Laravel PayTR Integration: Step-by-Step Installation and Payment Processes

Preparation for PayTR API Integration

First of all, you need to get API information from your PayTR account:

• Store ID (Merchant ID)

• API Key (Merchant Key)

• Secret Key (Merchant Salt)

To get this information, you can log in to the PayTR panel and visit the "API Information" section.

PayTR Integration to Laravel Project

Installing the Required Package with Composer

First of all, to integrate PayTR into your Laravel project, run the Composer command below to load the required library:

composer require paytr/paytr

Adding PayTR API Information to .env File

Add your PayTR information to your project's .env file:

PAYTR_MERCHANT_ID=your_merchant_id
PAYTR_MERCHANT_KEY=your_merchant_key
PAYTR_MERCHANT_SALT=your_merchant_salt

Creating a Payment Form

To create a payment request, create a controller in Laravel:

use Illuminate\Http\Request;
use Illuminate\Support\Facades\Http;

class PaymentController extends Controller
{
    public function createPayment(Request $request)
    {
        $merchant_id = env('PAYTR_MERCHANT_ID');
        $merchant_key = env('PAYTR_MERCHANT_KEY');
        $merchant_salt = env('PAYTR_MERCHANT_SALT');

        $user_ip = request()->ip();
        $email = 'test@example.com';
        $payment_amount = 10000; // 100.00 TL
        $merchant_oid = uniqid();
        $ok_url = route('payment.success');
        $fail_url = route('payment.fail');
        $user_basket = base64_encode(json_encode([
            ["Ürün Adı", "100.00", 1]
        ]));

        $hash_str = $merchant_id . $user_ip . $merchant_oid . $email . $payment_amount . $ok_url . $fail_url . $user_basket . $merchant_salt;
        $paytr_token = base64_encode(hash_hmac('sha256', $hash_str, $merchant_key, true));

        $post_vals = [
            'merchant_id' => $merchant_id,
            'user_ip' => $user_ip,
            'merchant_oid' => $merchant_oid,
            'email' => $email,
            'payment_amount' => $payment_amount,
            'paytr_token' => $paytr_token,
            'user_basket' => $user_basket,
            'debug_on' => 1,
            'no_installment' => 0,
            'max_installment' => 12,
            'currency' => 'TL'
        ];

        $response = Http::asForm()->post('https://www.paytr.com/odeme/api/get-token', $post_vals);
        $result = $response->json();

        if ($result['status'] == 'success') {
            return view('payment.form', ['token' => $result['token']]);
        } else {
            return back()->with('error', $result['reason']);
        }
    }
}

Payment Success and Error Pages

Define routes for successful and unsuccessful payment transactions:

Route::get('/payment/success', function () {
    return 'Ödeme başarılı!';
})->name('payment.success');

Route::get('/payment/fail', function () {
    return 'Ödeme başarısız!';
})->name('payment.fail');

Safety Precautions and Best Practices

Webhook Usage

You can use PayTR's callback (webhook) feature to verify payments. Create an endpoint for callback:

Route::post('/payment/callback', [PaymentController::class, 'callback']);

public function callback(Request $request)
{
    $hash = base64_encode(hash_hmac('sha256', $request->merchant_oid . env('PAYTR_MERCHANT_SALT'), env('PAYTR_MERCHANT_KEY'), true));
    
    if ($hash !== $request->hash) {
        return response('PAYTR notification failed', 403);
    }

    if ($request->status === 'success') {
        // Ödeme başarılı, veritabanına kaydedin
    }

    return response('OK', 200);
}

Payment Process Simulation in a Test Environment

PayTR offers a sandbox environment to test the integration. You can try your transactions with test card information. Sample test card information:

Kart Numarası: 4111 1111 1111 1111
Son Kullanma Tarihi: 12/26
CVV: 000

Note: For testing operations, you need to enable "Test Mode" in your PayTR panel.

In this article, we explained step by step how to integrate PayTR into Laravel projects. For a successful payment integration, you should pay attention to issues such as API connections, security measures and webhook.