Hosted checkout

The customer pays on Sifalo’s page. They choose Waafi, eDahab, Premier Wallet, or card. You never take those details yourself.

Testing on staging? Use the .net hosts from Sandbox. Examples below use live hosts.

Already have their wallet number? Use the e-Wallet API instead.

sequenceDiagram
  participant App as Your server
  participant GW as Sifalo gateway
  participant Cust as Customer
  participant CO as Checkout page
  App->>GW: POST /gateway/ gateway=checkout
  GW-->>App: key + token
  App->>Cust: Redirect to /checkout/?key=&token=
  Cust->>CO: Pay
  CO->>Cust: Return URL + sid
  Cust->>App: Browser hits return_url?sid=
  App->>GW: POST /gateway/verify.php sid
  GW-->>App: status + code

You need API keys and Basic auth.

1. Get key + token

Call this from your server:

curl -X POST "https://api.sifalopay.com/gateway/" \
  -u "$SIFALO_API_USER:$SIFALO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": "22",
    "gateway": "checkout",
    "currency": "USD",
    "return_url": "https://example.com/pay/return?order_id=123",
    "webhook_url": "https://example.com/hooks/sifalopay"
  }'

Response:

{ "key": "YWVm=.........", "token": "uVKqEYi......." }

2. Redirect

https://pay.sifalo.com/checkout/?key=YWVm=.........&token=uVKqEYi.......

When they’re done they land on something like:

https://example.com/pay/return?order_id=123&sid=ABC123

Read sid from the query string.

If the checkout page returns 403, the payment link is inactive or not allowed — start a new session. 410 means the token expired — call POST /gateway/ again for a fresh key and token.

3. Verify

On the server, when return_url is hit. Verify does not use Basic auth. If you passed webhook_url on start, you also get a push when payment finishes — still verify as a backup.

curl -X POST "https://api.sifalopay.com/gateway/verify.php" \
  -H "Content-Type: application/json" \
  -d '{"sid":"ABC123"}'

Mark the order paid only if status is success and code is 601.

{
  "sid": "ABC123",
  "account": "25262XXXXXXX",
  "payment_type": "EDAHAB",
  "amount": "1",
  "currency": "USD",
  "response": "Your Transaction has been Processed!",
  "status": "success",
  "code": 601
}

Use sid when you have it. order_id works as a fallback but only the most recent payment for that id is returned.

payment_type is EDAHAB, ZAAD (Waafi — not "WAAFI"), PREMIER WALLET, or CARD.

Set gateway timeouts to 120 seconds. Staging: Sandbox. PHP and Node: Hosted checkout (PHP / Node).

You can also send a product, invoice, or payment link from the Business portal. No key/token call for that.

Next

[email protected]