sebpay / sebpay-php

v1.0.0 2026-09-25 00:51 UTC

Requires

• php: ^8.1
• ext-curl: *
• ext-json: *

MIT

Published on Packagist.org on 2026-10-19 02:53 UTC

README

Official PHP SDK for the Sebpay API — hosted checkout, mobile money collections/payouts, and webhook signature verification.

This SDK is a thin, dependency-free (besides ext-curl) wrapper over the public REST API documented in docs/SEBPAY_PUBLIC_API.md. It does not attempt to cover every endpoint (API key management, IP allowlists) — only what an integrator actually calls at runtime.

Install

Not yet published on Packagist. For now, require it as a local path repository:

{
  "repositories": [
    { "type": "path", "url": "../sebpay/sdks/php" }
  ],
  "require": {
    "sebpay/sebpay-php": "*"
  }
}

Usage

use Sebpay\SebpayClient;

$sebpay = new SebpayClient('pk_live_...', 'sk_live_...');

// Hosted checkout (redirect flow)
$session = $sebpay->checkoutSessions->create([
    'amount' => 5000,
    'currency' => 'XOF',
    'redirect_url' => 'https://yoursite.com/orders/8822/return',
    'external_reference' => 'ORDER-8822',
    'callback_url' => 'https://yoursite.com/webhook/sebpay',
]);

header('Location: ' . $session['checkout_url']);

// Direct collection (you supply operator/phone/OTP yourself)
$collection = $sebpay->collections->create([
    'amount' => 5000,
    'currency' => 'XOF',
    'phone' => '22997000000',
    'operator' => 'mtn',
    'country' => 'BJ',
    'external_reference' => 'ORDER-8823',
]);

// Payout
$payout = $sebpay->payouts->create([
    'recipient_name' => 'Jean Dupont',
    'phone' => '22997000000',
    'operator' => 'mtn',
    'country' => 'BJ',
    'amount' => 5000,
    'currency' => 'XOF',
    'external_reference' => 'PAYOUT-8822',
]);

// Reference data
$countries = $sebpay->references->countries();
$operators = $sebpay->references->operators('BJ');
$fee = $sebpay->references->calculateFee('10000', 'bj', 'sn');

Verifying a webhook

use Sebpay\Webhooks\WebhookVerifier;

$rawBody = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_SEBPAY_SIGNATURE'] ?? '';

if (!WebhookVerifier::verify($rawBody, $signature, 'sk_live_...')) {
    http_response_code(401);
    exit;
}

Always pass the raw request body — re-encoding a decoded payload can reorder keys and break the signature.

Errors

Every non-2xx response throws Sebpay\Exceptions\SebpayApiException, carrying httpStatus and the decoded errorBody:

use Sebpay\Exceptions\SebpayApiException;

try {
    $sebpay->collections->create([...]);
} catch (SebpayApiException $e) {
    // $e->getMessage(), $e->httpStatus, $e->errorBody
}

Multiwallet accounts

Business accounts can hold one balance per currency (one "wallet" per currency). The SDK sends nothing wallet-specific — the API decides:

• Collections and hosted checkout are credited on the wallet of the currency your customer actually pays in (the currency of the operator's country — a customer paying with a Cameroonian operator credits your XAF wallet), whatever currency you priced the amount in. If the account has no wallet in that currency, the main wallet is credited. Standard (single-balance) accounts are credited on the account balance, as before.
• Payouts are always debited from the main wallet (the account's main currency).

The operator field of a collection or payout accepts either an operator code (mtn) or slug (mtn-bj), as returned by $sebpay->references->operators().

Examples

See examples/ — set SEBPAY_PUBLIC_KEY/SEBPAY_SECRET_KEY (and SEBPAY_BASE_URL for local testing) then run with php examples/create-checkout.php.

Requirements

PHP 8.1+, ext-curl, ext-json.