PHP Examples#

Complete PHP integration examples for AuxCORE API.

Note: AuxCORE does not publish a PHP SDK package. These examples call the REST API directly with cURL. For WooCommerce, use the AuxPay WooCommerce plugin.

Setup#

php

<?php
function auxcore(string $method, string $path, ?array $body = null): array {
    $base = getenv('AUXCORE_API_BASE') ?: 'https://uat.auxcore.net/api/v1/public';
    $ch = curl_init($base . $path);
    curl_setopt_array($ch, [
        CURLOPT_CUSTOMREQUEST => $method,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER => [
            'x-api-key: ' . getenv('AUXCORE_API_KEY'),
            'Content-Type: application/json',
        ],
        CURLOPT_POSTFIELDS => $body !== null ? json_encode($body) : null,
    ]);
    $raw = curl_exec($ch);
    $status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);
    return [$status, json_decode($raw, true) ?? []];
}

Tenant-wide ERP keys (lv_erp_…) must also send X-Merchant-ID: <merchant uuid>.

Process Payment#

Raw card numbers are rejected on Sandbox and Production — charge a pci_tok_… token from the PCI SDK or from POST /tokenize-card.

php

<?php
[$status, $body] = auxcore('POST', '/transaction', [
    'Amount' => 100.00,
    'pciToken' => 'pci_tok_a1b2c3d4e5f6',
    'BillingCustomerName' => 'John Doe',
    'BillingEmail' => 'john@example.com',
    'BillingAddress' => '123 Main St',
    'BillingCity' => 'New York',
    'BillingState' => 'NY',
    'BillingPostalCode' => '10001',
    'BillingCountry' => 'US',
    'OrderId' => 'ORD-1001',
]);

if ($status === 200 && !empty($body['requires_action'])) {
    header('Location: ' . $body['data']['RedirectUrl']);
} elseif ($status === 200 && $body['success']) {
    echo "Transaction approved: " . $body['data']['TransactionId'];
} elseif ($status === 402) {
    echo "Payment declined: " . $body['message'];
} else {
    echo "Error {$status}: " . json_encode($body);
}

Webhook Handler#

The X-Webhook-Signature header is t=<unix>,v1=<hex>, where v1 is HMAC-SHA256 of "<t>.<raw body>" keyed with the endpoint secret.

php

<?php
// webhook.php
$payload = file_get_contents('php://input');
$header = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';
$secret = getenv('AUXCORE_WEBHOOK_SECRET');

parse_str(str_replace(',', '&', $header), $parts);
$t = (int)($parts['t'] ?? 0);
$expected = hash_hmac('sha256', $t . '.' . $payload, $secret);

if (!$t || abs(time() - $t) > 300 || !hash_equals($expected, $parts['v1'] ?? '')) {
    http_response_code(401);
    die('Invalid signature');
}

$event = json_decode($payload, true); // id, type, created, data, metadata

switch ($event['type']) {
    case 'transaction.approved':
        handleTransactionApproved($event['data']);
        break;
    case 'transaction.declined':
        handleTransactionDeclined($event['data']);
        break;
}

http_response_code(200);

function handleTransactionApproved($data) {
    // Update order $data['orderId'], send receipt
}

function handleTransactionDeclined($data) {
    // Notify customer: $data['responseText']
}

Next: Python examples →