Server-side PHP SDK for Elebne Pay — mint client secrets, retrieve/cancel/refund intents, and verify webhooks. PHP 8.1+, dependency-free.

PHP SDK

elebne/pay-php is the server SDK for Elebne Pay — the PHP counterpart to stripe-php. It mints the clientSecret that the client SDKs (React, React Native, Flutter) consume, builds the hosted embed URL, and verifies webhooks. It renders no UI. Dependency-free (uses curl), PHP 8.1+.

Install

composer require elebne/pay-php

While the package is being published to Packagist, it is also available via the Elebne private registry — request access from dev@elebne.ai.

Configure

Construct a client with your secret key and environment. The environment selects the API base URL preset (production → https://api.elebne.ai/api/v1, staging → https://api.staging.elebne.ai/api/v1).

use Elebne\Pay\{ElebneClient, Config};

// Production
$elebne = new ElebneClient(new Config('sk_live_…', 'production'));

// Staging
$staging = new ElebneClient(new Config('sk_test_…', 'staging'));

Keep sk_ on the server

sk_ keys can create, cancel, and refund payments. They must never reach the browser or a mobile app — that is what the client SDKs and clientSecret are for.

A sk_test_ key produces sandbox intents (no real money); a sk_live_ key produces real payments. There is no separate sandbox hostname — the key decides.

Flow A — mint an intent and hand off the clientSecret

Your server creates the intent, then returns the clientSecret to your frontend (which passes it to a client SDK via fetchClientSecret), or builds the hosted embed URL directly.

use Elebne\Pay\{ElebneClient, Config, EmbedUrl};

$elebne = new ElebneClient(new Config('sk_live_…', 'production'));

$intent = $elebne->intents->create([
    'amount'          => 150000,            // centimes → 1 500.00 MRU
    'label'           => 'Commande #12345',
    'merchantOrderId' => 'ORDER-12345',
    'success_url'     => 'https://shop.example/success',
    'cancel_url'      => 'https://shop.example/cart',
]);

// Return this to your frontend (pay-react / RN / Flutter fetchClientSecret):
$clientSecret = $intent->clientSecret();

// Or build the hosted embed URL directly:
$url = EmbedUrl::build('https://elebne.ai/embed', $clientSecret);
// Staging: EmbedUrl::build('https://pay.staging.elebne.ai/embed', $clientSecret);

Retrieve, cancel, refund

$elebne->intents->retrieve('PI-30…');
$elebne->intents->cancel('PI-30…');

// Partial refund of 500.00 MRU with a reason
$elebne->intents->refund('PI-30…', amount: 50000, reason: 'SERVICE_NOT_DELIVERED');

Flow B / Flow C — publishable key

Flow B (stored price) and Flow C (verify) use a publishable key (pk_):

$pk = new ElebneClient(new Config('pk_live_…'));

// Flow B — stored price defined in the dashboard
$pk->intents->createCheckoutSession(['priceId' => 'abc123', 'quantity' => 2]);

// Flow C — verify against your own order reference
$pk->intents->createPkIntent(['merchantOrderId' => 'ORDER-1']);

Verify webhooks

verifyAndParse checks the HMAC-SHA256 signature (constant-time) and rejects timestamp drift, then returns the parsed event. On a bad signature it throws SignatureVerificationException — respond 401 and do nothing else.

use Elebne\Pay\Webhooks;
use Elebne\Pay\Exception\SignatureVerificationException;

$raw = file_get_contents('php://input');

try {
    $event = (new Webhooks())->verifyAndParse(
        $raw,
        $_SERVER['HTTP_X_ELEBNE_SIGNATURE'] ?? '',
        $_SERVER['HTTP_X_ELEBNE_TIMESTAMP'] ?? 0,
        getenv('ELEBNE_WEBHOOK_SECRET'),
    );

    // $event->event                        e.g. 'payment.confirmed'
    // $event->data['referenceNumber']      e.g. 'PI-30XXXXXXXXXXXXXX'
    http_response_code(200);
} catch (SignatureVerificationException $e) {
    http_response_code(401);
}

The signature scheme (header X-Elebne-Signature: sha256=<hex>, signed content "{timestamp}.{rawBody}", HMAC-SHA256) is the same one documented in full at Webhooks.

Error handling

API calls throw Elebne\Pay\Exception\ApiException with ->errorCode and ->httpStatus. Catch it around create / refund and inspect the code.

Next steps

React SDK — consume the clientSecret on the web
Java SDK — the same server SDK for the JVM
Webhooks — full signature and retry contract
Pay API — the REST endpoints this SDK wraps

Was this page helpful?

PHP SDK

On this page