Purchase Method

<?php
declare(strict_types=1);

function signPostData(array $postData, string $privateKey): string
{
    // Same signing logic as your sample:
    // base64_encode(implode('-', $postData)) then RSA-SHA256 sign then base64(signature).
    $concatenated = base64_encode(implode('-', $postData));

    $privateKeyObj = openssl_get_privatekey($privateKey);
    if ($privateKeyObj === false) {
        throw new RuntimeException('Invalid private key');
    }

    $signature = '';
    $success = openssl_sign($concatenated, $signature, $privateKeyObj, OPENSSL_ALGO_SHA256);
    openssl_free_key($privateKeyObj);

    if (!$success) {
        throw new RuntimeException('Failed to sign data');
    }

    return base64_encode($signature);
}

// Sandbox endpoint (per myPOS docs / test data)
const API_URL = 'https://www.mypos.com/vmp/checkout-test';

// Production endpoint 
// const API_URL = 'https://www.mypos.com/vmp/checkout';

// Test Private Key (Replace with your own private key from myPOS merchant account)
const PRIVATE_KEY = '-----BEGIN RSA PRIVATE KEY-----
MIICXAIBAAKBgQCf0TdcTuphb7X+Zwekt1XKEWZDczSGecfo6vQfqvraf5VPzcnJ
2Mc5J72HBm0u98EJHan+nle2WOZMVGItTa/2k1FRWwbt7iQ5dzDh5PEeZASg2UWe
hoR8L8MpNBqH6h7ZITwVTfRS4LsBvlEfT7Pzhm5YJKfM+CdzDM+L9WVEGwIDAQAB
AoGAYfKxwUtEbq8ulVrD3nnWhF+hk1k6KejdUq0dLYN29w8WjbCMKb9IaokmqWiQ
5iZGErYxh7G4BDP8AW/+M9HXM4oqm5SEkaxhbTlgks+E1s9dTpdFQvL76TvodqSy
l2E2BghVgLLgkdhRn9buaFzYta95JKfgyKGonNxsQA39PwECQQDKbG0Kp6KEkNgB
srCq3Cx2od5OfiPDG8g3RYZKx/O9dMy5CM160DwusVJpuywbpRhcWr3gkz0QgRMd
IRVwyxNbAkEAyh3sipmcgN7SD8xBG/MtBYPqWP1vxhSVYPfJzuPU3gS5MRJzQHBz
sVCLhTBY7hHSoqiqlqWYasi81JzBEwEuQQJBAKw9qGcZjyMH8JU5TDSGllr3jybx
FFMPj8TgJs346AB8ozqLL/ThvWPpxHttJbH8QAdNuyWdg6dIfVAa95h7Y+MCQEZg
jRDl1Bz7eWGO2c0Fq9OTz3IVLWpnmGwfW+HyaxizxFhV+FOj1GUVir9hylV7V0DU
QjIajyv/oeDWhFQ9wQECQCydhJ6NaNQOCZh+6QTrH3TC5MeBA1Yeipoe7+BhsLNr
cFG8s9sTxRnltcZl1dXaBSemvpNvBizn0Kzi8G3ZAgc=
-----END RSA PRIVATE KEY-----';

// IMPORTANT:
// - URL_Notify must be HTTPS and publicly reachable (not localhost), otherwise transaction can be cancelled.

// - Use a unique OrderID each time
$orderId = (string) time();

// Build POST params in the exact order you want them signed.
// (Signature must be added LAST.)
$postData = [
    'IPCmethod' => 'IPCPurchase',
    'IPCVersion' => '1.4',
    'IPCLanguage' => 'EN',
    
    // Replace with your own StoreID(can be found in your myPOS merchant account)
    'SID' => '000000000000010',

    // Replace with your own WalletNumber (Client Number from your myPOS merchant account)
    'WalletNumber' => '61938166610',

    'Amount' => '20.55',
 
    // Replace with the desired currency
    'Currency' => 'EUR',
    
    'OrderID' => $orderId,

    // Replace with your own URLs
    'URL_OK' => 'https://mypos.com/vmp/checkout-test/client/ipcOk',
    'URL_Cancel' => 'https://mypos.com/vmp/checkout-test/client/ipcCancel',
    'URL_Notify' => 'https://mypos.com/vmp/checkout-test/client/ipcNotify',

    // Set CardTokenRequest as per your needs (documentation above)
    'CardTokenRequest' => '0',

    // Replace with the KeyIndex provided to you by myPOS
    'KeyIndex' => '1',

    // Replace with PaymentParametersRequired value as per your needs (documentation above)
    'PaymentParametersRequired' => '1',

    // Set PaymentMethod as per your needs (documentation above)
    'PaymentMethod' => '1',

    'CustomerEmail' => 'name@website.com',
    'CustomerFirstNames' => 'John Santamaria',
    'CustomerFamilyName' => 'Smith',
    'CustomerPhone' => '+359888222333',
    'CustomerCountry' => 'DEU',
    'CustomerCity' => 'Hamburg',
    'CustomerZIPCode' => '20095',
    'CustomerAddress' => 'Kleine Bahnstr. 41',

    'Note' => 'Some note here',
    'Source' => 'Your Website Name',

    'CartItems' => 2,

    'Article_1' => 'HP ProBook 6360b sticker',
    'Quantity_1' => 2,
    'Price_1' => 10.00,
    'Currency_1' => 'EUR',
    'Amount_1' => 20.00,

    'Article_2' => 'Discount',
    'Quantity_2' => 1,
    'Price_2' => -3.45,
    'Currency_2' => 'EUR',
    'Amount_2' => -3.45,

    'delivery' => 4.00,
];

try {
    $postData['Signature'] = signPostData($postData, PRIVATE_KEY);
} catch (RuntimeException $e) {
    http_response_code(500);
    echo 'Signature error: ' . htmlspecialchars($e->getMessage(), ENT_QUOTES, 'UTF-8');
    exit;
}

// Render an auto-submitting form (the correct flow for IPCPurchase)
?>
<!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <title>Redirecting to myPOS Checkout…</title>
</head>
<body>
  <p>Redirecting to payment page…</p>

  <form id="myposForm" method="post" action="<?= htmlspecialchars(API_URL, ENT_QUOTES, 'UTF-8') ?>">
    <?php foreach ($postData as $k => $v): ?>
      <input type="hidden" name="<?= htmlspecialchars((string)$k, ENT_QUOTES, 'UTF-8') ?>"
             value="<?= htmlspecialchars((string)$v, ENT_QUOTES, 'UTF-8') ?>">
    <?php endforeach; ?>
    <noscript>
      <button type="submit">Continue</button>
    </noscript>
  </form>

  <script>
    document.getElementById('myposForm').submit();
  </script>
</body>
</html>