ibnnajjaar / mib-global-pay
Framework-agnostic MIB Global integration in PHP
Requires
- php: ^7.2|^8.0|^8.1|^8.2|^8.3
- ext-json: *
- guzzlehttp/guzzle: ~6.0|~7.0
Requires (Dev)
- friendsofphp/php-cs-fixer: ^3.4
- phpunit/phpunit: ^8.5.42
README
A Framework-agnostic PHP SDK for integrating with MIB Global Pay – enabling merchants to initiate payments and retrieve payment statuses using a clean, developer-friendly interface.
This SDK targets the Hosted Checkout integration of the Mastercard Payment Gateway (MPGS).
What is Hosted Checkout? Hosted Checkout is a gateway-managed, PCI-compliant checkout page that you redirect shoppers to for entering payment details. The gateway collects and processes sensitive card data on its own secure pages, then redirects the shopper back to your site with the payment result. This reduces your PCI scope and simplifies compliance while keeping your app focused on order creation and result handling.
Further reading: See the official MPGS Hosted Checkout documentation: https://test-mib.mtf.gateway.mastercard.com/api/documentation/integrationGuidelines/hostedCheckout/integrationModelHostedCheckout.html?locale=en_US
Table of Contents
- Requirements
- Installation
- Setup & Configuration
- Implementation Guide
- Error Handling
- API Response Structures
- Security Considerations
- Testing
- Contributing
- Contributors
- License
Requirements
- PHP 7.2 or higher
- Composer
Installation
Install the package using Composer:
composer require ibnnajjaar/mib-global-pay
Setup & Configuration
Environment Setup
Before using the SDK, obtain your Merchant ID and API Key from the MIB Merchant Portal.
Environment (Sandbox or Production):
$merchant_portal_url = 'sandbox.gateway.mastercard.com'; $merchant_id = 'YOUR_SANDBOX_MERCHANT_ID'; $api_password = 'your-sandbox-api-password';
Client Initialization
Initialize the client:
use IbnNajjaar\MIBGlobalPay\MIBGlobalPayConnector; $connector = new MIBGlobalPayConnector($merchant_portal_url, $merchant_id, $api_password);
Environment Variables (Recommended)
Store credentials securely using environment variables:
// .env file MIB_MERCHANT_URL=sandbox.gateway.mastercard.com MIB_MERCHANT_ID=your_merchant_id MIB_API_PASSWORD=your_api_password // In your code $connector = new MIBGlobalPayConnector( $_ENV['MIB_MERCHANT_URL'], $_ENV['MIB_MERCHANT_ID'], $_ENV['MIB_API_PASSWORD'] );
Note: NEVER commit your env file to the repository.
Implementation Guide
Create Payment
To initiate a payment, first prepare the order data:
// Minimum required data $order_id = 'order123'; $amount = 100.00; $payment_details = OrderData::make($order_id, $amount); // You can chain methods to set other information. All available methods are as follows: $payment_details->setOrderCurrency('MVR') ->setOrderDescription('Test Order') ->setMerchantAddressLine1('Sample, Majeedhee Magu') ->setMerchantEmail('merchant@example.mv') ->setMerchantLogo('https://example.mv/logo.svg') ->setMerchantName('Merchant Name') ->setMerchantPhone('1234567890') ->setMerchantUrl('https://example.mv') // Return URL is important though not required // This is the URL the gateway will redirect the user to after payment ->setReturnUrl('https://example.mv/order123/process') // NOTE: Although not documented, the redirect page throws errors if the cancel URL is missing. // It’s recommended to set a cancel URL (usually same as the return URL) to avoid this issue. ->setCancelUrl('https://example.mv/order123/process') ->setRedirectMerchantUrl('https://example.mv/order123/process') ->setWebHookUrl('https://example.mv/webhook') ->setRetryAttemptCount(3);
Send the request with the data:
use IbnNajjaar\MIBGlobalPay\Requests\DataObjects\OrderData; try { $response = $connector->createTransaction($payment_details); $response_data = $response->toDto(); $session_id = $response_data->getSessionId(); $success_indicator = $response_data->getSuccessIndicator(); // Store success indicator for later verification // You may store it in your transaction or order record. // This will be used later to verify payment } catch (Exception $e) { // Handle error appropriately echo $e->getMessage(); }
For further information, see the API documentation: Initiate Checkout.
Important: Save the successIndicator
in your database for later verification after redirection.
Redirect to MIB Checkout
Once you have the session ID, redirect the user to the page below. You will need to update the sandbox.gateway.mastercard.com
to the appropriate URL and also send the session ID to the view. This view will automatically redirect the user to the MIB Global Pay payment page.
<!doctype html> <html> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Payment Checkout</title> <script src="https://sandbox.gateway.mastercard.com/static/checkout/checkout.min.js" data-error="errorCallback" data-cancel="cancelCallback"></script> </head> <body> <div id="loading">Processing payment...</div> <script> Checkout.configure({ session: { id: '<?php echo htmlspecialchars($session_id); ?>' } }); // Redirect user to the payment page Checkout.showPaymentPage(); </script> </body> </html>
For further information, see the Documentation: Implementing the Hosted Payment Page.
Handle Payment Completion
After the payment process, MIB will redirect the user to the return_url
you provided earlier. On that page, verify the payment result:
// Get the result indicator from the redirect $return_data = HostedCheckoutReturnData::fromArray($_GET); $result_indicator = $return_data->getResultIndicator(); // Retrieve the stored success indicator // Verify payment result if ($result_indicator && $result_indicator == $success_indicator) { // Payment was successful // Normally you should make a GET request to get order details // to confirm the payment before marking the order as paid echo "Payment was successful!"; } else { // Payment failed or was cancelled echo "Payment was not successful."; }
For further information, see the Documentation: Interpreting the Response.
Retrieve Payment Status
To double-check the status of a payment via API:
$order_reference = 'order_12345'; // Use the order ID you saved earlier try { $response = $connector->getOrderDetails($order_reference); $response_data = $response->toDto(); // Available methods on dto $response_data->getOrderStatus(); $response_data->getTotalCapturedAmount(); $response_data->getTransactions(); $response_data->getRawResponse(); $response_data->paymentSuccessfullyCaptured(); // To mark the order as paid if ($response_data->paymentSuccessfullyCaptured()) { // Mark order as paid } } catch (Exception $e) { error_log('Failed to retrieve payment status: ' . $e->getMessage()); echo "Could not retrieve payment status."; }
For further information, see the API documentation: Retrieve Order. Best Practice: Always verify payment status with the get order API for critical orders.
Handling Webhook Data
A webhook notifies you of successful transactions at predefined intervals, which is very useful for marking orders as paid. Sometimes, users may close their browser or interrupt the session before the payment gateway returns the transaction information. In such cases, your order might remain marked as unpaid in your database, even though the payment was completed in the merchant portal.
The webhook sends the successful transaction data to a predefined URL. You can use this data to update and mark the order as paid. Additionally, you can set a secret token in the merchant portal that will be included in the webhook request headers. This token can be used to verify the authenticity of the data.
Since webhook notifications are sent as POST requests, your application must be able to accept POST requests at the specified endpoint.
You can convert the webhook data into a response data object as shown below:
$webhook_data = WebhookResponseData::fromArray($_POST, getallheaders()); // Available methods: returns all strings or null $webhook_data->getOrderReference(); $webhook_data->getOrderAmount(); // returns float|null $webhook_data->getOrderCurrency(); $webhook_data->getOrderStatus(); $webhook_data->getNotificationSecret(); $webhook_data->getResult(); $webhook_data->getGatewayCode(); $webhook_data->getRawResponse(); $webhook_data->paymentIsSuccessful(); // returns a boolean
For further information, see the Documentation: Webhook Notifications.
Error Handling
The SDK may encounter various errors during API calls. Always implement proper error handling:
try { $response = $client->transactions->create($payment_details->toArray()); $response_data = json_decode($response->getBody()->getContents(), true); } catch (Exception $e) { // Log the error error_log('MIB Payment Error: ' . $e->getMessage()); }
API Response Structures
Create Payment Response
This is a typical response you will receive when you send a create transaction request:
[ 'checkoutMode' => 'WEBSITE', 'merchant' => 'YOURMERCHANTID', 'result' => 'SUCCESS', 'session' => [ 'id' => 'SESSION_abc123', // session id 'updateStatus' => 'SUCCESS', 'version' => 'fasdf3452' ], 'successIndicator' => 'abc123def456' ]
Payment Status Response
This is a typical response you will receive to your return URL:
[ 'order' => 'ORD-9010047', 'resultIndicator' => '50addc325519453c', 'sessionVersion' => '1fasdf23f', 'checkoutVersion' => '1.0.0', ]
Note: The order ID is present because it was included in the return URL. If you did not include the order ID in the return URL, the order key will not be present.
Response Methods
All responses have the following methods available:
- getStatusCode(): returns int
- getHeaders(): returns an array
- getBody(): returns json string
- toArray(): returns an array
- toDto(): returns a data transfer object defined in the request
- isSuccessful(): returns a boolean
- isFailed(): returns a boolean
- throw(): throws an exception on failed response
Security Considerations
Credential Management
- Store API credentials in environment variables
- Never commit credentials to version control
- Use different credentials for sandbox and production
HTTPS Requirements
- Always use HTTPS for return URLs
- Ensure your checkout page is served over HTTPS
- Verify SSL certificates in production
Test Card Numbers
Use test card numbers provided by the bank. Test cards will be listed in the documentation. Test Cards
Testing
composer test
Run tests in Docker
If you prefer to run the test suite in Docker (no local PHP or Composer required):
# Build the image docker compose build # Install dependencies inside the container (if vendor is not present or is outdated) docker compose run --rm php composer install # Run PHPUnit # Option A: Use the dedicated 'test' service docker compose run --rm test # Option B: Run via the php service (overriding the command) docker compose run --rm php vendor/bin/phpunit -c phpunit.xml --colors=always
Changelog
See CHANGELOG.md for release notes: CHANGELOG.md
Contributing
- Fork the repository
- Create a feature branch
- Add tests for new functionality
- Ensure all tests pass
- Submit a pull request
Contributors
License
MIT License.
For additional support, please raise an issue.