Overview
- For registration in Sandbox, click Create Sandbox Account
- For registration in Production, visit https://signup.sslcommerz.com/register
- There are two processes of integration:
- SSLCOMMERZ Easy Checkout in your checkout page
- Redirect the customer from your checkout page to the SSLCOMMERZ Hosted page
- You will use three APIs of SSLCOMMERZ to complete the integration:
- Create and Get Session
- Receive Payment Notification (IPN)
- Order Validation API
- You must validate your transaction and amount by calling our Order Validation API
- You must develop the IPN URL to receive the payment notification
- Sometimes you will get risky payments (in the response you will get a risk property, value 0 for safe, 1 for risky). It depends on you whether to provide the service or not.
- To test: run the following from your server host in command line
- Command:
root@server# curl "https://sandbox.sslcommerz.com/public/tls/" -v - Output: TLS is okay
- Remarks: if you get the output as "TLS is okay", then your server supports updated TLS
SSLCOMMERZ is the first payment gateway in Bangladesh, opening doors for merchants to receive payments on the internet via their online stores. Customers can buy products online using their credit cards as well as bank accounts. Enhance your business by integrating SSLCOMMERZ into your online store and facilitating online payment in Bangladeshi Taka. Your customers will be able to pay using local credit/debit cards like VISA, MasterCard, DBBL Nexus Card and any kind of credit card or bank account right from your online store. SSLCOMMERZ uses industry-standard Secure Sockets Layer (SSL) technology, used worldwide for securing data encryption.
There are two ways to display the SSLCOMMERZ payment page for your customer.
1. Easy Checkout Integration
An embedded JS integration within your site which will display the payment channels on your page.
2. Hosted Payment Integration
Here, you redirect the customer to the SSLCOMMERZ Hosted page to display the payment channels.
Technical or Backend Integration Process
For both Easy Checkout and Hosted Payment Integration, the backend API communication is executed the same way. Due to security and to avoid data tampering, you must call the SSLCOMMERZ APIs from your server.
The process breaks down into three stages:
Transaction Initiate
After getting checkout confirmation from the customer, the merchant server sends a request to the SSLCOMMERZ server to get a Session ID. If all credentials and mandatory fields are valid, SSLCOMMERZ provides a Session ID to the Merchant System, which then redirects the customer to the payment page with that Session ID.
Handling Payment Notification
For any notification, SSLCOMMERZ sends an HTTP POST message (IPN Message) to the Listener configured in the Merchant's SSLCOMMERZ Administrator Panel. After receiving the message, you must validate it with the Order Validation API.
Service Confirmation
SSLCOMMERZ redirects the customer to the merchant's side, where the merchant displays the service confirmation.
Payment Process Environment
We have both a Live environment and a Test/Sandbox environment. You just need to use the proper URL and Store ID for each. We provide a separate Store ID for live and test.
Live Environment
All transactions made using this environment count as real transactions. URL starts with https://securepay.sslcommerz.com
Sandbox Environment
All transactions made using this environment count as test transactions and have no effect on accounting. URL starts with https://sandbox.sslcommerz.com.
Test Credit Card Account Numbers
| Card | Number | Expiry | CVV |
|---|---|---|---|
| VISA | 4111111111111111 | 12/26 | 111 |
| Mastercard | 5111111111111111 | 12/26 | 111 |
| American Express | 371111111111111 | 12/26 | 111 |
Mobile OTP: 111111 or 123456
Initiate Payment
Before initiating payment processing, enable your HTTP IPN Listener so it can update your database even if the customer has a connectivity issue returning to your site.
Ready the Parameters
Some mandatory parameters need to be passed to SSLCOMMERZ to identify your customer and order. You must also pass the success, fail, and cancel URLs to redirect your customer after payment.
POST https://sandbox-gw.sslcommerz.com/gwprocess/v4/api.php
API Endpoint (Live):
POST https://securepay.sslcommerz.com/gwprocess/v4/api.php
Method: POST
Request Parameters
| Param Name | Data Type | Description |
|---|---|---|
| Integration Required Parameters | ||
store_id | string (30) | Mandatory - Your SSLCOMMERZ Store ID, the integration credential collected through our managers. |
store_passwd | string (30) | Mandatory - Your SSLCOMMERZ Store Password, the integration credential collected through our managers. |
total_amount | decimal (10,2) | Mandatory - The amount processed by SSLCOMMERZ, e.g. 55.40. Must be from 10.00 BDT to 500,000.00 BDT. |
currency | string (3) | Mandatory - Three-character currency code, e.g. BDT, USD, EUR, SGD, INR, MYR. Non-BDT currencies convert to BDT at the current rate. |
tran_id | string (30) | Mandatory - Unique transaction ID identifying your order on both your end and SSLCOMMERZ's. |
product_category | string (50) | Mandatory - Open field for product category, e.g. clothing, shoes, watches, gift, healthcare, jewellery, top up, toys, baby care, pants, laptop, donation. |
success_url | string (255) | Mandatory - Callback URL where the user is redirected after successful payment. |
fail_url | string (255) | Mandatory - Callback URL where the user is redirected after a failed payment. |
cancel_url | string (255) | Mandatory - Callback URL where the user is redirected if the transaction is cancelled. |
ipn_url | string (255) | Important, not mandatory - Instant Payment Notification URL where SSLCOMMERZ sends the transaction's status server-to-server (no customer session involved). Important for catching pending/lost-session transactions. |
multi_card_name | string (30) | Do not use unless customizing the gateway list - Controls which gateways display on the selection page. Comma-separate keys such as brac_visa, dbbl_visa, city_visa, ebl_visa, sbl_visa, brac_master, dbbl_master, city_master, ebl_master, sbl_master, city_amex, qcash, dbbl_nexus, bankasia, abbank, ibbl, mtbl, bkash, dbblmobilebanking, city, upay, tapnpay, or group keys internetbank, mobilebank, othercard, visacard, mastercard, amexcard. |
allowed_bin | string (255) | Do not use unless controlling by BIN - Restrict the transaction to a comma-separated list of card BINs, e.g. 371598,371599,376947,376948,376949. |
| Parameters to Handle EMI Transactions | ||
emi_option | integer (1) | Mandatory if EMI-enabled - Value 1/0. 1 means the customer gets the EMI facility for this transaction. |
emi_max_inst_option | integer (2) | Max instalment option - customer gets 3, 6, or 9 instalments at the gateway page. |
emi_selected_inst | integer (2) | Instalment already selected on your site, so no instalment option is displayed at the gateway page. |
emi_allow_only | integer (1) | Value 1/0 - if 1, only EMI transactions are possible on the payment page (no mobile/internet banking). Depends on emi_option and emi_selected_inst. |
| Customer Information | ||
cus_name | string (50) | Mandatory - Customer name, used to address them in the payment receipt email. |
cus_email | string (50) | Mandatory - Valid customer email to send the payment receipt. |
cus_add1 | string (50) | Mandatory - Customer address. |
cus_add2 | string (50) | Address line 2. |
cus_city | string (50) | Mandatory - Customer city. |
cus_state | string (50) | Customer state. |
cus_postcode | string (30) | Mandatory - Customer postcode. |
cus_country | string (50) | Mandatory - Customer country. |
cus_phone | string (20) | Mandatory - Customer phone/mobile number. Required for SSLCOMMERZ_LOGISTIC |
cus_fax | string (20) | Customer fax number. |
| Shipment Information | ||
shipping_method | string (50) | Mandatory - e.g. YES, NO, Courier, or SSLCOMMERZ_LOGISTIC. Required for SSLCOMMERZ_LOGISTIC |
num_of_item | integer (1) | Mandatory - Number of items to ship. Required for SSLCOMMERZ_LOGISTIC |
weight_of_items | decimal (10,2) | Mandatory - Weight of the shipment in kg, e.g. 0.5 or 2.00. Required for SSLCOMMERZ_LOGISTIC |
logistic_pickup_id | string (50) | Mandatory - Pickup ID from where SSLCOMMERZ logistic partners collect your product, set in your merchant portal. Required for SSLCOMMERZ_LOGISTIC |
logistic_delivery_type | string (50) | Mandatory - Required by SSLCOMMERZ logistic partners before pickup. Required for SSLCOMMERZ_LOGISTIC |
ship_name | string (50) | Mandatory if shipping_method is YES - Shipping recipient name. Required for SSLCOMMERZ_LOGISTIC |
ship_add1 | string (50) | Mandatory if shipping_method is YES - Shipping address. Required for SSLCOMMERZ_LOGISTIC |
ship_add2 | string (50) | Additional shipping address. Required for SSLCOMMERZ_LOGISTIC |
ship_area | string (50) | Mandatory if shipping_method is YES - Shipping area. Required for SSLCOMMERZ_LOGISTIC |
ship_city | string (50) | Mandatory if shipping_method is YES - Shipping city. Required for SSLCOMMERZ_LOGISTIC |
ship_sub_city | string (50) | Mandatory if shipping_method is YES - Shipping sub-city/thana. Required for SSLCOMMERZ_LOGISTIC |
ship_state | string (50) | Shipping state. |
ship_postcode | string (50) | Mandatory if shipping_method is YES - Shipping postcode. Required for SSLCOMMERZ_LOGISTIC |
ship_country | string (50) | Mandatory if shipping_method is YES - Shipping country. |
| Product Information | ||
product_name | string (255) | Mandatory - Product name(s), comma-separated, e.g. Computer,Speaker. |
product_category | string (100) | Mandatory - e.g. Electronic, topup, bus ticket, air ticket. |
product_profile | string (100) | Mandatory - Goods vertical, necessary to avoid chargeback. One of: general, physical-goods, non-physical-goods, airline-tickets, travel-vertical, telecom-vertical. |
hours_till_departure | string (30) | Mandatory if product_profile is airline-tickets - Remaining time until departure at purchase time, e.g. 12 hrs or 36 hrs. |
flight_type | string (30) | Mandatory if product_profile is airline-tickets - Oneway, Return, or Multistop. |
pnr | string (50) | Mandatory if product_profile is airline-tickets - Passenger Name Record. |
journey_from_to | string (255) | Mandatory if product_profile is airline-tickets - Journey route, e.g. DAC-CGP or DAC-CGP CGP-DAC. |
third_party_booking | string (20) | Mandatory if product_profile is airline-tickets - No/Yes, whether booked via a third-party system. |
hotel_name | string (255) | Mandatory if product_profile is travel-vertical - e.g. Sheraton. |
length_of_stay | string (30) | Mandatory if product_profile is travel-vertical - e.g. 2 days. |
check_in_time | string (30) | Mandatory if product_profile is travel-vertical - e.g. 24 hrs. |
hotel_city | string (50) | Mandatory if product_profile is travel-vertical - e.g. Dhaka. |
product_type | string (30) | Mandatory if product_profile is telecom-vertical - Prepaid or Postpaid. |
topup_number | string (150) | Mandatory if product_profile is telecom-vertical - Mobile number(s) to recharge, e.g. 8801700000000 or comma-separated for multiple. |
country_topup | string (30) | Mandatory if product_profile is telecom-vertical - e.g. Bangladesh. |
cart | json | JSON array with product (max 255 chars), quantity, and amount (decimal 12,2) per line item. Required for SSLCOMMERZ_LOGISTIC |
product_amount | decimal (10,2) | Product price shown in your merchant panel, for reconciliation. |
vat | decimal (10,2) | VAT included in the product price, for reconciliation. |
discount_amount | decimal (10,2) | Discount given on the invoice, for reconciliation. |
convenience_fee | decimal (10,2) | Any convenience fee imposed on the invoice, for reconciliation. |
| Customized or Additional Parameters | ||
value_a | string (255) | Extra metadata field, not mandatory. |
value_b | string (255) | Extra metadata field, not mandatory. |
value_c | string (255) | Extra metadata field, not mandatory. |
value_d | string (255) | Extra metadata field, not mandatory. |
Note: parameters marked Required for SSLCOMMERZ_LOGISTIC became required for the logistic support SSLCOMMERZ introduced on 1st October 2022.
Returned Parameters
| Param Name | Data Type | Description |
|---|---|---|
status | string (10) | API connectivity status - SUCCESS if all required data is provided, otherwise FAILED. |
failedreason | string (255) | Reason for failure, if status is FAILED. |
sessionkey | string (50) | Unique session key - save it to query the transaction status later if needed. |
gw | string | All active gateways, classified into visa, master, amex, othercards, internetbanking, and mobilebanking. |
GatewayPageURL | string (255) | The main URL you'll use for integration - redirect the customer here to pay. |
storeBanner | string (255) | Image URL if a banner is uploaded against the store. |
storeLogo | string (255) | Image URL if a logo is uploaded against the store. |
desc | string | Brief description of every gateway - search a gw key (e.g. visacard) here for its name, type, and logo. |
CREATE and GET Session
Build an array from the parameters above and call the initiation API to generate a session.
POST gwprocess/v4/api.php
Request Example
$ curl -X POST https://sandbox.sslcommerz.com/gwprocess/v4/api.php \
-d 'store_id=testbox&
store_passwd=qwerty&
total_amount=100&
currency=EUR&
tran_id=REF123&
success_url=http://yoursite.com/success.php&
fail_url=http://yoursite.com/fail.php&
cancel_url=http://yoursite.com/cancel.php&
cus_name=Customer Name&
cus_email=cust@yahoo.com&
cus_add1=Dhaka&
cus_city=Dhaka&
cus_postcode=1000&
cus_country=Bangladesh&
cus_phone=01711111111&
shipping_method=NO&
product_name=Test Product&
product_category=General&
product_profile=general'
Response Example
{
"status":"SUCCESS",
"failedreason":"",
"sessionkey":"F298BC45B0688E02768900C4F6B28C8B",
"gw":{
"visa":"dbbl_visa,brac_visa,city_visa,ebl_visa,visacard",
"master":"dbbl_master,brac_master,city_master,ebl_master,mastercard",
"amex":"city_amex,amexcard",
"othercards":"dbbl_nexus,qcash,fastcash",
"internetbanking":"city,bankasia,ibbl,mtbl",
"mobilebanking":"dbblmobilebanking,bkash,abbank,ibbl"
},
"redirectGatewayURL":"https://sandbox.sslcommerz.com/gwprocess/v4/bankgw/indexhtml.php?...",
"GatewayPageURL":"https://sandbox.sslcommerz.com/gwprocess/v4/gw.php?Q=PAY&SESSIONKEY=F298BC45B0688E02768900C4F6B28C8B",
"storeBanner":"https://securepay.sslcommerz.com/testbox/stores/banners/easyv1.png",
"storeLogo":"https://securepay.sslcommerz.com/testbox/stores/logos/logo_SCZ100197.jpg",
"desc":[
{"name":"VISA","type":"visa","logo":"...","gw":"visacard","r_flag":"1","redirectGatewayURL":"..."},
{"name":"MASTER","type":"master","logo":"...","gw":"mastercard","r_flag":"1","redirectGatewayURL":"..."}
]
}
Validate Payment with IPN
Remember, you set an IPN URL in the first step so your server can be notified the moment payment completes at the bank end. It is important to validate the notification for security and to keep your records accurate.
Grab the Notification
As the IPN URL is already set in your panel, every payment notification reaches you via IPN prior to the customer returning. Grab the POST notification with your platform of choice (PHP: $_POST).
| Param Name | Data Type | Description |
|---|---|---|
status | string (20) | Check before updating your database. One of VALID (successful), FAILED (declined by issuer), CANCELLED (customer cancelled), UNATTEMPTED (no channel chosen), EXPIRED (timeout). |
tran_date | datetime | Payment completion date, e.g. 2016-05-08 15:53:49. |
tran_id | string (30) | Your unique transaction ID sent at initiation. Validate against your database. |
val_id | string (50) | Validation ID for this transaction, provided by SSLCOMMERZ. |
amount | decimal (10,2) | Total amount sent by you (may change based on currency). Validate against your database. |
store_amount | decimal (10,2) | Amount credited to your account after bank charge, e.g. 100 BDT settles as 96 BDT after a 4% commission. |
card_type | string (50) | Bank gateway name the customer selected. |
card_no | string (80) | Customer's card number (masked), or a reference ID for mobile/internet banking. |
currency | string (3) | Currency your merchant account settles in. |
bank_tran_id | string (80) | Transaction ID at the bank's end. |
card_issuer | string (100) | Issuer bank name. |
card_brand | string (30) | VISA, MASTER, AMEX, IB, or MOBILE BANKING. |
card_issuer_country | string (50) | Country of the card issuer. |
card_issuer_country_code | string (2) | 2-letter country code of the card issuer. |
currency_type | string (3) | Currency sent at initiation. Validate against your database. |
currency_amount | decimal (10,2) | Amount sent at initiation, before BDT conversion. Validate against your database. |
value_a – value_d | string (255) | Same values passed during initiation, echoed back. |
verify_sign / verify_key | string | Data validation key. |
risk_level | integer (1) | 1 = high risk (verify the customer before servicing), 0 = safe. |
risk_title | string (50) | Description of the risk level. |
POST <YOUR IPN LISTENER>
$ curl -X POST <YOUR IPN LISTENER FROM YOUR MERCHANT PANEL> \
-d 'tran_id=5a16c68b23783&
val_id=1711231900331kHP17lnrr9T8Gt&
amount=100&
card_type=VISA-Dutch Bangla&
store_amount=97&
card_no=425272XXXXXX3456&
bank_tran_id=1711231900331S0R8atkhAZksmM&
status=VALID&
tran_date=2017-11-23 18:59:55&
currency=BDT&
card_issuer=Standard Chartered Bank&
card_brand=VISA&
card_issuer_country=Bangladesh&
card_issuer_country_code=BD&
store_id=testbox&
verify_sign=8070c0cefed9e629b01100d8a92afda2&
risk_level=0&
risk_title=Safe'
Response Example
<YOU CAN PRINT ANY MESSAGE>
Order Validation API
After confirming the post keys are valid and untampered, validate your transaction's amount and status - it is only treated as valid if both match at SSLCOMMERZ's end.
API Endpoint (Live): https://securepay.sslcommerz.com/validator/api/validationserverAPI.php
Method: GET
| Param Name | Data Type | Description |
|---|---|---|
val_id | string (50) | Mandatory - Validation ID for the successful transaction. |
store_id | string (30) | Mandatory |
store_passwd | string (30) | Mandatory |
format | string (10) | json or xml. Defaults to json. |
v | integer (1) | Open for future use only. |
Returned Parameters
Same fields as the IPN notification above, plus: status can additionally be VALIDATED (already validated once before) or INVALID_TRANSACTION; and emi_instalment, emi_amount, discount_amount, discount_percentage, discount_remarks when applicable.
$ curl -X GET 'https://sandbox.sslcommerz.com/validator/api/validationserverAPI.php?val_id=1709162025351ElIuHtUtFReBwE&store_id=testbox&store_passwd=qwerty&format=json'
Response Example
{
"status":"VALIDATED",
"tran_date":"2017-09-16 20:25:27",
"tran_id":"SSLCZ_TEST_59bd349436a7b",
"val_id":"1709162025351ElIuHtUtFReBwE",
"amount":"103.00",
"store_amount":"98.88",
"currency":"BDT",
"bank_tran_id":"1709162025350IvUOK8nCTb6Uan",
"card_type":"VISA-Brac bank",
"card_issuer":"STANDARD CHARTERED BANK",
"card_brand":"VISA",
"risk_title":"Safe",
"risk_level":"0",
"APIConnect":"DONE",
"validated_on":"2017-09-16 20:25:37"
}
Security Check Points:
- Track your order by transaction ID and check it exists in your database
- Validate amount and currency against your database to avoid fraud
- Check status - VALID, FAILED, CANCEL - before updating your order status
Update Your Transaction
Once your order and amount are validated, update your database accordingly. If both status and validation status are Valid, wait for the user to return to your website and show them the success, fail, or cancel page.
Easy Checkout - Integration Process
Two ways to present the payment page: a hosted redirect, or a pop-up widget embedded in your own checkout page.
Hosted Checkout Process
Identical to the normal transaction-initiation process above - redirect the customer to the returned GatewayPageURL.
Pop Up Checkout Process
Requires a small amount of JavaScript on your site; your backend assists the popup in initiating the transaction.
Step 1 - Add this before </body>:
(function (window, document) {
var loader = function () {
var script = document.createElement("script"), tag = document.getElementsByTagName("script")[0];
script.src = "https://sandbox.sslcommerz.com/embed.min.js?" + Math.random().toString(36).substring(7);
tag.parentNode.insertBefore(script, tag);
};
window.addEventListener ? window.addEventListener("load", loader, false) : window.attachEvent("onload", loader);
})(window, document);
Live: swap the script host for https://seamless-epay.sslcommerz.com/embed.min.js.
Step 2 - Add a button your customer clicks to pay:
<button class="your-button-class" id="sslczPayBtn"
token="if you have any token validation"
postdata="your javascript arrays or objects required in backend"
order="if you already have the transaction generated for this order"
endpoint="a URL where your backend will initiate the payment to SSLCOMMERZ"> Pay Now
</button>
Backend transaction initiation - use your generated order data, or read the button's postdata key from the request:
$post_data = array();
$post_data['store_id'] = "your-store-id";
$post_data['store_passwd'] = "your-store-password";
$post_data['total_amount'] = "50";
$post_data['currency'] = "BDT";
$post_data['tran_id'] = "your unique order id" . uniqid();
$post_data['success_url'] = "your payment application success url";
$post_data['fail_url'] = "your payment application fail url";
$post_data['cancel_url'] = "your payment application cancel url";
# ... customer, shipment, and product fields as in Request Parameters above
$direct_api_url = "https://securepay.sslcommerz.com/gwprocess/v4/api.php";
$handle = curl_init();
curl_setopt($handle, CURLOPT_URL, $direct_api_url);
curl_setopt($handle, CURLOPT_POST, 1);
curl_setopt($handle, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($handle, CURLOPT_RETURNTRANSFER, true);
$content = curl_exec($handle);
$sslcz = json_decode($content, true);
if (isset($sslcz['GatewayPageURL']) && $sslcz['GatewayPageURL'] != "") {
// this is what the popup widget expects back
return json_encode(['status' => 'success', 'data' => $sslcz['GatewayPageURL'], 'logo' => $sslcz['storeLogo']]);
} else {
return json_encode(['status' => 'fail', 'data' => null, 'message' => "JSON Data parsing error!"]);
}
Refund API
Use the Refund API to initiate and track refunds against a completed transaction.
Initiate The Refund
API Endpoint (Live): https://securepay.sslcommerz.com/validator/api/merchantTransIDvalidationAPI.php
Method: GET
| Param Name | Data Type | Description |
|---|---|---|
bank_tran_id | string (80) | Mandatory - Transaction ID at the bank's end. |
refund_trans_id | string (30) | Mandatory - A unique ID you generate to identify this refund. (New parameter as of 24/02/2025.) |
store_id | string (30) | Mandatory |
store_passwd | string (30) | Mandatory |
refund_amount | decimal (10,2) | Mandatory - Amount to refund to the cardholder. |
refund_remarks | string (255) | Mandatory - Reason for the refund. |
refe_id | string (50) | Any reference number of your own, for reconciliation. |
format | string (10) | json or xml. Defaults to json. |
| Returned Param | Data Type | Description |
|---|---|---|
APIConnect | string (30) | DONE (success), FAILED (auth failed), INACTIVE (store inactive), or INVALID_REQUEST. |
bank_tran_id | string (80) | Transaction ID at the bank's end. |
trans_id | string (30) | Returned only when authentication succeeds and bank_tran_id is valid. |
refund_ref_id | string (50) | Returned only when the request initiates successfully. |
status | string (30) | success, failed, or processing (already initiated). |
errorReason | string (255) | Failure reason, if any. |
Security Check Point: your public IP must be registered at the SSLCOMMERZ live system.
$ curl -X GET 'https://sandbox.sslcommerz.com/validator/api/merchantTransIDvalidationAPI.php?bank_tran_id=1709162345070ANJdZV8LyI4cMw&refund_trans_id=TRID0000000001&refund_amount=5.50&refund_remarks=Out%20of%20Stock&store_id=testbox&store_passwd=qwerty&v=1&format=json'
Response Example
{
"APIConnect": "DONE",
"bank_tran_id": "1709162345070ANJdZV8LyI4cMw",
"trans_id": "SSLCZ_TEST_59bd635981a94",
"refund_ref_id": "59bd63fea5455",
"status": "success",
"errorReason": ""
}
Query Refund Status
Check whether a refund has been credited to the customer's account.
| Param Name | Data Type | Description |
|---|---|---|
refund_ref_id | string (50) | Mandatory - Returned when the refund was initiated. |
store_id | string (30) | Mandatory |
store_passwd | string (30) | Mandatory |
Returns the same APIConnect/bank_tran_id fields as above, plus initiated_on, refunded_on (datetimes), and status: refunded, processing, or cancelled.
$ curl -X GET 'https://sandbox.sslcommerz.com/validator/api/merchantTransIDvalidationAPI.php?refund_ref_id=59bd63fea5455&store_id=testbox&store_passwd=qwerty&format=json'
Response Example
{
"APIConnect": "DONE",
"bank_tran_id": "1709162345070ANJdZV8LyI4cMw",
"tran_id": "SSLCZ_TEST_59bd635981a94",
"initiated_on": "2017-09-16 23:48:46",
"refunded_on": "2017-09-17 08:53:51",
"status": "refunded",
"refund_ref_id": "59bd63fea5455"
}
Transaction Query API
Query your transaction status at any time - useful for ticketing systems or product-limit checks before releasing a hold.
By Session ID
Request: sessionkey, store_id, store_passwd (all mandatory). Returns the same fields as Order Validation, plus status can also be PENDING (not yet completed).
$ curl -X GET 'https://sandbox.sslcommerz.com/validator/api/merchantTransIDvalidationAPI.php?sessionkey=C3329C5E252DF44B323D9BAF47ACBCD9&store_id=testbox&store_passwd=qwerty&format=json'
Response Example
{
"status": "VALID",
"sessionkey": "C3329C5E252DF44B323D9BAF47ACBCD9",
"tran_date": "2017-09-20 23:37:56",
"tran_id": "59C2A4F6432F8",
"val_id": "1709202338060TUgLqWw1PgB4GA",
"amount": "10.00",
"store_amount": "9.6",
"bank_tran_id": "1709202338061Ac2MhyeosVJmUh",
"card_type": "VISA-Brac bank",
"risk_title": "Safe",
"risk_level": "0",
"APIConnect": "DONE",
"validated_on": "2017-09-20 23:38:07"
}
By Transaction ID
Request: tran_id, store_id, store_passwd (all mandatory). Since one tran_id can have multiple attempts, this returns an element array with no_of_trans_found, each element carrying the same per-transaction fields as above.
$ curl -X GET 'https://sandbox.sslcommerz.com/validator/api/merchantTransIDvalidationAPI.php?tran_id=59C2A4F6432F8&store_id=testbox&store_passwd=qwerty&format=json'
Response Example
{
"APIConnect": "DONE",
"no_of_trans_found": 5,
"element": [
{
"val_id": "17092023365512Wr2jmzTG69nV6",
"status": "VALIDATED",
"tran_id": "59C2A4F6432F8",
"amount": "10.00",
"store_amount": "9.75",
"bank_tran_id": "17092023365508TFa1fjTrvgIhz",
"card_type": "VISA-City Bank",
"risk_title": "Safe",
"risk_level": "0",
"currency": "BDT"
}
// ... one element per attempt found
]
}
Common Issues
Network Issues:
- Your IPN Listener must use a common port (80 or 443) and be reachable from the internet
- Whitelist SSLCOMMERZ's IPs at your network firewall
- Sandbox: requires access to
sandbox.sslcommerz.com; open TCP 80/443 from103.26.139.87 - Production: requires access to
securepay.sslcommerz.com; open TCP 80/443 from103.26.139.81&103.132.153.81, and be able to reach TCP 443 of103.26.139.148&103.132.153.148
Library Resources for Integration
Reference SDKs and code samples across common frameworks and languages are maintained at the SSLCommerz GitHub organization.
Library Resources for IntegrationSecurePay API (Mobile SDK)
SecurePay is the mobile-app-facing counterpart to the V4 gateway API above - device registration, OTP-based customer login, saved-card management, and EMI/offer lookups for native mobile integrations. Endpoints live under /securepay/api.php/{action} (get_token, send_checkout_otp, verify_checkout_otp, login_status, mycards, get_emi, logoff, and related actions), each requiring a device's reg_id/enc_key pair obtained from get_token.
Postman Collection
No hosted collection is published yet - every request on this page is a plain curl example, so you can import any of them into Postman directly via Import → Raw text.