Documentation

composer require hasinhayder/sslcommerz-laravel
php artisan sslcommerz-laravel:install

# Sandbox mode (default: true)
SSLC_SANDBOX=true

# Store credentials (required)
SSLC_STORE_ID=your_store_id
SSLC_STORE_PASSWORD=your_store_password

# Currency (default: BDT)
SSLC_STORE_CURRENCY=BDT

# Callback route names (optional, set to match your routes)
SSLC_ROUTE_SUCCESS=sslc.success
SSLC_ROUTE_FAILURE=sslc.failure
SSLC_ROUTE_CANCEL=sslc.cancel
SSLC_ROUTE_IPN=sslc.ipn

use App\Http\Controllers\SSLCommerzController;
use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken;

// Entry point: user clicks "Pay" on your checkout page
Route::get('sslcommerz/initiate/{order}', [SSLCommerzController::class, 'initiate'])
    ->name('sslc.initiate');

// Callbacks: SSLCommerz posts back to these after payment
Route::controller(SSLCommerzController::class)
    ->prefix('sslcommerz')
    ->name('sslc.')
    ->withoutMiddleware([VerifyCsrfToken::class])
    ->group(function () {
        Route::post('success', 'success')->name('success');
        Route::post('failure', 'failure')->name('failure');
        Route::post('cancel',  'cancel')->name('cancel');
        Route::post('ipn',     'ipn')->name('ipn');
    });

use HasinHayder\Sslcommerz\Facades\Sslcommerz;
use Illuminate\Support\Facades\Log;
use Illuminate\Support\Str;

public function initiate(Request $request, Order $order)
{
    $user = auth()->user();
    $invoiceId = 'INV-' . strtoupper(Str::random(10)) . '-' . $order->id;
    $amount    = $order->total;

    // Store context for the success callback
    session([
        'sslc_order_id'  => $order->id,
        'sslc_user_id'  => $user->id,
        'sslc_invoice'  => $invoiceId,
    ]);

    try {
        $response = Sslcommerz::setOrder($amount, $invoiceId, $order->product_name)
            ->setCustomer($user->name, $user->email)
            ->setShippingInfo(1, 'Dhaka, Bangladesh')
            ->makePayment();

        if ($response->success()) {
            return redirect($response->gatewayPageURL());
        }

        Log::error('SSLCommerz initiation failed', [
            'status'   => $response->status(),
            'order_id' => $order->id,
        ]);
        return back()->withErrors(['Payment initiation failed. Please try again.']);

    } catch (\Exception $e) {
        Log::error('SSLCommerz exception', ['error' => $e->getMessage()]);
        return back()->withErrors(['Connection error. Please try again.']);
    }
}

public function success(Request $request)
{
    // 1. Verify hash — prevents tampered data
    if (! Sslcommerz::verifyHash($request->all())) {
        Log::warning('Hash verification failed', $request->all());
        return redirect()->route('home')
            ->withErrors(['Payment verification failed.']);
    }

    $transactionId = $request->input('tran_id');
    $amount = $request->input('amount');

    // 2. Validate payment with SSLCommerz
    if (! Sslcommerz::validatePayment($request->all(), $transactionId, $amount)) {
        Log::warning('Payment validation failed', ['tran_id' => $transactionId]);
        return redirect()->route('home')
            ->withErrors(['Payment could not be validated.']);
    }

    // 3. Retrieve order from session
    $orderId = session('sslc_order_id');
    $userId  = session('sslc_user_id');

    if (! $orderId || ! $userId) {
        return redirect()->route('home')
            ->withErrors(['Session expired. Contact support with ID: ' . $transactionId]);
    }

    $order = Order::find($orderId);

    // 4. Prevent duplicate processing
    if (! $order->isPaid()) {
        $order->update([
            'status'           => 'paid',
            'transaction_id'   => $transactionId,
            'payment_gateway'  => 'sslcommerz',
            'paid_at'          => now(),
        ]);
    }

    // 5. Clean up session
    session()->forget(['sslc_order_id', 'sslc_user_id', 'sslc_invoice']);

    return redirect()->route('orders.show', $order)
        ->with('success', 'Payment successful!');
}

public function failure(Request $request)
{
    Log::warning('SSLCommerz payment failed', $request->all());
    session()->forget(['sslc_order_id', 'sslc_user_id', 'sslc_invoice']);
    return redirect()->route('home')
        ->withErrors(['Payment could not be processed.']);
}

public function cancel(Request $request)
{
    Log::info('SSLCommerz payment cancelled', $request->all());
    session()->forget(['sslc_order_id', 'sslc_user_id', 'sslc_invoice']);
    return redirect()->route('home')
        ->with('info', 'Payment was cancelled.');
}

/**
 * IPN — server-to-server notification from SSLCommerz.
 * Do NOT redirect. Always return JSON.
 */
public function ipn(Request $request)
{
    if (! Sslcommerz::verifyHash($request->all())) {
        return response()->json(['error' => 'Hash verification failed'], 400);
    }

    $transactionId = $request->input('tran_id');
    $status = $request->input('status');

    if ($status === 'VALID' || $status === 'VALIDATED') {
        $order = Order::where('transaction_id', $transactionId)->first();
        if ($order && ! $order->isPaid()) {
            $order->update(['status' => 'paid', 'paid_at' => now()]);
        }
    }

    return response()->json(['received' => true], 200);
}

$refund = Sslcommerz::refundPayment(
    $order->bank_tran_id,
    $order->total,
    'Customer requested refund'
);

if ($refund->success()) {
    $order->update(['refund_ref_id' => $refund->refundRefId()]);
} elseif ($refund->processing()) {
    // Refund is being processed by the bank
} elseif ($refund->failed()) {
    Log::error($refund->failedReason());
}

$status = Sslcommerz::checkRefundStatus($order->refund_ref_id);

if ($status->refunded()) {
    $order->update(['status' => 'refunded', 'refunded_at' => $status->refundedAt()]);
} elseif ($status->cancelled()) {
    $order->update(['status' => 'refund_failed']);
} elseif ($status->processing()) {
    // Still being processed by the bank
}

$response = Sslcommerz::setOrder($amount, $invoiceId, 'Premium Plan')
    ->setCustomer($user->name, $user->email)
    ->makePayment();

if ($response->success()) {
    return redirect($response->gatewayPageURL());
}

// Handle failure
Log::error($response->failedReason());

$response = Sslcommerz::setOrder($amount, $invoiceId, 'Wireless Headphones', 'Electronics')
    ->setCustomer(
        $user->name,
        $user->email,
        '01700000000',
        '123 Mirpur Road', 'Dhaka', 'Dhaka', '1216'
    )
    ->setShippingInfo(2, '456 Gulshan Ave', $user->name, 'Dhaka')
    ->setGateways(['visa', 'mastercard', 'bkash'])
    ->setProductProfile('physical-goods')
    ->makePayment([
        'value_a' => $order->id,      // passes through to SSLCommerz
        'value_b' => 'customer_ref_' . $user->id,
    ]);