NovaPay Ukraine
Cards, Apple/Google Pay, NovaPay app. Official documentation: https://novapay.readme.io/reference. Gateway fee: 1.8% (NovaPay rate).
Credentials
Application on novapay.ua → manager → NovaPay Business account: merchant_id; RSA keys are generated in the Acquiring3 admin. NovaPay’s public key for verifying postbacks is in the Authentication section.
- Environment variables
NOVAPAY_MERCHANT_IDNOVAPAY_PRIVATE_KEY (PEM)NOVAPAY_PUBLIC_KEY (NovaPay PEM)NOVAPAY_API_BASE- Webhook
POST /webhooks/novapay; headerx-sign-v2= base64(RSA-SHA256(body)) with NovaPay’s key. Mistok’s requests are signed withx-signusing the merchant’s key.
What Mistok calls
| Request | Fields / meaning |
|---|---|
POST /v1/session | merchant_id, client_phone, client_email, callback_url, success_url, fail_url, metadata → session id |
POST /v1/payment | session_id, amount (UAH), external_id, use_hold, products[] → hosted page url |
POST /v1/get-status | session status |
POST /v1/void · /v1/complete-hold · /v1/expire | refund of the whole session · capture of the hold · voiding |
Statuses
created → created · processing/holded → processing/hold · paid → success · voided → reversed · failed/blocked → failure · expired → expired.
Mistok’s model: created → processing → (hold →) success | failure | expired | reversed. The Shopify order receives a payment only on success and only after the amount and currency are checked against our record.
Sandbox
https://api-qecom.novapay.ua, test merchant 2 with published keys, test cards on the Test data page.
Limitations
- UAH only
- refunds — full only (void of the whole session)
- NovaPay “Оплата частинами” (installments) has no merchant API: the installment plan is issued to the buyer inside the NovaPay app; the store does not integrate it
Not confirmed by a live run
Implemented from the official docs and SDKs; a first run on test keys is mandatory.
- semantics of hold_confirmed / to_be_paid
- field length limits