Paymob_Integration_DotNet

KO | EN

gitlite — search

#python #go #nodejs #javascript #php #ruby #r #shell #java #metrics #ios #logging

Paymob_Integration_DotNet

★ 23 Open GitHub ↗

Example ASP.NET Core 8 integration with Paymob: intention creation, Unified Checkout redirect, HMAC-secured callbacks, and payment state persistence.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Paymob Integration (.NET 8 Minimal API Example)

A minimal, framework-agnostic ASP.NET Core 8 example showing how to integrate with **Paymob**: create an intention, redirect the user to the Unified Checkout, verify the HMAC on both browser and server callbacks, and persist payment / enrollment state.

> The domain objects (Enrollment, Payment, Student, Course, etc.) are placeholders. Replace or extend them to fit any business domain (subscriptions, orders, bookings, donations, etc.).

## Key Features
- Intention creation with dynamic amount & integration ID selection (card / wallet)
- Unified Checkout redirect URL generation (`publicKey + clientSecret`)
- Secure HMAC SHA-512 verification for redirect & server-to-server callbacks
- Separation of concerns via `IPaymobService`
- Example success / failure HTML responses
- Extensible structure for adding more payment methods or post-payment workflows

## High-Level Flow
1. Authenticated client calls `POST /create-payment-token?courseID=123&paymentMethod=card` (or `wallet`).
2. Service creates Paymob Intention → returns `client_secret`.
3. Backend stores pending payment & returns a redirect URL to Unified Checkout.
4. User completes payment on Paymob.
5. Paymob triggers:
   - Browser redirect (`GET /callback?...hmac=...`)
   - Server callback (`POST /server-callback?hmac=...`) → authoritative status update.
6. System marks payment success / failure after HMAC validation.

```
Client -> /create-payment-token -> Paymob Intention API -> Unified Checkout
   ^                                                   |
   |---- redirect URL (publicKey + clientSecret) <-----|
   |                                                   v
Browser Redirect (GET /callback)            Server Callback (POST /server-callback)
            \__________________________________________/ 
                        HMAC validated -> update status
```

## Project Structure (Relevant Parts)
```
Controllers/PaymentController.cs   # Endpoints: token creation, redirect callback, server callback
Interfaces/IPaymobService.cs       # Abstraction
Repositores/PaymobService.cs       # Core Paymob API + persistence logic
Entities/Enrollment.cs, Payment.cs # Example domain entities (simplified)
Program.cs                         # Minimal API bootstrap + Swagger
```

## Configuration
Add the following to `appsettings.Development.json` (and production secrets securely):
```json
{
  "Paymob": {
    "APIKey": "<dashboard-api-key-if-used>",
    "SecretKey": "<secret-auth-token-for-intention-endpoint>",
    "PublicKey": "<public-key-for-unified-checkout>",
    "CardIntegrationId": "<int-id-for-card-integration>",
    "MobileIntegrationId": "<int-id-for-wallet-integration>",
    "HMAC": "<hmac-secret-from-paymob-dashboard>"
  }
}
```
> Some calls use the Secret (Token auth) while public key is only for building the checkout URL. Ensure you keep secrets outside source control (User Secrets, Key Vault, etc.).

## Endpoints
| Method | Route | Purpose |
|--------|-------|---------|
| POST | `/create-payment-token?courseID=10&paymentMethod=card` | Creates intention & returns redirect URL |
| GET | `/callback` | Browser redirect (displays success/failure based on HMAC) |
| POST | `/server-callback` | Server-to-server status confirmation (authoritative) |

### Sample Response (create-payment-token)
```json
{
  "redirectUrl": "https://accept.paymob.com/unifiedcheckout/?publicKey=...&clientSecret=..."
}
```
Redirect the user (SPA: `window.location = redirectUrl`).

## HMAC Verification
Both callback handlers concatenate specific ordered fields (per Paymob docs) then compute:
```
HMAC = Hex( HMAC_SHA512(secret, concatenatedString) )
```
Reject mismatched HMAC early to avoid tampering.

## Extending
- Add support for kiosk, pay-on-delivery, installment by mapping more integration IDs.
- Persist raw callback payloads (audit table) for reconciliation.
- Introduce retry logic & idempotency keys.
- Wrap HttpClient with `IHttpClientFactory` for resiliency (policies, timeout, logging).
- Emit domain events after success (email, license provisioning, etc.).

## Security & Hardening Checklist
- [ ] Move secrets to secure store (Azure Key Vault, AWS Secrets Manager, etc.)
- [ ] Enforce HTTPS & HSTS in production
- [ ] Validate `amount` server-side only (never trust client-submitted amounts)
- [ ] Log but do not leak sensitive values (card PAN, tokens)
- [ ] Add request signature / anti-replay for internal webhooks if possible
- [ ] Rate limit public endpoints

## Assumptions & Placeholders
| Placeholder | Replace With |
|-------------|--------------|
| `YourDbContent` | Your actual EF Core DbContext |
| `Enrollment.Student / Course` navigation | Implement the related entities |
| Authentication | Real auth (JWT, Cookies, Identity) returning `NameIdentifier` |
| HTML generators | Customize branding / UX |

## Local Run
1. Restore & build:
```powershell
dotnet restore; dotnet build
```
2. Run:
```powershell
dotnet run
```
3. Open Swagger UI: https://localhost:5001/swagger (or shown port).
4. Call `create-payment-token` with a valid auth context (mock or implement auth).

## Contributing
1. Fork & branch (`feature/<name>`)
2. Keep changes small & focused.
3. Submit PR with description & any config additions.

## License
Choose and add a license (e.g., MIT, Apache 2.0). A LICENSE file is recommended for public reuse.

## Disclaimer
This repository is an illustrative integration example. Review & harden before production (validation, logging, resilience, monitoring, compliance).

Paymob_Integration_DotNet

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README