Take your first payment첫 결제 받아 보기

<?php
$ch = curl_init("https://api.outlinepay.com/v1/merchants?limit=20");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => [
        "Authorization: Bearer olp_sk_test_YOUR_KEY",
    ],
]);

$response = curl_exec($ch);
$status   = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo $status . PHP_EOL;
echo $response . PHP_EOL;

<?php
$ch = curl_init("https://api.outlinepay.com/v1/merchants");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_HTTPHEADER     => [
        "Authorization: Bearer olp_sk_test_YOUR_KEY",
        "Content-Type: application/json",
    ],
    CURLOPT_POSTFIELDS     => json_encode([
        "name"        => "Acme Trading Co.",
        "email"       => "[email protected]",
        "country"     => "US",
        "entity_type" => "company",
        "business"    => [
            "legal_name"           => "Acme Trading Co. LLC",
            "structure"            => "llc",
            "phone"                => "+12125550123",
            "url"                  => "https://acme.example",
            "product_description"  => "Imported kitchenware and small appliances.",
            "industry_code"        => "5722",
            "statement_descriptor" => "ACME TRADING",
            "address"              => [
                "line1"       => "1600 Market St",
                "city"        => "Philadelphia",
                "state"       => "PA",
                "postal_code" => "19103",
                "country"     => "US",
            ],
        ],
    ]),
]);

$response = curl_exec($ch);
$status   = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo $status . PHP_EOL;
echo $response . PHP_EOL;

<?php
$ch = curl_init("https://api.outlinepay.com/v1/merchants/mrc_9f2c8bAaZ1kQ/processors");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_HTTPHEADER     => [
        "Authorization: Bearer olp_sk_test_YOUR_KEY",
        "Content-Type: application/json",
    ],
    CURLOPT_POSTFIELDS     => json_encode([
        "tax_id"         => "00-0000000",
        "representative" => [
            "first_name"    => "Dana",
            "last_name"     => "Whitfield",
            "email"         => "[email protected]",
            "phone"         => "+12125550188",
            "date_of_birth" => "1985-04-27",
            "address"       => [
                "line1"       => "220 Spruce St",
                "city"        => "Philadelphia",
                "state"       => "PA",
                "postal_code" => "19106",
                "country"     => "US",
            ],
        ],
    ]),
]);

$response = curl_exec($ch);
$status   = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo $status . PHP_EOL;
echo $response . PHP_EOL;

YOUR BROWSER           YOUR SERVER         OUTLINEPAY        STRIPE
outlinepay.js          holds olp_sk_       holds the
+ your page                                Stripe keys
    |                      |                   |               |
    |  POST /merchant/session                  |               |
    |  (your route, not ours)                  |               |
    |--------------------->|                   |               |
    |                      |  POST /v1/merchants/{id}/account_session
    |                      |  Authorization: Bearer olp_sk_    |
    |                      |------------------>|               |
    |                      |                   | create the    |
    |                      |                   | session       |
    |                      |                   |-------------->|
    |  the session body,   |<------------------|               |
    |  passed through      |                   |               |
    |<---------------------|                   |               |
    |                                                          |
    |  outlinepay.js loads connect.js, then mounts the component
    |--------------------------------------------------------->|

outlinepay.js NEVER calls /v1. It cannot: minting a session needs your
secret key, so that call stays on your server. The only request it makes
to a host of ours is the one that downloaded the file.

귀사의 브라우저귀사의 서버OUTLINEPAYSTRIPE
outlinepay.jsolp_sk_ 보관Stripe 키 보관
+ 귀사의 페이지
    |                      |                   |               |
    |  POST /merchant/session                  |               |
    |  (당사가 아닌 귀사의 라우트)|               |
    |--------------------->|                   |               |
    |                      |  POST /v1/merchants/{id}/account_session
    |                      |  Authorization: Bearer olp_sk_    |
    |                      |------------------>|               |
    |                      |                   | 세션 생성|
    |                      |                   |               |
    |                      |                   |-------------->|
    |  세션 본문을|<------------------|               |
    |  그대로 전달|                   |               |
    |<---------------------|                   |               |
    |                                                          |
    |  outlinepay.js가 connect.js를 불러와 컴포넌트를 마운트합니다
    |--------------------------------------------------------->|

outlinepay.js는 /v1을 절대 호출하지 않습니다. 호출할 수도 없습니다. 세션을
발급하려면 귀사의 시크릿 키가 필요하므로 그 호출은 귀사의 서버에 남습니다.
이 파일이 당사 호스트에 보내는 요청은 파일을 내려받은 그 한 번뿐입니다.

<?php
$ch = curl_init("https://api.outlinepay.com/v1/merchants/mrc_9f2c8bAaZ1kQ/account_session");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_HTTPHEADER     => [
        "Authorization: Bearer olp_sk_test_YOUR_KEY",
        "Content-Type: application/json",
    ],
    CURLOPT_POSTFIELDS     => json_encode([
        "components" => [
            "onboarding",
        ],
    ]),
]);

$response = curl_exec($ch);
$status   = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo $status . PHP_EOL;
echo $response . PHP_EOL;

<?php
// YOUR route, on YOUR server. Your page calls this one.
// It is not an OutlinePay endpoint, and OutlinePay never calls it.
//   POST https://pg.cookiepay.example/merchant/onboarding-session

// Which merchant this is for comes from YOUR login session, never from the
// request body. Reading it from the browser would let any signed-in user
// mint a session for somebody else's merchant.
$merchantId = merchant_for_current_session();

// The OutlinePay call. Your secret key is used on this machine and stays here.
$ch = curl_init("https://api.outlinepay.com/v1/merchants/{$merchantId}/account_session");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_HTTPHEADER     => [
        "Authorization: Bearer olp_sk_test_YOUR_KEY",
        "Content-Type: application/json",
    ],
    CURLOPT_POSTFIELDS     => json_encode(["components" => ["onboarding"]]),
]);

// Hand our response back as it arrived. outlinepay.js reads what it needs
// out of it, so there is no list of fields to forward and none to forget.
//
// Nothing in that body is a secret of yours: client_secret is scoped to this
// one merchant and only the components you named, publishable_key is public,
// and processor and locale are not sensitive. Your key is not in it.
header("Content-Type: application/json");
echo curl_exec($ch);
curl_close($ch);

<script src="https://js.outlinepay.com/v1/outlinepay.js"></script>

<div id="onboarding"></div>

<script>
  // The whole of the browser half. sessionUrl is YOUR route, the one above,
  // and it is the only endpoint this page knows about.
  OutlinePay.mount("onboarding", "#onboarding", {
    sessionUrl: "/merchant/onboarding-session",
  })
</script>

<?php
$ch = curl_init("https://api.outlinepay.com/v1/payments");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_HTTPHEADER     => [
        "Authorization: Bearer olp_sk_test_YOUR_KEY",
        "Content-Type: application/json",
    ],
    CURLOPT_POSTFIELDS     => json_encode([
        "merchant_id" => "mrc_9f2c8bAaZ1kQ",
        "amount"      => 10000,
        "currency"    => "usd",
        "description" => "Order",
        "customer"    => [
            "email" => "[email protected]",
        ],
        "success_url" => "https://pg.cookiepay.example/op/result",
        "cancel_url"  => "https://pg.cookiepay.example/op/cancel",
    ]),
]);

$response = curl_exec($ch);
$status   = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo $status . PHP_EOL;
echo $response . PHP_EOL;

<?php
// $payment is the decoded create-payment response
header("Location: " . $payment["checkout_url"]);
exit;

<?php
$ch = curl_init("https://api.outlinepay.com/v1/webhook_endpoints");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_HTTPHEADER     => [
        "Authorization: Bearer olp_sk_test_YOUR_KEY",
        "Content-Type: application/json",
    ],
    CURLOPT_POSTFIELDS     => json_encode([
        "url" => "https://pg.cookiepay.example/outlinepay/webhook",
    ]),
]);

$response = curl_exec($ch);
$status   = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo $status . PHP_EOL;
echo $response . PHP_EOL;

<?php
// Verify an OutlinePay webhook before trusting it.
// Header: OutlinePay-Signature: t=<unix>,v1=<HMAC-SHA256(secret, "t.body")>
$secret  = "olp_whsec_YOUR_SIGNING_SECRET";          // shown once when you create the endpoint
$payload = file_get_contents("php://input");         // the RAW body. Do not json_decode first
$header  = $_SERVER["HTTP_OUTLINEPAY_SIGNATURE"] ?? "";

// Pull t= and v1= out of the header.
$parts = [];
foreach (explode(",", $header) as $pair) {
    [$k, $v] = array_pad(explode("=", $pair, 2), 2, "");
    $parts[$k] = $v;
}
$timestamp = (int)($parts["t"] ?? 0);
$given     = $parts["v1"] ?? "";

// The timestamp is when this delivery attempt was sent, not when the event
// was created. Retries are re-signed fresh, so late ones still verify.
// Reject a timestamp older than 5 minutes to stop replayed deliveries.
if ($timestamp === 0 || abs(time() - $timestamp) > 300) {
    http_response_code(400);
    exit("stale or malformed signature");
}

// Recompute the HMAC over "timestamp.body" and compare in constant time.
$expected = hash_hmac("sha256", $timestamp . "." . $payload, $secret);
if (!hash_equals($expected, $given)) {
    http_response_code(400);
    exit("signature mismatch");
}

// Verified. Handle the event, then return 2xx so OutlinePay stops retrying.
$event = json_decode($payload, true);
// switch ($event["type"]) { case "payment.succeeded": ... }
http_response_code(200);

curl -X POST "https://api.outlinepay.com/v1/merchants/mrc_9f2c8bAaZ1kQ/account_session" \
  -H "Authorization: Bearer olp_sk_test_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "components": ["balances", "payouts"]
}'

<?php
// YOUR route again, one step wider, so the same one serves every component
// page you build.
//   POST https://pg.cookiepay.example/merchant/session

// Still your login session that decides the merchant. Nothing changed here.
$merchantId = merchant_for_current_session();

// Which page is asking, and what that page is allowed to mount. An
// allowlist, not a pass-through: if the browser could name its own
// components, a payout page could ask for a credential that also opens
// account management.
$pages = [
    "money"    => ["balances", "payouts"],
    "account"  => ["account_management", "notifications"],
    "disputes" => ["disputes"],
    "tax"      => ["documents"],
];

$body = json_decode(file_get_contents("php://input"), true) ?: [];
$page = $body["page"] ?? "";
if (!isset($pages[$page])) {
    http_response_code(400);
    exit("unknown page");
}

$ch = curl_init("https://api.outlinepay.com/v1/merchants/{$merchantId}/account_session");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_HTTPHEADER     => [
        "Authorization: Bearer olp_sk_test_YOUR_KEY",
        "Content-Type: application/json",
    ],
    // The only line that differs from the onboarding route.
    CURLOPT_POSTFIELDS     => json_encode(["components" => $pages[$page]]),
]);

// Passed straight through, exactly as in the onboarding route.
header("Content-Type: application/json");
echo curl_exec($ch);
curl_close($ch);

<script src="https://js.outlinepay.com/v1/outlinepay.js"></script>

<div id="balances"></div>
<div id="payouts"></div>

<script>
  // Both name the same sessionUrl and the same request, so they share one
  // account session and one SDK instance between them. Ask for a different
  // page and you get a second of each, which is why a page's components
  // belong in a single request.
  const options = {
    sessionUrl: "/merchant/session",   // yours, not ours
    request: { page: "money" },        // your server decides what this may ask for
  }

  // Chained, not fired side by side, and it matters: mount() checks that
  // shared instance BEFORE it awaits the session, so two calls made at once
  // both miss it and each mint their own. Awaiting the first is what makes
  // the second free.
  OutlinePay.mount("balances", "#balances", options)
    .then(() => OutlinePay.mount("payouts", "#payouts", options))
</script>

// A component the session does not cover. Without the wrapper this renders
// an empty box and the reason is swallowed inside the processor's handshake.
outlinepay.js [component_not_in_session]: the session from /merchant/session
covers [balances, payouts], so it cannot mount disputes. Add disputes to the
components your endpoint asks for.

// A route that picked fields out of our response instead of passing it on.
outlinepay.js [endpoint_missing_field]: your endpoint /merchant/session
returned no publishable_key. Return the account-session response body as we
sent it to you.

// A Content-Security-Policy that does not allow the processor's SDK.
outlinepay.js [processor_sdk_blocked]: could not load
https://connect-js.stripe.com/v1.0/connect.js. If your Content-Security-Policy
sets script-src, it has to allow https://connect-js.stripe.com.