storeLogostring (255)Image URL if a logo is uploaded against the store.
descstringBrief description of every gateway - search a gw key (e.g. visacard) here for its name, type, and logo.

CREATE and GET Session

Build an array from the parameters above and call the initiation API to generate a session.

POST gwprocess/v4/api.php

Request Example

$ curl -X POST https://sandbox.sslcommerz.com/gwprocess/v4/api.php \
-d 'store_id=testbox&
store_passwd=qwerty&
total_amount=100&
currency=EUR&
tran_id=REF123&
success_url=http://yoursite.com/success.php&
fail_url=http://yoursite.com/fail.php&
cancel_url=http://yoursite.com/cancel.php&
cus_name=Customer Name&
cus_email=cust@yahoo.com&
cus_add1=Dhaka&
cus_city=Dhaka&
cus_postcode=1000&
cus_country=Bangladesh&
cus_phone=01711111111&
shipping_method=NO&
product_name=Test Product&
product_category=General&
product_profile=general'


Response Example
{
   "status":"SUCCESS",
   "failedreason":"",
   "sessionkey":"F298BC45B0688E02768900C4F6B28C8B",
   "gw":{
      "visa":"dbbl_visa,brac_visa,city_visa,ebl_visa,visacard",
      "master":"dbbl_master,brac_master,city_master,ebl_master,mastercard",
      "amex":"city_amex,amexcard",
      "othercards":"dbbl_nexus,qcash,fastcash",
      "internetbanking":"city,bankasia,ibbl,mtbl",
      "mobilebanking":"dbblmobilebanking,bkash,abbank,ibbl"
   },
   "redirectGatewayURL":"https://sandbox.sslcommerz.com/gwprocess/v4/bankgw/indexhtml.php?...",
   "GatewayPageURL":"https://sandbox.sslcommerz.com/gwprocess/v4/gw.php?Q=PAY&SESSIONKEY=F298BC45B0688E02768900C4F6B28C8B",
   "storeBanner":"https://securepay.sslcommerz.com/testbox/stores/banners/easyv1.png",
   "storeLogo":"https://securepay.sslcommerz.com/testbox/stores/logos/logo_SCZ100197.jpg",
   "desc":[
      {"name":"VISA","type":"visa","logo":"...","gw":"visacard","r_flag":"1","redirectGatewayURL":"..."},
      {"name":"MASTER","type":"master","logo":"...","gw":"mastercard","r_flag":"1","redirectGatewayURL":"..."}
   ]
}

Validate Payment with IPN

Remember, you set an IPN URL in the first step so your server can be notified the moment payment completes at the bank end. It is important to validate the notification for security and to keep your records accurate.

Grab the Notification

As the IPN URL is already set in your panel, every payment notification reaches you via IPN prior to the customer returning. Grab the POST notification with your platform of choice (PHP: $_POST).

Param NameData TypeDescription
statusstring (20)Check before updating your database. One of VALID (successful), FAILED (declined by issuer), CANCELLED (customer cancelled), UNATTEMPTED (no channel chosen), EXPIRED (timeout).
tran_datedatetimePayment completion date, e.g. 2016-05-08 15:53:49.
tran_idstring (30)Your unique transaction ID sent at initiation. Validate against your database.
val_idstring (50)Validation ID for this transaction, provided by SSLCOMMERZ.
amountdecimal (10,2)Total amount sent by you (may change based on currency). Validate against your database.
store_amountdecimal (10,2)Amount credited to your account after bank charge, e.g. 100 BDT settles as 96 BDT after a 4% commission.
card_typestring (50)Bank gateway name the customer selected.
card_nostring (80)Customer's card number (masked), or a reference ID for mobile/internet banking.
currencystring (3)Currency your merchant account settles in.
bank_tran_idstring (80)Transaction ID at the bank's end.
card_issuerstring (100)Issuer bank name.
card_brandstring (30)VISA, MASTER, AMEX, IB, or MOBILE BANKING.
card_issuer_countrystring (50)Country of the card issuer.
card_issuer_country_codestring (2)2-letter country code of the card issuer.
currency_typestring (3)Currency sent at initiation. Validate against your database.
currency_amountdecimal (10,2)Amount sent at initiation, before BDT conversion. Validate against your database.
value_avalue_dstring (255)Same values passed during initiation, echoed back.
verify_sign / verify_keystringData validation key.
risk_levelinteger (1)1 = high risk (verify the customer before servicing), 0 = safe.
risk_titlestring (50)Description of the risk level.
POST <YOUR IPN LISTENER>

$ curl -X POST <YOUR IPN LISTENER FROM YOUR MERCHANT PANEL> \
-d 'tran_id=5a16c68b23783&
val_id=1711231900331kHP17lnrr9T8Gt&
amount=100&
card_type=VISA-Dutch Bangla&
store_amount=97&
card_no=425272XXXXXX3456&
bank_tran_id=1711231900331S0R8atkhAZksmM&
status=VALID&
tran_date=2017-11-23 18:59:55&
currency=BDT&
card_issuer=Standard Chartered Bank&
card_brand=VISA&
card_issuer_country=Bangladesh&
card_issuer_country_code=BD&
store_id=testbox&
verify_sign=8070c0cefed9e629b01100d8a92afda2&
risk_level=0&
risk_title=Safe'

Response Example
<YOU CAN PRINT ANY MESSAGE>

Order Validation API

After confirming the post keys are valid and untampered, validate your transaction's amount and status - it is only treated as valid if both match at SSLCOMMERZ's end.

Param NameData TypeDescription
val_idstring (50)Mandatory - Validation ID for the successful transaction.
store_idstring (30)Mandatory
store_passwdstring (30)Mandatory
formatstring (10)json or xml. Defaults to json.
vinteger (1)Open for future use only.

Returned Parameters

Same fields as the IPN notification above, plus: status can additionally be VALIDATED (already validated once before) or INVALID_TRANSACTION; and emi_instalment, emi_amount, discount_amount, discount_percentage, discount_remarks when applicable.

$ curl -X GET 'https://sandbox.sslcommerz.com/validator/api/validationserverAPI.php?val_id=1709162025351ElIuHtUtFReBwE&store_id=testbox&store_passwd=qwerty&format=json'

Response Example
{
   "status":"VALIDATED",
   "tran_date":"2017-09-16 20:25:27",
   "tran_id":"SSLCZ_TEST_59bd349436a7b",
   "val_id":"1709162025351ElIuHtUtFReBwE",
   "amount":"103.00",
   "store_amount":"98.88",
   "currency":"BDT",
   "bank_tran_id":"1709162025350IvUOK8nCTb6Uan",
   "card_type":"VISA-Brac bank",
   "card_issuer":"STANDARD CHARTERED BANK",
   "card_brand":"VISA",
   "risk_title":"Safe",
   "risk_level":"0",
   "APIConnect":"DONE",
   "validated_on":"2017-09-16 20:25:37"
}

Security Check Points:

  • Track your order by transaction ID and check it exists in your database
  • Validate amount and currency against your database to avoid fraud
  • Check status - VALID, FAILED, CANCEL - before updating your order status

Update Your Transaction

Once your order and amount are validated, update your database accordingly. If both status and validation status are Valid, wait for the user to return to your website and show them the success, fail, or cancel page.

Easy Checkout - Integration Process

Two ways to present the payment page: a hosted redirect, or a pop-up widget embedded in your own checkout page.

Hosted Checkout Process

Identical to the normal transaction-initiation process above - redirect the customer to the returned GatewayPageURL.

Pop Up Checkout Process

Requires a small amount of JavaScript on your site; your backend assists the popup in initiating the transaction.

Step 1 - Add this before </body>:

(function (window, document) {
    var loader = function () {
        var script = document.createElement("script"), tag = document.getElementsByTagName("script")[0];
        script.src = "https://sandbox.sslcommerz.com/embed.min.js?" + Math.random().toString(36).substring(7);
        tag.parentNode.insertBefore(script, tag);
    };
    window.addEventListener ? window.addEventListener("load", loader, false) : window.attachEvent("onload", loader);
})(window, document);

Live: swap the script host for https://seamless-epay.sslcommerz.com/embed.min.js.

Step 2 - Add a button your customer clicks to pay:

<button class="your-button-class" id="sslczPayBtn"
    token="if you have any token validation"
    postdata="your javascript arrays or objects required in backend"
    order="if you already have the transaction generated for this order"
    endpoint="a URL where your backend will initiate the payment to SSLCOMMERZ"> Pay Now
</button>

Backend transaction initiation - use your generated order data, or read the button's postdata key from the request:

$post_data = array();
$post_data['store_id'] = "your-store-id";
$post_data['store_passwd'] = "your-store-password";
$post_data['total_amount'] = "50";
$post_data['currency'] = "BDT";
$post_data['tran_id'] = "your unique order id" . uniqid();
$post_data['success_url'] = "your payment application success url";
$post_data['fail_url'] = "your payment application fail url";
$post_data['cancel_url'] = "your payment application cancel url";
# ... customer, shipment, and product fields as in Request Parameters above

$direct_api_url = "https://securepay.sslcommerz.com/gwprocess/v4/api.php";
$handle = curl_init();
curl_setopt($handle, CURLOPT_URL, $direct_api_url);
curl_setopt($handle, CURLOPT_POST, 1);
curl_setopt($handle, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($handle, CURLOPT_RETURNTRANSFER, true);
$content = curl_exec($handle);

$sslcz = json_decode($content, true);
if (isset($sslcz['GatewayPageURL']) && $sslcz['GatewayPageURL'] != "") {
    // this is what the popup widget expects back
    return json_encode(['status' => 'success', 'data' => $sslcz['GatewayPageURL'], 'logo' => $sslcz['storeLogo']]);
} else {
    return json_encode(['status' => 'fail', 'data' => null, 'message' => "JSON Data parsing error!"]);
}

Refund API

Use the Refund API to initiate and track refunds against a completed transaction.

Initiate The Refund

Param NameData TypeDescription
bank_tran_idstring (80)Mandatory - Transaction ID at the bank's end.
refund_trans_idstring (30)Mandatory - A unique ID you generate to identify this refund. (New parameter as of 24/02/2025.)
store_idstring (30)Mandatory
store_passwdstring (30)Mandatory
refund_amountdecimal (10,2)Mandatory - Amount to refund to the cardholder.
refund_remarksstring (255)Mandatory - Reason for the refund.
refe_idstring (50)Any reference number of your own, for reconciliation.
formatstring (10)json or xml. Defaults to json.
Returned ParamData TypeDescription
APIConnectstring (30)DONE (success), FAILED (auth failed), INACTIVE (store inactive), or INVALID_REQUEST.
bank_tran_idstring (80)Transaction ID at the bank's end.
trans_idstring (30)Returned only when authentication succeeds and bank_tran_id is valid.
refund_ref_idstring (50)Returned only when the request initiates successfully.
statusstring (30)success, failed, or processing (already initiated).
errorReasonstring (255)Failure reason, if any.

Security Check Point: your public IP must be registered at the SSLCOMMERZ live system.

$ curl -X GET 'https://sandbox.sslcommerz.com/validator/api/merchantTransIDvalidationAPI.php?bank_tran_id=1709162345070ANJdZV8LyI4cMw&refund_trans_id=TRID0000000001&refund_amount=5.50&refund_remarks=Out%20of%20Stock&store_id=testbox&store_passwd=qwerty&v=1&format=json'

Response Example
{
  "APIConnect": "DONE",
  "bank_tran_id": "1709162345070ANJdZV8LyI4cMw",
  "trans_id": "SSLCZ_TEST_59bd635981a94",
  "refund_ref_id": "59bd63fea5455",
  "status": "success",
  "errorReason": ""
}

Query Refund Status

Check whether a refund has been credited to the customer's account.

Param NameData TypeDescription
refund_ref_idstring (50)Mandatory - Returned when the refund was initiated.
store_idstring (30)Mandatory
store_passwdstring (30)Mandatory

Returns the same APIConnect/bank_tran_id fields as above, plus initiated_on, refunded_on (datetimes), and status: refunded, processing, or cancelled.

$ curl -X GET 'https://sandbox.sslcommerz.com/validator/api/merchantTransIDvalidationAPI.php?refund_ref_id=59bd63fea5455&store_id=testbox&store_passwd=qwerty&format=json'

Response Example
{
  "APIConnect": "DONE",
  "bank_tran_id": "1709162345070ANJdZV8LyI4cMw",
  "tran_id": "SSLCZ_TEST_59bd635981a94",
  "initiated_on": "2017-09-16 23:48:46",
  "refunded_on": "2017-09-17 08:53:51",
  "status": "refunded",
  "refund_ref_id": "59bd63fea5455"
}

Transaction Query API

Query your transaction status at any time - useful for ticketing systems or product-limit checks before releasing a hold.

By Session ID

Request: sessionkey, store_id, store_passwd (all mandatory). Returns the same fields as Order Validation, plus status can also be PENDING (not yet completed).

$ curl -X GET 'https://sandbox.sslcommerz.com/validator/api/merchantTransIDvalidationAPI.php?sessionkey=C3329C5E252DF44B323D9BAF47ACBCD9&store_id=testbox&store_passwd=qwerty&format=json'

Response Example
{
  "status": "VALID",
  "sessionkey": "C3329C5E252DF44B323D9BAF47ACBCD9",
  "tran_date": "2017-09-20 23:37:56",
  "tran_id": "59C2A4F6432F8",
  "val_id": "1709202338060TUgLqWw1PgB4GA",
  "amount": "10.00",
  "store_amount": "9.6",
  "bank_tran_id": "1709202338061Ac2MhyeosVJmUh",
  "card_type": "VISA-Brac bank",
  "risk_title": "Safe",
  "risk_level": "0",
  "APIConnect": "DONE",
  "validated_on": "2017-09-20 23:38:07"
}

By Transaction ID

Request: tran_id, store_id, store_passwd (all mandatory). Since one tran_id can have multiple attempts, this returns an element array with no_of_trans_found, each element carrying the same per-transaction fields as above.

$ curl -X GET 'https://sandbox.sslcommerz.com/validator/api/merchantTransIDvalidationAPI.php?tran_id=59C2A4F6432F8&store_id=testbox&store_passwd=qwerty&format=json'

Response Example
{
  "APIConnect": "DONE",
  "no_of_trans_found": 5,
  "element": [
    {
      "val_id": "17092023365512Wr2jmzTG69nV6",
      "status": "VALIDATED",
      "tran_id": "59C2A4F6432F8",
      "amount": "10.00",
      "store_amount": "9.75",
      "bank_tran_id": "17092023365508TFa1fjTrvgIhz",
      "card_type": "VISA-City Bank",
      "risk_title": "Safe",
      "risk_level": "0",
      "currency": "BDT"
    }
    // ... one element per attempt found
  ]
}

Common Issues

Network Issues:

  • Your IPN Listener must use a common port (80 or 443) and be reachable from the internet
  • Whitelist SSLCOMMERZ's IPs at your network firewall
  • Sandbox: requires access to sandbox.sslcommerz.com; open TCP 80/443 from 103.26.139.87
  • Production: requires access to securepay.sslcommerz.com; open TCP 80/443 from 103.26.139.81 & 103.132.153.81, and be able to reach TCP 443 of 103.26.139.148 & 103.132.153.148

Library Resources for Integration

Reference SDKs and code samples across common frameworks and languages are maintained at the SSLCommerz GitHub organization.

Library Resources for Integration

SecurePay API (Mobile SDK)

SecurePay is the mobile-app-facing counterpart to the V4 gateway API above - device registration, OTP-based customer login, saved-card management, and EMI/offer lookups for native mobile integrations. Endpoints live under /securepay/api.php/{action} (get_token, send_checkout_otp, verify_checkout_otp, login_status, mycards, get_emi, logoff, and related actions), each requiring a device's reg_id/enc_key pair obtained from get_token.

Postman Collection

No hosted collection is published yet - every request on this page is a plain curl example, so you can import any of them into Postman directly via Import → Raw text.

Next Steps