Create transaction

Request

Live

POST https://fumopay.app/transaction/pay/

Test

POST https://fumopay.dev/transaction/pay/

The test bank details is available here.

Payload

{
    "merchant_profile": { 
        "profile_key": "your public key" 
    },
    "currency": "GBP",
    "description": "Description on customer's app",
    "ext_reference": "Your internal reference",
    "ext_customer": "Your customer reference",
    "amount": 100,
    "age": 1,
    "redirect_url": "optional url",
    "signature": "Signed fields"
}

Field descriptions

field	usage
profile_key	This is your public key from the profile that you are using
currency	3 digit ISO currency code. This currently only accepts GBP
description	This is the description that is shown to the customer
ext_reference	This is your internal reference code. For example an order number
ext_customer	This is your customer reference. For example it can be an email or a customer id
amount	The amount in minor units, eg. £1.34 is 134
age	How many hours the transaction stays active. This is an optional field with a default of 1 hour.
redirect_url	This is an optional field to override the redirect url set on the used profile.
signature	The signed request which is detailed below

Request signing

The signature is the concatenation of certain fields which is then given a SHA512 hash which is finally base64 encoded. In pseudo code as follows:

strToHash = currency + description + profile_key + ext_reference + secret_key
hash = sha512(strToHash)
signature = base64.encode(hash)

The secret key is from the profile that you are using.

See code examples below.

Response

{
    "transaction_id": "fumo transaction code",
    "result": "1",
    "error": "error description",
    "url": "a fumopay url"
}

Field descriptions

field	usage
transaction_id	This is the fumo transaction code
result	The result of the call. Please see status codes
error	The error message if not successful
url	The url relevant to the type of profile. For redirect profiles this is where you redirect the user. For inline it can be used to load the iframe. Please see TODO for more information.

Signing Code examples

JavaScript

let toHash = `${currency}${description}${profile_key}${reference}${secret_key}`
const msgUint8 = new TextEncoder().encode(toHash)
const hashBuffer = await crypto.subtle.digest("SHA-512", msgUint8)
let signature = window.btoa(String.fromCharCode(...new Uint8Array(hashBuffer)))

PHP

$strToHash = implode('',[$currency, $description, $profile_key, $reference, $secret_key]);
$hashed = hash("sha512", $strToHash, true);
$signature = base64_encode($hashed);

Golang

stringToHash := fmt.Sprintf("%s%s%s%s%s", currency, description, profileKey, reference, secretKey)
hash := sha512.New()
hash.Write([]byte(stringToHash))
signature := base64.StdEncoding.EncodeToString(hash.Sum(nil))

Python

stringToHash = "".join([currency, description, profileKey, reference, secretKey])
hash = hashlib.sha512(stringToHash.encode('utf-8'))
signature =  base64.b64encode(hash.digest()).decode("utf-8")

Dart

final strtoHash = currency + description + profileKey + extReference + secretKey;
var bytes = utf8.encode(strtoHash);
var digest = sha512.convert(bytes);
var signature = base64.encode(digest.bytes);