Tranzzo Ukraine
Aggregator: cards, Apple/Google Pay, hold, hosted payment page. Official documentation: https://docs.tranzzo.com. Gateway fee: per your Tranzzo agreement.
Credentials
A test project with keys is available right after signing up in the Tranzzo portal: POS_ID, API_KEY, API_SECRET (live keys once the live project is approved).
- Environment variables
TRANZZO_POS_IDTRANZZO_API_KEYTRANZZO_API_SECRETTRANZZO_ENDPOINTS_KEY (opt.)TRANZZO_WEBHOOK_SECRET (opt.)TRANZZO_API_BASE (opt.)- Webhook
POST /webhooks/tranzzo, form-urlencodeddata(base64url JSON) +signature= base64url(sha1(API_SECRET + data + API_SECRET)). API requests are signed withX-API-AUTH: CPAY-HMAC-SHA256 API_KEY:hex(hmac_sha256(API_SECRET, body)).
What Mistok calls
| Request | Fields / meaning |
|---|---|
POST /api/v1/payment | pos_id, mode=hosted, method=purchase|auth, amount, currency, description, order_id (≤ 32), order_timeout, server_url, result_url → HTTP 303 Location = payment page |
GET /api/v1/pos/{POS_ID}/orders/{order_id} | all transactions of the order (purchase/auth + capture/void/refund) — folded into one status, re-read after every webhook |
POST /api/v1/refund | refund (full/partial) |
POST /api/v1/capture | capture of a hold on orders/fulfilled |
POST /api/v1/pos/{POS_ID}/order/{order_id}/cancel | void an unpaid payment |
Statuses
init → created · pending → processing · success (purchase/capture) → success · success (auth) → hold · success (refund/void) → reversed · failure → failure, codes 6006/6007/4149 → expired.
Mistok’s model: created → processing → (hold →) success | failure | expired | reversed. The Shopify order receives a payment only on success and only after the amount and currency are checked against our record.
Sandbox
No separate sandbox host — the test project runs on cpay.tranzzo.com. Test cards: 4111 1111 1111 1111 (success), 4242 4242 4242 4242 (3DS), 4000 0000 0000 0044 (insufficient funds).
Limitations
- order_id ≤ 32 characters
- holds are auto-voided per project rule
- recommended request timeout ≥ 30 s
Not confirmed by a live run
Implemented from the official docs and SDKs; a first run on test keys is mandatory.
- signature of GET requests (empty body signed)
- webhook secret: API_SECRET or a separate SECRET_KEY — TRANZZO_WEBHOOK_SECRET override exists
- shape of the fee field