Accept payments with the Basalt Dynamics API

<?php
$parameters = [
    'identifier' => 'YOUR_IDENTIFIER',
    'currency' => 'USD',
    'amount' => 11.00,
    'gateway_methods' => [],
    'details' => 'Purchase T-shirt',
    'ipn_url' => 'https://example.com/ipn',
    'cancel_url' => 'https://example.com/cancel',
    'success_url' => 'https://example.com/success',
    'public_key' => 'YOUR_PUBLIC_KEY',
    'site_name' => 'Your site name',
    'site_logo' => 'https://example.com/logo.png',
    'checkout_theme' => 'light',
    'customer' => ['first_name' => 'John', 'last_name' => 'Doe', 'email' => 'john@example.com', 'mobile' => '12345789'],
    'shipping_info' => [],
    'billing_info' => [],
];
$url = 'https://payments.basaltdynamics.com/test/payment/initiate';
$secret = 'YOUR_TEST_SECRET_KEY';
$body = json_encode($parameters, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE | JSON_THROW_ON_ERROR);
$timestamp = (string) time();
$nonce = bin2hex(random_bytes(16));
$signature = hash_hmac('sha256', $timestamp."\n".$nonce."\n".$body, $secret);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $body);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Content-Type: application/json',
    'Idempotency-Key: '.bin2hex(random_bytes(16)),
    'X-Basalt-Timestamp: '.$timestamp,
    'X-Basalt-Nonce: '.$nonce,
    'X-Basalt-Signature: v1='.$signature,
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 5);
curl_setopt($ch, CURLOPT_TIMEOUT, 15);
$result = curl_exec($ch);
curl_close($ch);

<?php
$rawBody = file_get_contents('php://input');
$timestamp = $_SERVER['HTTP_X_BASALT_TIMESTAMP'] ?? '';
$eventId = $_SERVER['HTTP_X_BASALT_EVENT'] ?? '';
$provided = preg_replace('/^v1=/', '', $_SERVER['HTTP_X_BASALT_SIGNATURE'] ?? '');
$secret = 'YOUR_ENVIRONMENT_SECRET_KEY';

if (!ctype_digit($timestamp) || abs(time() - (int) $timestamp) > 300) {
    http_response_code(401); exit;
}
$expected = hash_hmac('sha256', $timestamp.'.'.$rawBody, $secret);
if (!preg_match('/^[a-f0-9]{64}$/', $provided) || !hash_equals($expected, $provided)) {
    http_response_code(401); exit;
}
$event = json_decode($rawBody, true, 32, JSON_THROW_ON_ERROR);
// In one DB transaction: insert $eventId into a UNIQUE column, verify the
// environment/identifier/amount/currency, then fulfill the order exactly once.
http_response_code(204);