PayU Poland
BLIK, cards, Klarna/PayPo/Twisto, Raty. Official documentation: https://developers.payu.com/europe/docs/. Gateway fee: per the PayU rate.
Credentials
POS id, OAuth client_id/client_secret, second key (MD5) from the panel. Sandbox secure.snd.payu.com, public test POS 300746.
- Environment variables
PAYU_POS_IDPAYU_CLIENT_IDPAYU_CLIENT_SECRETPAYU_SECOND_KEYPAYU_SANDBOX- Webhook
POST /webhooks/payu; headerOpenPayu-Signature: sender=…;signature=…;algorithm=MD5|SHA-256, signature = hash(body + second_key). A 200 response is mandatory (PayU retries for up to 72 h).
What Mistok calls
| Request | Fields / meaning |
|---|---|
POST /pl/standard/user/oauth/authorize | client_credentials → bearer (cached, refreshed on 401) |
POST /api/v2_1/orders | notifyUrl, continueUrl, customerIp, merchantPosId, description, currencyCode, totalAmount (groszy), extOrderId, products[], buyer{} → 302 + redirectUri, orderId |
GET /api/v2_1/orders/{id} | status |
POST /api/v2_1/orders/{id}/refunds · /captures · DELETE /orders/{id} | refund · capture · cancel |
Statuses
NEW → created · PENDING → processing · WAITING_FOR_CONFIRMATION → hold · COMPLETED → success · CANCELED/REJECTED → failure.
Mistok’s model: created → processing → (hold →) success | failure | expired | reversed. The Shopify order receives a payment only on success and only after the amount and currency are checked against our record.
Sandbox
Sandbox with public keys in the documentation; the hold status depends on the auto-receive setting on the POS.
Limitations
- PLN, EUR, USD, GBP, CZK, HUF (BLIK/bank transfers PLN/CZK/EUR only)
- merchant registration requires the representative’s PESEL — non-residents go through a manager
Not confirmed by a live run
Implemented from the official docs and SDKs; a first run on test keys is mandatory.
- the /captures response body
- buyer.phone with a “+”