Documentation · Gateways · UA

RozetkaPay Ukraine

Cards, Apple Pay, Google Pay, hold (two-step), hosted checkout page. Official documentation: https://docs.rozetkapay.com/. Gateway fee: per RozetkaPay tariff.

Credentials

Merchant login and password (HTTP Basic). The password is also the callback signing key. Sandbox: https://api-epdev.rozetkapay.com (ROZETKAPAY_SANDBOX=1).

Environment variables: ROZETKAPAY_LOGIN ROZETKAPAY_PASSWORD ROZETKAPAY_SANDBOX=0|1 (opt.) ROZETKAPAY_API_BASE (opt.)
Webhook: POST /webhooks/rozetkapay, JSON; header X-ROZETKAPAY-SIGNATURE = base64url(sha1(password + base64url(body) + password)). Reply 200 OK; the status is re-read from /info.

What Mistok calls

Request	Fields / meaning
`POST /api/payments/v1/new`	external_id, amount, currency=UAH, mode=hosted, confirm (false = hold), callback_url, result_url, customer{email, phone, locale}, checkout_ttl → {id, action.value = payment page}
`GET /api/payments/v1/info?external_id`	aggregate state (purchase / confirmation / cancellation / refund details); 404 data_not_found = nobody has paid yet
`POST /api/payments/v1/refund`	refund (full/partial)
`POST /api/payments/v1/confirm`	capture of a hold
`POST /api/payments/v1/cancel`	release a hold / void

Statuses

init, pending → processing · success → success (hold until confirm for two-step) · failure → failure · failure + session_expired → expired · cancel / full refund → reversed.

Mistok’s model: created → processing → (hold →) success | failure | expired | reversed. The Shopify order receives a payment only on success and only after the amount and currency are checked against our record.

Sandbox

Test cards: 4242 4242 4242 4242 (3DS, success), 4111 1111 1111 1111 (success), 4200 0000 0000 0000 (rejected), 4000 0000 0000 0044 (insufficient funds).

Limitations

UAH only
external_id unique per attempt
the API does not report the commission

Not confirmed by a live run

Implemented from the official docs and SDKs; a first run on test keys is mandatory.

the operation field in callbacks (payment|confirm|cancel|refund)
checkout_ttl field name (minutes)
public sandbox credentials may return 401 — request your own; docs.rozetkapay.com is unreachable from our network, shapes taken from the official php-sdk

← all gateways · Mistok HTTP API