To'lovlarni qabul qiling — bir necha daqiqada
inPAY REST API merchantlarga to'lov tranzaksiyalarini xavfsiz va tezkor yaratish imkoniyatini beradi. RESTful arxitektura, JSON format, Bearer Token autentifikatsiya.
Tezkor boshlash
5 daqiqada to'lov qabul qilishni boshlang
Autentifikatsiya
24 soatlik Bearer token olish
API bilan ishlash uchun Bearer Token olish kerak. Token 24 soat amal qiladi. Har bir so'rovda Authorization: Bearer {token} headerini yuboring.
| Parametr | Tip | Majburiy | Tavsif |
|---|---|---|---|
| merchant_id | integer | ✓ Ha | Merchant identifikatori |
| merchant_token | string | ✓ Ha | Merchant token (32 belgili) |
Accept: application/json
curl -X GET "https://inpay.uz/api/v1/authorization/?merchant_id=1353&merchant_token=6a7bf375b302cfcda6692e6f60402cb3" \ -H "Accept: application/json"
<?php $curl = curl_init(); curl_setopt_array($curl, [ CURLOPT_URL => 'https://inpay.uz/api/v1/authorization/?merchant_id=1353&merchant_token=...', CURLOPT_RETURNTRANSFER => true, CURLOPT_HTTPHEADER => ['Accept: application/json'], ]); $res = json_decode(curl_exec($curl), true); curl_close($curl); // Tokenni keshda saqlang (24 soat) apcu_store('inpay_token', $res['bearer_token'], 86400);
import requests r = requests.get( "https://inpay.uz/api/v1/authorization/", params={"merchant_id": 1353, "merchant_token": "..."}, headers={"Accept": "application/json"}, timeout=10, ) token = r.json()["bearer_token"] # Save token to cache for 24 hours
{
"success": true,
"bearer_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}To'lov yaratish
Yangi tranzaksiyani boshlash
Yangi to'lov tranzaksiyasini yaratish. Muvaffaqiyatli bo'lsa foydalanuvchini pay_url ga yo'naltiring. Endpoint oxirida / belgisi shart.
Content-Type: application/json
Authorization: Bearer {your_bearer_token}| Parametr | Tip | Majburiy | Tavsif |
|---|---|---|---|
| merchant_id | string | ✓ Ha | Merchant ID |
| token | string | ✓ Ha | Merchant token |
| amount | number | ✓ Ha | To'lov summasi (min: 1 000 so'm) |
| description | string | — Ixtiyoriy | To'lov haqida izoh |
| payment_method | string | — Ixtiyoriy | To'lov usuli (click, payme, inPAY) |
| callback_url | string | — Ixtiyoriy | Webhook URL manzili |
| phone | string | — Ixtiyoriy | Telefon raqami (998901234567) |
curl -X POST "https://inpay.uz/api/v1/create/" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \ -d '{ "merchant_id": "1353", "token": "6a7bf375b302cfcda6692e6f60402cb3", "amount": 15000, "description": "Order #12345", "payment_method": "click", "phone": "998901234567", "callback_url": "https://merchant.uz/payment/callback" }'
<?php $payload = [ 'merchant_id' => '1353', 'token' => '6a7bf375b302cfcda6692e6f60402cb3', 'amount' => 15000, 'description' => 'Order #12345', 'payment_method' => 'click', 'phone' => '998901234567', 'callback_url' => 'https://merchant.uz/payment/callback', ]; $ch = curl_init('https://inpay.uz/api/v1/create/'); curl_setopt_array($ch, [ CURLOPT_RETURNTRANSFER => true, CURLOPT_POST => true, CURLOPT_POSTFIELDS => json_encode($payload), CURLOPT_HTTPHEADER => [ 'Content-Type: application/json', 'Authorization: Bearer ' . $bearerToken, ], ]); $res = json_decode(curl_exec($ch), true); curl_close($ch); if ($res['success']) { header('Location: ' . $res['pay_url']); exit; }
const axios = require('axios'); const { data } = await axios.post('https://inpay.uz/api/v1/create/', { merchant_id: '1353', token: '6a7bf375b302cfcda6692e6f60402cb3', amount: 15000, description: 'Order #12345', payment_method: 'click', phone: '998901234567', callback_url: 'https://merchant.uz/payment/callback', }, { headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${bearerToken}`, }, }); console.log('order_id:', data.order_id); console.log('pay_url: ', data.pay_url);
import requests payload = { "merchant_id": "1353", "token": "6a7bf375b302cfcda6692e6f60402cb3", "amount": 15000, "description": "Order #12345", "payment_method": "click", "phone": "998901234567", "callback_url": "https://merchant.uz/payment/callback", } r = requests.post( "https://inpay.uz/api/v1/create/", json=payload, headers={"Authorization": f"Bearer {bearer_token}"}, timeout=15, ) data = r.json() print(data["pay_url"])
{
"success": true,
"order_id": "1ff2f5a6d66f6e9c",
"pay_url": "https://inpay.uz/checkout/1ff2f5a6d66f6e9c",
"phone": "998901234567",
"message": "invoice yaratildi",
"security": {
"ip_mode": "optional",
"ip_check": "IP verified (optional)"
}
}Tranzaksiya holati
order_id orqali holatni tekshirish
| Parametr | Tip | Majburiy | Tavsif |
|---|---|---|---|
| order_id | string | ✓ Ha | To'lov yaratishda qaytarilgan buyurtma ID |
curl -X GET "https://inpay.uz/api/v1/transactions/?order_id=1ff2f5a6d66f6e9c" \ -H "Accept: application/json"
<?php $orderId = '1ff2f5a6d66f6e9c'; $ch = curl_init(); curl_setopt_array($ch, [ CURLOPT_URL => "https://inpay.uz/api/v1/transactions/?order_id={$orderId}", CURLOPT_RETURNTRANSFER => true, CURLOPT_HTTPHEADER => ['Accept: application/json'], ]); $data = json_decode(curl_exec($ch), true); curl_close($ch); // $data['status'] => pending | success | failed | cancelled
{
"success": true,
"order_id": "1ff2f5a6d66f6e9c",
"status": "success",
"amount": 15000,
"payment_method": "click",
"created_at": "2025-12-10 05:14:52",
"paid_at": "2025-12-10 05:15:23"
}Webhook bildirishnomalar
To'lov holati o'zgarganda real-time xabar
| Parametr | Tip | Tavsif |
|---|---|---|
| amount | string | To'lov summasi (masalan: "15000.00") |
| status | string | To'lov holati: success yoki failed |
| order_id | string | Buyurtma identifikatori |
| transaction_id | integer | inPAY tizimidagi tranzaksiya ID |
| created_at | string | Yaratilgan vaqt (ISO format) |
{
"amount": "15000.00",
"status": "success",
"order_id": "1ff2f5a6d66f6e9c",
"transaction_id": 149,
"created_at": "2025-12-10 05:14:52"
}<?php $input = file_get_contents('php://input'); $data = json_decode($input, true); if (!$data) { http_response_code(400); exit('Invalid JSON'); } if (($data['status'] ?? '') === 'success') { // Update order in your DB $pdo->prepare('UPDATE orders SET status=?, paid_at=NOW() WHERE order_id=?') ->execute(['paid', $data['order_id']]); } // Always respond 200 OK http_response_code(200); echo 'OK';
const express = require('express'); const app = express(); app.use(express.json()); app.post('/payment/callback', async (req, res) => { const { amount, status, order_id, transaction_id } = req.body; if (status === 'success') { await db.query( 'UPDATE orders SET status = ? WHERE order_id = ?', ['paid', order_id] ); } res.status(200).send('OK'); });
from flask import Flask, request app = Flask(__name__) @app.route("/payment/callback", methods=["POST"]) def callback(): data = request.get_json(silent=True) or {} if data.get("status") == "success": # update DB mark_paid(data["order_id"]) return "OK", 200
- Webhook URL ni callback_url da yuboring — aks holda kassadagi default URL ishlatiladi
- Handler JSON formatini qabul qilishi va HTTP 200 qaytarishi shart
- Webhook URL HTTPS bo'lishi tavsiya etiladi
Xato kodlari
API javob xatolari va ularning ma'nosi
| Xato kodi | HTTP | Tavsif |
|---|---|---|
| MISSING_AUTH_TOKEN | 401 | Authorization token topilmadi |
| INVALID_TOKEN | 401 | Bearer token noto'g'ri yoki muddati tugagan |
| MISSING_MERCHANT_ID | 400 | merchant_id parametri topilmadi |
| MERCHANT_NOT_FOUND | 404 | Merchant topilmadi |
| IP_NOT_WHITELISTED_STRICT | 403 | IP manzil whitelist da yo'q (Strict mode) |
| RATE_LIMIT_EXCEEDED | 429 | So'rovlar soni limitdan oshdi (100/soat) |
| CALLBACK_NOT_WHITELISTED | 403 | Callback URL whitelist da yo'q |
| MERCHANT_WEBSITE_NOT_WHITELISTED | 403 | Merchant website whitelist da active emas |
| AMOUNT_TOO_LOW | 400 | Summa juda kam (min: 1 000 so'm) |
| AMOUNT_TOO_HIGH | 400 | Summa maksimal limitdan oshdi |
| TRANSACTION_SAVE_FAILED | 500 | Tranzaksiya saqlanmadi (server xatosi) |
{
"success": false,
"message": "Minimal to'lov summasi 1000 so'm",
"error_code": "AMOUNT_TOO_LOW"
}- Har doim success maydonini tekshiring, so'ng error_code asosida xatolarni boshqaring
- 401/403 xatolarida autentifikatsiyani qayta tekshiring
- 429 xatolarida biroz kuting va qayta urinib ko'ring
- 500 xatolarida support bilan bog'laning: @merchants_uz
Xavfsizlik
IP Whitelist, Rate Limiting va token himoyasi
Har bir IP manzil uchun soatiga 100 ta so'rov limiti. Limit oshirilsa, RATE_LIMIT_EXCEEDED xatosi qaytariladi.
- Token 24 soat amal qiladi — keshda saqlang
- Tokenni server-side saqlang, hech kimga bermang
- Har so'rovda Authorization: Bearer {token} headerini yuboring
- Muddati tugagandan so'ng yangi token oling
Callback URL va merchant website whitelist da bo'lishi kerak. Sozlamalar uchun inPAY platformasiga kiring.
Eng yaxshi amaliyotlar
Ishonchli integratsiya uchun tavsiyalar