Integration Guide & API Reference

const r = await fetch("https://hexupi.xyz/api/v1/create-order", {
  method: "POST",
  headers: {
    "x-api-key": process.env.HEX_API_KEY,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    amount: 199,
    order_id: "ORD-" + Date.now(),
    webhook: "https://yoursite.com/hexpay-webhook",
    redirect: "https://yoursite.com/thanks"
  })
});
const o = await r.json();
if (!r.ok || !o.ok) throw new Error(o.error || "Gateway error");
console.log(o.pay_url, o.payable);

import os, time, requests

r = requests.post(
    "https://hexupi.xyz/api/v1/create-order",
    headers={"x-api-key": os.environ["HEX_API_KEY"]},
    json={
        "amount": 199,
        "order_id": f"ORD-{int(time.time())}",
        "webhook": "https://yoursite.com/hexpay-webhook",
        "redirect": "https://yoursite.com/thanks",
    },
    timeout=20,
)
o = r.json()
if not r.ok or not o.get("ok"):
    raise Exception(o.get("error", "Gateway error"))
print(o["pay_url"], o["payable"])

curl -X POST https://hexupi.xyz/api/v1/create-order \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"amount":199,"order_id":"ORD-1001","webhook":"https://yoursite.com/hexpay-webhook"}'

package main

import (
    "bytes"
    "encoding/json"
    "fmt"
    "io"
    "net/http"
    "os"
)

func main() {
    body, _ := json.Marshal(map[string]any{
        "amount":   199,
        "order_id": "ORD-1001",
        "webhook":  "https://yoursite.com/hexpay-webhook",
    })
    req, _ := http.NewRequest("POST",
        "https://hexupi.xyz/api/v1/create-order",
        bytes.NewBuffer(body))
    req.Header.Set("x-api-key", os.Getenv("HEX_API_KEY"))
    req.Header.Set("Content-Type", "application/json")

    res, _ := http.DefaultClient.Do(req)
    defer res.Body.Close()
    raw, _ := io.ReadAll(res.Body)
    fmt.Println(string(raw))
}

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

var json = """
    {"amount":199,"order_id":"ORD-1001","webhook":"https://yoursite.com/hexpay-webhook"}
    """;
var req = HttpRequest.newBuilder()
    .uri(URI.create("https://hexupi.xyz/api/v1/create-order"))
    .header("x-api-key", System.getenv("HEX_API_KEY"))
    .header("Content-Type", "application/json")
    .POST(HttpRequest.BodyPublishers.ofString(json))
    .build();
var res = HttpClient.newHttpClient().send(req, HttpResponse.BodyHandlers.ofString());
System.out.println(res.body());

using System.Net.Http.Json;

var http = new HttpClient();
http.DefaultRequestHeaders.Add("x-api-key",
    Environment.GetEnvironmentVariable("HEX_API_KEY"));

var res = await http.PostAsJsonAsync(
    "https://hexupi.xyz/api/v1/create-order",
    new {
        amount = 199,
        order_id = "ORD-1001",
        webhook = "https://yoursite.com/hexpay-webhook"
    });

var json = await res.Content.ReadAsStringAsync();
Console.WriteLine(json);

require "net/http"
require "json"

uri = URI("https://hexupi.xyz/api/v1/create-order")
req = Net::HTTP::Post.new(uri)
req["x-api-key"]    = ENV["HEX_API_KEY"]
req["Content-Type"] = "application/json"
req.body = {
    amount: 199,
    order_id: "ORD-1001",
    webhook: "https://yoursite.com/hexpay-webhook"
}.to_json

res = Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == "https") do |h|
    h.request(req)
end
puts res.body

const express = require("express");
const crypto = require("crypto");
const app = express();
const API_KEY = process.env.HEX_API_KEY;

// IMPORTANT: express.raw gives the untouched body.
// JSON.stringify(req.body) will NOT match the signature.
app.post("/hexpay-webhook", express.raw({ type: "*/*" }), (req, res) => {
    const sig  = String(req.headers["x-signature"] || "");
    const calc = crypto.createHmac("sha256", API_KEY)
                       .update(req.body)
                       .digest("hex");
    const ok = sig.length === calc.length
        && crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(calc));
    if (!ok) return res.status(401).send("bad signature");

    const ev = JSON.parse(req.body.toString());
    if (ev.event === "payment.success") {
        // ev.id = gateway order id, ev.order_id = YOUR reference
        // The same event can arrive more than once
        // -> mark paid ONCE per ev.id
    }
    res.send("ok");
});

app.listen(3000);

import os, hmac, hashlib, json
from flask import Flask, request, abort

app = Flask(__name__)
API_KEY = os.environ["HEX_API_KEY"]

@app.post("/hexpay-webhook")
def hexpay_webhook():
    raw  = request.get_data()                 # RAW body
    calc = hmac.new(API_KEY.encode(), raw, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(calc, request.headers.get("x-signature", "")):
        abort(401)

    ev = json.loads(raw)
    if ev.get("event") == "payment.success":
        # ev["id"] = gateway order id, ev["order_id"] = YOUR reference
        # The same event can arrive more than once
        # -> mark paid ONCE per ev["id"]
        pass
    return "ok"

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "io"
    "log"
    "net/http"
    "os"
)

func webhook(w http.ResponseWriter, r *http.Request) {
    raw, _ := io.ReadAll(r.Body)
    mac := hmac.New(sha256.New, []byte(os.Getenv("HEX_API_KEY")))
    mac.Write(raw)
    if !hmac.Equal([]byte(hex.EncodeToString(mac.Sum(nil))),
        []byte(r.Header.Get("x-signature"))) {
        http.Error(w, "bad signature", 401)
        return
    }
    log.Println("payment ok:", string(raw))
    w.WriteHeader(200)
    w.Write([]byte("ok"))
}

func main() {
    http.HandleFunc("/hexpay-webhook", webhook)
    http.ListenAndServe(":3000", nil)
}

using System.Security.Cryptography;
using System.Text;

app.MapPost("/hexpay-webhook", async (HttpRequest req) =>
{
    using var reader = new StreamReader(req.Body);
    var raw = await reader.ReadToEndAsync();
    var sig = req.Headers["x-signature"].ToString();

    using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(
        Environment.GetEnvironmentVariable("HEX_API_KEY")));
    var calc = Convert.ToHexString(
        hmac.ComputeHash(Encoding.UTF8.GetBytes(raw))).ToLower();

    if (calc != sig) return Results.Unauthorized();

    // process raw JSON here...
    return Results.Text("ok");
});

import os, io, time, hmac, hashlib, json, threading
import requests, qrcode, telebot
from telebot import types
from flask import Flask, request, abort

GW         = "https://hexupi.xyz"
API_KEY    = os.environ["HEX_API_KEY"]
PUBLIC_URL = os.environ["PUBLIC_URL"]
bot        = telebot.TeleBot(os.environ["BOT_TOKEN"])
app        = Flask(__name__)

wallet, orders, lock = {}, {}, threading.Lock()


def gw(path, body=None):
    r = requests.request("POST" if body else "GET", GW + path, json=body,
                         headers={"x-api-key": API_KEY}, timeout=20)
    d = r.json()
    if not r.ok or d.get("error"):
        raise Exception(d.get("error") or f"Gateway error {r.status_code}")
    return d


def credit_once(order_id):
    with lock:
        o = orders.get(order_id)
        if not o or o["credited"]:
            return
        o["credited"] = True
        wallet[o["tg"]] = wallet.get(o["tg"], 0) + o["amount"]
        bal = wallet[o["tg"]]
    bot.send_message(o["tg"], f"Added Rs.{o['amount']}.\nBalance: Rs.{bal}")


@bot.message_handler(commands=["balance"])
def balance(m):
    bot.reply_to(m, f"Wallet: Rs.{wallet.get(m.from_user.id, 0)}")


@bot.message_handler(commands=["add"])
def add(m):
    try:
        amount = float(m.text.split()[1])
        assert 1 <= amount <= 100000
    except Exception:
        return bot.reply_to(m, "Usage: /add 100")
    try:
        o = gw("/api/v1/create-order", {
            "amount": amount,
            "order_id": f"W{m.from_user.id}-{int(time.time())}",
            "webhook": PUBLIC_URL + "/hexpay-webhook",
        })
        orders[o["id"]] = {"tg": m.from_user.id, "amount": amount, "credited": False}

        buf = io.BytesIO()
        qrcode.make(o["upi"]).save(buf, "PNG")
        buf.seek(0)

        kb = types.InlineKeyboardMarkup()
        kb.add(types.InlineKeyboardButton("Open payment page", url=o["pay_url"]))
        kb.add(types.InlineKeyboardButton("I have paid", callback_data="chk:" + o["id"]))

        bot.send_photo(m.chat.id, buf, reply_markup=kb,
                       caption=f"Pay exactly Rs.{o['payable']} (valid 10 min)")
        threading.Thread(target=poll, args=(o["id"],), daemon=True).start()
    except Exception as e:
        bot.reply_to(m, "Error: " + str(e))


def poll(oid):
    for _ in range(132):
        time.sleep(5)
        if orders[oid]["credited"]:
            return
        try:
            s = gw("/api/v1/status/" + oid)
            if s["paid"]:
                return credit_once(oid)
            if s["status"] == "EXPIRED":
                return
        except Exception:
            pass


@bot.callback_query_handler(func=lambda c: c.data.startswith("chk:"))
def check(c):
    oid = c.data[4:]
    try:
        s = gw("/api/v1/status/" + oid)
        if s["paid"]:
            credit_once(oid)
        bot.answer_callback_query(c.id, "Paid" if s["paid"] else "Status: " + s["status"])
    except Exception:
        bot.answer_callback_query(c.id, "Try again")


@app.post("/hexpay-webhook")
def hook():
    raw  = request.get_data()
    calc = hmac.new(API_KEY.encode(), raw, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(calc, request.headers.get("x-signature", "")):
        abort(401)
    ev = json.loads(raw)
    if ev.get("event") == "payment.success":
        credit_once(ev["id"])
    return "ok"


if __name__ == "__main__":
    threading.Thread(target=bot.infinity_polling, daemon=True).start()
    app.run(host="0.0.0.0", port=int(os.environ.get("PORT", 3000)))

<?php
const HEX_GW  = 'https://hexupi.xyz';
const HEX_KEY = 'hex_live_xxxxxxxx';


function hex_call($path, $body = null) {
    $ch = curl_init(HEX_GW . $path);
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT        => 20,
        CURLOPT_HTTPHEADER     => [
            'x-api-key: ' . HEX_KEY,
            'Content-Type: application/json',
        ],
    ]);
    if ($body !== null) {
        curl_setopt($ch, CURLOPT_POST, true);
        curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($body));
    }
    $d = json_decode(curl_exec($ch), true);
    curl_close($ch);
    if (!$d || !empty($d['error'])) {
        throw new Exception($d['error'] ?? 'Gateway error');
    }
    return $d;
}


function hex_create($tgId, $amount, $webhookUrl) {
    return hex_call('/api/v1/create-order', [
        'amount'   => $amount,
        'order_id' => "W{$tgId}-" . time(),
        'webhook'  => $webhookUrl,
    ]);
}


function hex_qr_png_url($upiLink) {
    return 'https://api.qrserver.com/v1/create-qr-code/?size=512x512&data='
        . rawurlencode($upiLink);
}


function hex_status($gatewayOrderId) {
    return hex_call('/api/v1/status/' . rawurlencode($gatewayOrderId));
}


function hex_handle_webhook(callable $creditOnce) {
    $raw = file_get_contents('php://input');
    $sig = $_SERVER['HTTP_X_SIGNATURE'] ?? '';
    if (!hash_equals(hash_hmac('sha256', $raw, HEX_KEY), $sig)) {
        http_response_code(401);
        exit('bad signature');
    }
    $ev = json_decode($raw, true);
    if (($ev['event'] ?? '') === 'payment.success') {
        $creditOnce($ev['id'], (float)$ev['amount']);
    }
    echo 'ok';
}

def buy(tg_id, price):
    with lock:
        if wallet.get(tg_id, 0) < price:
            return False
        wallet[tg_id] -= price
    return True

<?php
$st = $pdo->prepare(
    "UPDATE users SET bal = bal - ? WHERE tg_id = ? AND bal >= ?"
);
$st->execute([$price, $tgId, $price]);
if ($st->rowCount() === 1) {
    // deliver product
}

var req = URLRequest(
    url: URL(string: "https://yoursite.com/api/create-order")!
)
req.httpMethod = "POST"
req.setValue("application/json", forHTTPHeaderField: "Content-Type")
req.httpBody = #"{"amount":199}"#.data(using: .utf8)

URLSession.shared.dataTask(with: req) { data, _, _ in
    guard let data = data,
          let json = try? JSONSerialization
              .jsonObject(with: data) as? [String: Any],
          let payUrl = json["pay_url"] as? String,
          let url = URL(string: payUrl) else { return }
    DispatchQueue.main.async { UIApplication.shared.open(url) }
}.resume()

import 'package:http/http.dart' as http;
import 'package:url_launcher/url_launcher.dart';
import 'dart:convert';

Future<void> pay() async {
    final r = await http.post(
        Uri.parse('https://yoursite.com/api/create-order'),
        headers: {'Content-Type': 'application/json'},
        body: jsonEncode({'amount': 199}),
    );
    final o = jsonDecode(r.body);
    await launchUrl(Uri.parse(o['pay_url']));
}

import { Linking } from 'react-native';

const res = await fetch('https://yoursite.com/api/create-order', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ amount: 199 }),
});
const o = await res.json();
Linking.openURL(o.pay_url);

const QRCode = require("qrcode");               // npm i qrcode
const png = await QRCode.toBuffer(order.upi, { width: 512, margin: 2 });
// send png to Telegram / Discord / WhatsApp

import io, qrcode                                 # pip install qrcode[pil]
buf = io.BytesIO()
qrcode.make(order["upi"]).save(buf, "PNG")
buf.seek(0)

<?php
// composer require endroid/qr-code
use Endroid\QrCode\Builder\Builder;

$png = Builder::create()
    ->data($order["upi"])
    ->size(512)
    ->margin(10)
    ->build()
    ->getString();