Fondy (Flitt) Ukraine
Cards, Apple/Google Pay, hold (preauth), hosted checkout; UAH/USD/EUR/PLN. Official documentation: https://docs.fondy.io/gateway/. Gateway fee: per the Fondy/Flitt rate (fee field in callback/status).
Credentials
merchant_id and the payment key from the dashboard: Merchant Settings → Technical.
- Environment variables
FONDY_MERCHANT_IDFONDY_SECRET_KEYFONDY_API_BASE (opt.)- Webhook
POST /webhooks/fondyJSON; signature = sha1(payment_key|values of all non-empty fields sorted by key). Reply200 OK; otherwise Fondy retries for up to 24 h.
What Mistok calls
| Request | Fields / meaning |
|---|---|
POST https://pay.fondy.eu/api/checkout/url | merchant_id, order_id, order_desc, amount (minor units), currency, response_url, server_callback_url, lifetime, preauth Y/N, signature → checkout_url |
POST /api/status/order_id | order_status, actual_amount, fee, reversal_amount (1018 = Order Not Found → created) |
POST /api/reverse/order_id | refund |
POST /api/capture/order_id | capture of the hold |
Statuses
approved → success (preauth without capture → hold) · created → created · processing → processing · declined → failure · expired → expired · reversed → reversed.
Mistok’s model: created → processing → (hold →) success | failure | expired | reversed. The Shopify order receives a payment only on success and only after the amount and currency are checked against our record.
Sandbox
Test merchant_id 1396424 / key “test”; card 4444 5555 6666 1111 — approve, 4444 1111 6666 5555 — decline.
Limitations
- order_id/order_desc up to 1024 chars
- Fondy callback IP 54.154.216.60
Not confirmed by a live run
Implemented from the official docs and SDKs; a first run on test keys is mandatory.
- nested objects excluded from the signature
- hold detection via the order_id suffix + capture_status