Authentication

Every /gateway/ charge uses HTTP Basic auth and a JSON body. POST /gateway/verify.php does not — send JSON only (sid or order_id).

POST /gateway/
Authorization: Basic base64(username:api_key)
Content-Type: application/json

Create credentials under Create API keys.

Testing on staging? Use the .net hosts from Sandbox. Example below uses live hosts.

curl -X POST "https://api.sifalopay.com/gateway/" \
  -u "$SIFALO_API_USER:$SIFALO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

-u user:key is the same as the Authorization header.

Wrong username or key → code 0. Missing fields → code "404".

Only your server sends Basic auth. The customer does not authenticate on hosted checkout.

Mark paid only if verify status is success and code is 601.