Provider Integration
Download the Postman collection to quickly test all Provider API endpoints.
Download JSONFor payment service providers connecting banking infrastructure
Provider Integration enables you to connect a complete payment orchestration system to your existing services. This powerful API allows you to offer seamless payment panel access to anyone who wants to work with you — without requiring manual setup, support calls, or technical assistance.
Connect your banking infrastructure to a unified payment system that handles deposits, withdrawals, and credit card transactions.
Your clients can create and manage their own payment panels without needing support or direct communication with you.
RESTful API with clear documentation, Postman collections, and hash-based authentication for secure communication.
Receive instant notifications for all transaction status changes via secure webhook callbacks to your system.
Register
Get your API credentials
Integrate
Connect via our API
Create Sites
Add your client sites
Go Live
Start processing payments
Clients manage everything themselves through intuitive panels. No support tickets, no phone calls.
Add unlimited sites and process unlimited transactions. The system scales with your business.
SHA-256 hash verification, timestamp validation, and IP whitelisting for maximum security.
Base URL
https://acidpanel.net/api/provider
Who Is This For?
This API provides 6 independent payment methods. Each method operates separately and can be integrated individually based on your needs.
Method 1
Manual Bank Transactions
Method 2
E-İBAN Transactions
Method 3
Credit Card Transactions
Method 4
Third-Party Bank
Method 5
Third-Party Crypto
Method 6
Third-Party Wallet
You can integrate one, multiple, or all payment methods depending on your business requirements. Each method has its own endpoints and operates independently.
All Provider API requests require authentication using API Key, Secret Key, and a SHA-256 Hash.
| Header | Description |
|---|---|
X-Api-Key |
Your Provider API Key |
X-Hash |
SHA-256 hash (see below) |
X-Timestamp |
Unix timestamp (valid for 5 minutes) |
Content-Type |
application/json |
$apiKey = 'YOUR_API_KEY';
$secretKey = 'YOUR_SECRET_KEY';
$timestamp = time();
// For basic endpoints (e.g., /welcome)
$hash = hash('sha256', $apiKey . $secretKey . $timestamp);
// For endpoints requiring additional key (e.g., /sites)
$key = 'additional_key_value';
$hash = hash('sha256', $apiKey . $secretKey . $key . $timestamp);
Connection test endpoint. Use this to verify your API credentials are working correctly.
/api/provider/welcome
| Header | Value |
|---|---|
X-Api-Key |
Your API Key |
X-Hash |
sha256(api_key + secret_key + timestamp) |
X-Timestamp |
Unix timestamp |
{
"success": true,
"message": "Welcome, Provider Name!",
"info": "Your API credentials have been verified successfully. Hope everything is going well on your end, partner!",
"next_step": "You are now ready to proceed with the next steps.",
"provider": {
"id": 1,
"name": "Provider Name",
"is_active": true
},
"timestamp": "2025-12-03 12:00:00"
}
$apiKey = 'YOUR_API_KEY';
$secretKey = 'YOUR_SECRET_KEY';
$timestamp = time();
$hash = hash('sha256', $apiKey . $secretKey . $timestamp);
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => 'https://acidpanel.net/api/provider/welcome',
CURLOPT_POST => true,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => [
'Content-Type: application/json',
'X-Api-Key: ' . $apiKey,
'X-Hash: ' . $hash,
'X-Timestamp: ' . $timestamp
]
]);
$response = curl_exec($ch);
curl_close($ch);
$result = json_decode($response, true);
print_r($result);
Get all sites associated with your provider account.
/api/provider/sites
| Header | Value |
|---|---|
X-Api-Key |
Your API Key |
X-Hash |
sha256(api_key + secret_key + key + timestamp) |
X-Timestamp |
Unix timestamp |
X-Key |
Additional verification key |
sha256(api_key + secret_key + key + timestamp)
{
"success": true,
"provider": {
"id": 1,
"name": "Provider Name"
},
"total_sites": 2,
"sites": [
{
"id": 1,
"name": "Site 1",
"is_active": true,
"created_at": "2025-01-15 10:30:00"
},
{
"id": 2,
"name": "Site 2",
"is_active": true,
"created_at": "2025-02-20 14:15:00"
}
],
"timestamp": "2025-12-03 12:00:00"
}
$apiKey = 'YOUR_API_KEY';
$secretKey = 'YOUR_SECRET_KEY';
$key = 'your_verification_key';
$timestamp = time();
// Hash includes the key parameter
$hash = hash('sha256', $apiKey . $secretKey . $key . $timestamp);
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => 'https://acidpanel.net/api/provider/sites',
CURLOPT_POST => true,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => [
'Content-Type: application/json',
'X-Api-Key: ' . $apiKey,
'X-Hash: ' . $hash,
'X-Timestamp: ' . $timestamp,
'X-Key: ' . $key
]
]);
$response = curl_exec($ch);
curl_close($ch);
$result = json_decode($response, true);
print_r($result);
This is an independent payment method for manual IBAN-based deposits and withdrawals.
Create a new manual IBAN deposit request for a customer. This endpoint requires both Provider authentication and Site Credential Key.
/api/provider/start-manual-deposit
hash = SHA256(api_key + secret_key + credential_key + timestamp)
The credential_key is included in hash calculation for additional security.
| Header | Value |
|---|---|
X-Api-Key |
Your Provider API Key |
X-Hash |
SHA256(api_key + secret_key + credential_key + timestamp) |
X-Timestamp |
Unix timestamp (max 5 min old) |
X-Credential-Key |
Your Site Credential Key |
Content-Type |
application/json |
| Parameter | Type | Required | Description |
|---|---|---|---|
fullname |
string | Yes | Customer's full name |
username |
string | Yes | Customer's username |
user_id |
string | Yes | Customer's user ID in your system |
amount |
number | Yes | Deposit amount (minimum: 1) |
{
"fullname": "John Doe",
"username": "johndoe123",
"user_id": "12345",
"amount": 500
}
{
"success": true,
"message": "Manuel yatırım talebi başarıyla oluşturuldu",
"data": {
"tracking_code": "MAN-ABCD1234-1733275800",
"payment_url": "https://acidpanel.net/deposit/track/abc123...",
"site": {
"id": 12,
"name": "Hugobet.com"
},
"customer": {
"fullname": "John Doe",
"username": "johndoe123",
"user_id": "12345"
},
"amount": 500,
"status": "showing",
"expires_at": "2025-12-04 02:10:00",
"created_at": "2025-12-04 01:50:00"
},
"timestamp": "2025-12-04 01:50:00"
}
Note: payment_url is the address to redirect the customer. On this page, the customer can edit the amount and click "Continue" to view the IBAN details.
curl -X POST https://acidpanel.net/api/provider/start-manual-deposit \
-H "Content-Type: application/json" \
-H "X-Api-Key: YOUR_API_KEY" \
-H "X-Hash: SHA256_HASH" \
-H "X-Timestamp: UNIX_TIMESTAMP" \
-H "X-Credential-Key: YOUR_SITE_CREDENTIAL_KEY" \
-d '{
"fullname": "John Doe",
"username": "johndoe123",
"user_id": "12345",
"amount": 500
}'
Create a new manual withdrawal request for a customer. The withdrawal will be processed by the assigned dealer.
| Header | Description |
|---|---|
X-Api-Key |
Your Provider API Key |
X-Hash |
SHA256(api_key + secret_key + credential_key + timestamp) |
X-Timestamp |
Current Unix timestamp (seconds) |
X-Credential-Key |
Your Site Credential Key |
| Parameter | Type | Required | Description |
|---|---|---|---|
fullname |
string | Yes | Customer's full name |
username |
string | Yes | Customer's username |
user_id |
string | Yes | Customer's user ID in your system |
iban |
string | Yes | Recipient's IBAN (15-34 characters) |
amount |
number | Yes | Withdrawal amount (minimum: 1) |
{
"fullname": "John Doe",
"username": "johndoe123",
"user_id": "12345",
"iban": "TR330006100519786457841326",
"amount": 1000
}
{
"success": true,
"message": "Manuel çekim talebi başarıyla oluşturuldu",
"data": {
"tracking_code": "WIT-ABCD1234-1733275800",
"site": {
"id": 12,
"name": "Hugobet.com"
},
"customer": {
"fullname": "John Doe",
"username": "johndoe123",
"user_id": "12345"
},
"iban": "TR330006100519786457841326",
"amount": 1000,
"status": "pending",
"created_at": "2025-12-04 01:50:00"
},
"timestamp": "2025-12-04 01:50:00"
}
{
"success": false,
"error": "Yetkisiz Credential Key",
"message": "Bu credential key sizin provider hesabınıza ait değil"
}
{
"success": false,
"error": "Doğrulama hatası",
"messages": [
"Alıcı IBAN zorunludur",
"Çekim tutarı zorunludur"
]
}
curl -X POST "https://acidpanel.net/api/provider/start-manual-withdraw" \
-H "Content-Type: application/json" \
-H "Accept: application/json" \
-H "X-Api-Key: YOUR_API_KEY" \
-H "X-Hash: SHA256_HASH" \
-H "X-Timestamp: UNIX_TIMESTAMP" \
-H "X-Credential-Key: YOUR_SITE_CREDENTIAL_KEY" \
-d '{
"fullname": "John Doe",
"username": "johndoe123",
"user_id": "12345",
"iban": "TR330006100519786457841326",
"amount": 1000
}'
This is an independent payment method for E-İBAN based deposits and withdrawals (same logic as Manual Bank).
Create a deposit request using E-İBAN (same flow as Manual Bank).
/api/provider/start-eiban-deposit
| Header | Value |
|---|---|
| X-Api-Key | Your Provider API Key |
| X-Hash | SHA256(api_key + secret_key + credential_key + timestamp) |
| X-Timestamp | Unix timestamp |
| X-Credential-Key | Site Credential Key |
| Parameter | Type | Required | Description |
|---|---|---|---|
| user_id | string | Yes | Customer's user ID |
| username | string | Yes | Customer's username |
| fullname | string | Yes | Customer's full name |
| amount | number | Yes | Deposit amount (minimum: 1) |
{
"success": true,
"message": "E-İBAN deposit request created successfully",
"data": {
"tracking_code": "EIBAN-ABC12345-1733947200",
"payment_url": "https://acidpanel.net/deposit/eiban/track/xxx",
"site": {
"id": 12,
"name": "Example Site"
},
"customer": {
"fullname": "John Doe",
"username": "johndoe123",
"user_id": "12345"
},
"amount": 1000.00,
"status": "showing",
"expires_at": "2025-12-11 19:30:00"
}
}
Uses existing deposit_callback_url
Create a withdrawal request using E-İBAN (same flow as Manual Bank).
/api/provider/start-eiban-withdraw
| Header | Value |
|---|---|
| X-Api-Key | Your Provider API Key |
| X-Hash | SHA256(api_key + secret_key + credential_key + timestamp) |
| X-Timestamp | Unix timestamp |
| X-Credential-Key | Site Credential Key |
| Parameter | Type | Required | Description |
|---|---|---|---|
| user_id | string | Yes | Customer's user ID |
| username | string | Yes | Customer's username |
| fullname | string | Yes | Customer's full name |
| iban | string | Yes | Recipient IBAN (customer's bank account) |
| amount | number | Yes | Withdrawal amount (minimum: 1) |
{
"success": true,
"message": "E-İBAN withdrawal request created successfully",
"data": {
"tracking_code": "EIBAN-WIT-DEF98765-1733947200",
"site": {
"id": 12,
"name": "Example Site"
},
"customer": {
"fullname": "John Doe",
"username": "johndoe123",
"user_id": "12345"
},
"iban": "TR330006100519786457841326",
"amount": 1000.00,
"status": "pending"
}
}
Uses existing withdrawal_callback_url
This is an independent payment method for credit/debit card payments via payment gateways.
Start a credit card payment for a site user. Returns a payment URL to redirect the user.
/api/provider/credit-card/payment
| Header | Value |
|---|---|
| Content-Type | application/json |
| X-Api-Key | Provider API Key |
| X-Timestamp | Unix timestamp |
| X-Hash | SHA256(api_key + secret_key + timestamp) |
| Parameter | Type | Required | Description |
|---|---|---|---|
| credential_key | string | Yes | Site credential key |
| username | string | Yes | User's username |
| user_id | string | Yes | User's unique ID |
| firstname | string | Yes | User's first name |
| lastname | string | Yes | User's last name |
| string | Yes | User's email address | |
| phone | string | Yes | User's phone number |
| amount | number | Yes | Payment amount (min: 1) |
| description | string | No | Payment description |
{
"success": true,
"message": "Payment created successfully",
"data": {
"tracking_code": "CC-A1B2C3D4-1733356800",
"payment_url": "https://payment.gateway.com/pay/xyz123",
"order_id": "VL20251204A1B2C3D4",
"amount": 500.00,
"currency": "TRY"
}
}
{ "success": false, "message": "Invalid credential key" }
{ "success": false, "message": "Credit card payment is not enabled for this dealer" }
{ "success": false, "message": "This customer is blocked. Payment not allowed." }
curl -X POST https://acidpanel.net/api/provider/credit-card/payment \
-H "Content-Type: application/json" \
-H "X-Api-Key: your_api_key" \
-H "X-Timestamp: 1733356800" \
-H "X-Hash: your_calculated_hash" \
-d '{
"credential_key": "site_credential_key",
"username": "johndoe123",
"user_id": "12345",
"firstname": "John",
"lastname": "Doe",
"email": "[email protected]",
"phone": "5551234567",
"amount": 500,
"description": "Deposit"
}'
Payment Flow
payment_urlpayment_urlcredit_card_callback_urltracking_codeCheck the status of a credit card payment using tracking code.
/api/provider/credit-card/status
| Parameter | Type | Required | Description |
|---|---|---|---|
| tracking_code | string | Yes | Tracking code from payment creation |
{
"success": true,
"data": {
"tracking_code": "CC-A1B2C3D4-1733356800",
"order_id": "VL20251204A1B2C3D4",
"status": "success",
"amount": 500.00,
"currency": "TRY",
"username": "johndoe123",
"user_id": "12345",
"created_at": "2025-12-04T20:00:00+00:00",
"updated_at": "2025-12-04T20:05:00+00:00"
}
}
| Status | Description |
|---|---|
| pending | Payment is pending, waiting for user action |
| success | Payment completed successfully |
| failed | Payment failed |
| cancelled | Payment was cancelled |
| refunded | Payment was refunded |
curl -X POST https://acidpanel.net/api/provider/credit-card/status \
-H "Content-Type: application/json" \
-H "X-Api-Key: your_api_key" \
-H "X-Timestamp: 1733356800" \
-H "X-Hash: your_calculated_hash" \
-d '{
"tracking_code": "CC-A1B2C3D4-1733356800"
}'
This is an independent payment method for bank transfers via third-party payment gateways.
Create a deposit request via third-party bank transfer gateways.
This endpoint acts as a payment bridge to other payment systems. The customer will select a payment method (Crypto, Papara, Bank Transfer) and receive payment details from the third-party gateway to complete the transaction.
/api/provider/third-party/bank/start-deposit
| Header | Value |
|---|---|
| X-Api-Key | Your Provider API Key |
| X-Hash | SHA256(api_key + secret_key + credential_key + timestamp) |
| X-Timestamp | Unix timestamp |
| X-Credential-Key | Site Credential Key |
| Parameter | Type | Required | Description |
|---|---|---|---|
| user_id | string | Yes | Customer's user ID |
| username | string | Yes | Customer's username |
| fullname | string | Yes | Customer's full name |
| amount | number | Yes | Deposit amount (minimum: 1) |
{
"success": true,
"message": "Third-party Bank Transfer deposit transaction started successfully",
"data": {
"tracking_code": "TPBD-ABC12345-1733275800",
"payment_url": "https://acidpanel.net/deposit/third-party/bank/track/xxx",
"type": "third_party_bank_deposit",
"payment_method": "bank",
"site": {
"id": 12,
"name": "Hugobet.com"
},
"customer": {
"user_id": "12345",
"username": "johndoe123",
"fullname": "John Doe"
},
"amount": 500.00,
"status": "showing",
"expires_at": "2025-12-04 02:10:00",
"created_at": "2025-12-04 01:50:00"
},
"timestamp": "2025-12-04 01:50:00"
}
payment_urlWhen the payment is completed, failed, or expired, we will send a callback to your configured callback_url (same as manual deposits).
Retrieve list of available bank gateways for withdrawal operations.
This endpoint is only needed for withdrawal operations. For deposits, gateway selection is handled on the payment tracking page.
/api/provider/third-party/bank/gateways
| Header | Value |
|---|---|
| X-Api-Key | Your Provider API Key |
| X-Hash | SHA256(api_key + secret_key + timestamp) |
| X-Timestamp | Unix timestamp |
{
"success": true,
"message": "Available bank gateways retrieved successfully",
"data": {
"gateways": [
{
"id": 1,
"name": "Akbank Gateway",
"code": "AKBANK",
"min_amount": 100.0,
"max_amount": 50000.0,
"required_fields": ["iban", "account_holder"],
"description": "Fast and secure bank transfers via Akbank"
},
{
"id": 2,
"name": "Garanti BBVA Gateway",
"code": "GARANTI",
"min_amount": 100.0,
"max_amount": 100000.0,
"required_fields": ["iban", "account_holder"],
"description": "Garanti BBVA bank transfer gateway"
}
],
"count": 2
},
"timestamp": "2025-12-11 18:30:00"
}
gateway_id and iban when calling the withdrawal endpointCreate a withdrawal request via third-party bank transfer gateways.
/api/provider/third-party/bank/start-withdrawal
| Header | Value |
|---|---|
| X-Api-Key | Your Provider API Key |
| X-Hash | SHA256(api_key + secret_key + credential_key + timestamp) |
| X-Timestamp | Unix timestamp |
| X-Credential-Key | Site Credential Key |
| Parameter | Type | Required | Description |
|---|---|---|---|
| user_id | string | Yes | Customer's user ID |
| username | string | Yes | Customer's username |
| fullname | string | Yes | Customer's full name |
| amount | number | Yes | Withdrawal amount (minimum: 1) |
| gateway_id | integer | Yes | Bank gateway ID (from Get Bank Gateways endpoint) |
| iban | string | Yes | Recipient IBAN (customer's bank account) |
{
"user_id": "12345",
"username": "johndoe123",
"fullname": "John Doe",
"amount": 1000,
"gateway_id": 1,
"iban": "TR330006100519786457841326"
}
{
"success": true,
"message": "Third-party Bank Transfer withdrawal transaction started successfully",
"data": {
"tracking_code": "TPBW-DEF98765-1733275800",
"type": "third_party_bank_withdrawal",
"payment_method": "bank",
"site": {
"id": 12,
"name": "Hugobet.com"
},
"customer": {
"user_id": "12345",
"username": "johndoe123",
"fullname": "John Doe"
},
"amount": 1000.00,
"status": "showing",
"expires_at": "2025-12-04 02:10:00",
"created_at": "2025-12-04 01:50:00"
},
"timestamp": "2025-12-04 01:50:00"
}
payment_urlWhen the withdrawal is completed, rejected, or failed, we will send a callback to your configured withdrawal_callback_url (same as manual withdrawals).
This is an independent payment method for cryptocurrency transactions (BTC, USDT, ETH, etc.) via third-party gateways.
Create a crypto deposit request (BTC, USDT, ETH, etc.).
/api/provider/third-party/crypto/start-deposit
{
"success": true,
"message": "Third-party Crypto deposit transaction started successfully",
"data": {
"tracking_code": "TPCD-ABC12345-1733275800",
"payment_url": "https://acidpanel.net/deposit/third-party/crypto/track/xxx",
"type": "third_party_crypto_deposit",
"payment_method": "crypto",
"amount": 500.00,
"status": "showing",
"expires_at": "2025-12-04 02:10:00"
}
}
Uses existing callback_url
Retrieve list of available crypto gateways for withdrawal operations.
This endpoint is only needed for withdrawal operations. For deposits, gateway selection is handled on the payment tracking page.
/api/provider/third-party/crypto/gateways
| Header | Value |
|---|---|
| X-Api-Key | Your Provider API Key |
| X-Hash | SHA256(api_key + secret_key + timestamp) |
| X-Timestamp | Unix timestamp |
{
"success": true,
"message": "Available crypto gateways retrieved successfully",
"data": {
"gateways": [
{
"id": 1,
"name": "Binance Gateway",
"code": "BINANCE",
"min_amount": 50.0,
"max_amount": 100000.0,
"supported_crypto_types": [
"BTC",
"USDT (TRC20)",
"USDT (ERC20)",
"ETH"
],
"required_fields": ["crypto_type", "wallet_address"],
"description": "Fast crypto transfers via Binance"
}
],
"count": 1
},
"timestamp": "2025-12-11 18:30:00"
}
gateway_id, crypto_type, and wallet_address when calling withdrawal endpointCreate a crypto withdrawal request.
/api/provider/third-party/crypto/start-withdrawal
| Parameter | Type | Required | Description |
|---|---|---|---|
| user_id | string | Yes | Customer's user ID |
| username | string | Yes | Customer's username |
| fullname | string | Yes | Customer's full name |
| amount | number | Yes | Withdrawal amount |
| gateway_id | integer | Yes | Crypto gateway ID (from Get Crypto Gateways) |
| crypto_type | string | Yes | Crypto type with network (e.g., "USDT (TRC20)", "BTC", "ETH") |
| wallet_address | string | Yes | Customer's crypto wallet address |
{
"user_id": "12345",
"username": "johndoe123",
"fullname": "John Doe",
"amount": 1000,
"gateway_id": 2,
"crypto_type": "USDT (TRC20)",
"wallet_address": "TXxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}
{
"success": true,
"message": "Third-party Crypto withdrawal transaction started successfully",
"data": {
"tracking_code": "TPCW-DEF98765-1733275800",
"type": "third_party_crypto_withdrawal",
"payment_method": "crypto",
"amount": 1000.00,
"status": "showing"
}
}
Uses existing withdrawal_callback_url
This is an independent payment method for e-wallet transactions (Papara, PayFix, etc.) via third-party gateways.
Create a wallet deposit request (Papara, PayFix, etc.).
/api/provider/third-party/wallet/start-deposit
{
"success": true,
"message": "Third-party Wallet deposit transaction started successfully",
"data": {
"tracking_code": "TPWD-ABC12345-1733275800",
"payment_url": "https://acidpanel.net/deposit/third-party/wallet/track/xxx",
"type": "third_party_wallet_deposit",
"payment_method": "wallet",
"amount": 500.00,
"status": "showing"
}
}
Uses existing callback_url
Retrieve list of available wallet gateways (Papara, PayFix, etc.) for withdrawal operations.
This endpoint is only needed for withdrawal operations. For deposits, gateway selection is handled on the payment tracking page.
/api/provider/third-party/wallet/gateways
| Header | Value |
|---|---|
| X-Api-Key | Your Provider API Key |
| X-Hash | SHA256(api_key + secret_key + timestamp) |
| X-Timestamp | Unix timestamp |
{
"success": true,
"message": "Available wallet gateways retrieved successfully",
"data": {
"gateways": [
{
"id": 1,
"name": "Papara Gateway",
"code": "PAPARA",
"min_amount": 50.0,
"max_amount": 10000.0,
"required_fields": ["wallet_number", "account_holder"],
"description": "Fast and secure wallet transfers via Papara"
},
{
"id": 2,
"name": "PayFix Gateway",
"code": "PAYFIX",
"min_amount": 50.0,
"max_amount": 15000.0,
"required_fields": ["wallet_number"],
"description": "PayFix wallet transfer gateway"
}
],
"count": 2
},
"timestamp": "2025-12-11 18:30:00"
}
gateway_id and wallet_number when calling withdrawal endpointCreate a wallet withdrawal request.
/api/provider/third-party/wallet/start-withdrawal
| Parameter | Type | Required | Description |
|---|---|---|---|
| user_id | string | Yes | Customer's user ID |
| username | string | Yes | Customer's username |
| fullname | string | Yes | Customer's full name |
| amount | number | Yes | Withdrawal amount |
| gateway_id | integer | Yes | Wallet gateway ID (from Get Wallet Gateways) |
| wallet_number | string | Yes | Customer's wallet number (e.g., Papara number, PayFix number) |
{
"user_id": "12345",
"username": "johndoe123",
"fullname": "John Doe",
"amount": 1000,
"gateway_id": 3,
"wallet_number": "1234567890"
}
{
"success": true,
"message": "Third-party Wallet withdrawal transaction started successfully",
"data": {
"tracking_code": "TPWW-DEF98765-1733275800",
"type": "third_party_wallet_withdrawal",
"payment_method": "wallet",
"amount": 1000.00,
"status": "showing"
}
}
Uses existing withdrawal_callback_url
When a deposit is approved or rejected,
the system will send a POST request to your configured callback_url.
Make sure to verify the hash before processing.
| Header | Description |
|---|---|
X-Api-Key |
Your API Key for identification |
X-Timestamp |
Unix timestamp of the callback |
X-Hash |
SHA256 verification hash |
To verify the callback authenticity, calculate the hash as follows:
hash = SHA256(api_key + secret_key + tracking_code + status + timestamp)
Compare your calculated hash with the X-Hash header value.
| Field | Type | Description |
|---|---|---|
tracking_code |
string | Unique transaction tracking code |
status |
string | completed canceled expired |
amount |
number | Final approved/rejected amount |
username |
string | Customer's username |
fullname |
string | Customer's full name |
user_id |
string | Customer's user ID in your system |
site_id |
integer | Site ID in AcidPanel |
timestamp |
integer | Unix timestamp of the callback |
hash |
string | SHA256 verification hash (also in header) |
{
"tracking_code": "MAN-ABCD1234-1733275800",
"status": "completed",
"amount": 500.00,
"username": "johndoe123",
"fullname": "John Doe",
"user_id": "12345",
"site_id": 12,
"timestamp": 1733275900,
"hash": "a1b2c3d4e5f6..."
}
<?php
// Get callback data
$payload = json_decode(file_get_contents('php://input'), true);
$receivedHash = $_SERVER['HTTP_X_HASH'] ?? '';
$timestamp = $_SERVER['HTTP_X_TIMESTAMP'] ?? '';
// Your credentials
$apiKey = 'YOUR_API_KEY';
$secretKey = 'YOUR_SECRET_KEY';
// Calculate expected hash
$expectedHash = hash('sha256',
$apiKey .
$secretKey .
$payload['tracking_code'] .
$payload['status'] .
$timestamp
);
// Verify hash
if ($receivedHash !== $expectedHash) {
http_response_code(401);
die('Invalid hash');
}
// Process the callback
if ($payload['status'] === 'completed') {
// Credit user's balance
creditUserBalance($payload['user_id'], $payload['amount']);
}
// Return success
http_response_code(200);
echo json_encode(['success' => true]);
Return HTTP 200 OK to acknowledge the callback.
Any other status code will be logged as a failed delivery attempt.
When a withdrawal is completed, rejected,
failed, or canceled,
the system will send a POST request to your configured withdrawal_callback_url.
Make sure to verify the hash before processing.
| Header | Description |
|---|---|
X-Api-Key |
Your API Key for identification |
X-Timestamp |
Unix timestamp of the callback |
X-Hash |
SHA256 verification hash |
To verify the callback authenticity, calculate the hash as follows:
hash = SHA256(api_key + secret_key + tracking_code + status + timestamp)
Compare your calculated hash with the X-Hash header value.
| Field | Type | Description |
|---|---|---|
tracking_code |
string | Unique transaction tracking code |
status |
string | completed rejected failed canceled |
amount |
number | Withdrawal amount |
username |
string | Customer's username |
fullname |
string | Customer's full name |
user_id |
string | Customer's user ID in your system |
iban |
string | Recipient's IBAN |
site_id |
integer | Site ID in AcidPanel |
timestamp |
integer | Unix timestamp of the callback |
hash |
string | SHA256 verification hash (also in header) |
{
"tracking_code": "WIT-ABCD1234-1733275800",
"status": "completed",
"amount": 1000.00,
"username": "johndoe123",
"fullname": "John Doe",
"user_id": "12345",
"iban": "TR330006100519786457841326",
"site_id": 12,
"timestamp": 1733275900,
"hash": "a1b2c3d4e5f6..."
}
<?php
// Get callback data
$payload = json_decode(file_get_contents('php://input'), true);
$receivedHash = $_SERVER['HTTP_X_HASH'] ?? '';
$timestamp = $_SERVER['HTTP_X_TIMESTAMP'] ?? '';
// Your credentials
$apiKey = 'YOUR_API_KEY';
$secretKey = 'YOUR_SECRET_KEY';
// Calculate expected hash
$expectedHash = hash('sha256',
$apiKey .
$secretKey .
$payload['tracking_code'] .
$payload['status'] .
$timestamp
);
// Verify hash
if ($receivedHash !== $expectedHash) {
http_response_code(401);
die('Invalid hash');
}
// Process the callback
if ($payload['status'] === 'completed') {
// Deduct from user's balance or mark as paid
processWithdrawal($payload['user_id'], $payload['amount']);
} elseif ($payload['status'] === 'rejected' || $payload['status'] === 'failed') {
// Refund to user's balance
refundWithdrawal($payload['user_id'], $payload['amount']);
}
// Return success
http_response_code(200);
echo json_encode(['success' => true]);
Return HTTP 200 OK to acknowledge the callback.
Any other status code will be logged as a failed delivery attempt.
When a credit card payment is completed (success or failed), we send a callback to your credit_card_callback_url.
When Callbacks Are Sent
status: successstatus: failedstatus: cancelledstatus: failedSHA256(api_key + secret_key + tracking_code + status + timestamp)
| Header | Description |
|---|---|
X-Api-Key |
Your Provider API Key |
X-Timestamp |
Unix timestamp of the callback |
X-Hash |
SHA256 verification hash |
| Field | Type | Description |
|---|---|---|
tracking_code |
string | Unique transaction tracking code |
order_id |
string | Payment gateway order ID |
status |
string | success, failed, cancelled |
amount |
number | Payment amount |
currency |
string | Currency code (TRY) |
username |
string | Customer's username |
user_id |
string | Customer's user ID |
site_id |
integer | Site ID in AcidPanel |
customer_name |
string | Customer's full name |
customer_email |
string | Customer's email |
timestamp |
integer | Unix timestamp |
hash |
string | SHA256 verification hash |
error_code |
string | Error code (only if failed) |
error_message |
string | Error description (only if failed) |
{
"tracking_code": "CC-A1B2C3D4-1733356800",
"order_id": "VL20251204A1B2C3D4",
"status": "success",
"amount": 500.00,
"currency": "TRY",
"username": "johndoe123",
"user_id": "12345",
"site_id": 12,
"customer_name": "John Doe",
"customer_email": "[email protected]",
"timestamp": 1733356900,
"hash": "a1b2c3d4e5f6..."
}
{
"tracking_code": "CC-A1B2C3D4-1733356800",
"order_id": "VL20251204A1B2C3D4",
"status": "failed",
"amount": 500.00,
"currency": "TRY",
"username": "johndoe123",
"user_id": "12345",
"site_id": 12,
"customer_name": "John Doe",
"customer_email": "[email protected]",
"error_code": "INSUFFICIENT_FUNDS",
"error_message": "Card declined - insufficient funds",
"timestamp": 1733356900,
"hash": "a1b2c3d4e5f6..."
}
Return HTTP 200 OK to acknowledge the callback.
| Code | Error | Description |
|---|---|---|
| 401 | Missing required headers | X-Api-Key, X-Hash, or X-Timestamp is missing |
| 401 | Invalid API key | API key not found in database |
| 401 | Request timestamp expired | Timestamp older than 5 minutes |
| 401 | Invalid hash | Hash verification failed |
| 403 | Provider account is inactive | Provider has been deactivated |
| 403 | IP address not allowed | Request IP not in whitelist |
Contact our support team for API credentials, integration assistance, or troubleshooting.
Contact on Telegram© 2026 Acid Panel. All rights reserved.