SDKs & Samples

The platform ships Java / PHP / Go SDKs and samples — signing/verification, create/query/balance, and a callback verification server — with zero third-party dependencies, byte-for-byte conformance-checked against the platform signing implementation. Delivered at sandbox onboarding; portal downloads coming later.

Create example

Go

client := &sunpay.Client{BaseURL: base, MerchantNo: "M100001", AppID: "app_10001",
    KeyVersion: 1, PrivateKeyPEM: pem}
resp, err := client.PayCreate(map[string]any{
    "mch_order_no": "T20260601001", "product_code": "QRPH",
    "amount": int64(10000), "currency": "PHP",
})

PHP

$client = new SunPayClient($base, 'M100001', 'app_10001', 1, $privatePem);
$resp = $client->payCreate([
    'mch_order_no' => 'T20260601001', 'product_code' => 'QRPH',
    'amount' => 10000, 'currency' => 'PHP',
]);

Java

SunPayClient client = new SunPayClient(base, "M100001", "app_10001", 1, privatePem);
SunPayClient.Response resp = client.payCreate(Map.of(
    "mch_order_no", "T20260601001", "product_code", "QRPH",
    "amount", 10000L, "currency", "PHP"));

• Go: conformance self-test via go test; demo includes a callback verification server.
• PHP: single-file client; only the openssl + curl extensions required (PHP 8.0+).
• Java: Java 11+, zero third-party dependencies (incl. callback verification and a built-in callback server demo).

Callback verification essentials

1. Read the raw request body (JSON);
2. Extract sign and key_version, verify with the platform public key of that version (canonical rules as in signing);
3. On success → process idempotently by platform_order_no + callback type (payouts may additionally receive a payout.reversed reversal callback, distinct from the terminal callback, see Payout) → respond HTTP 200 with plain text success;
4. On failure → do not process, do not reply success.

All three SDKs ship verifyCallback plus a runnable callback-server sample.

Generating production keys

openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out merchant_private.pem
openssl pkey -in merchant_private.pem -pubout -out merchant_public.pem

WARNING

Keep the private key server-side only: never in frontends/JS, logs, or repositories; register the public key (PEM) with the platform. Test keys used during sandbox integration must never be used in production.