Step 2: Create Order

// You need: $fabricToken from Step 1, $config with your credentials
// You need: a Signer that does SHA256WithRSA — see Request Signature guide
 
$timestamp   = (string) time();
$nonceStr    = bin2hex(random_bytes(16));
$merchOrderId = time() . ''; // alphanumeric only!
 
$biz = [
    'notify_url'      => 'https://your-site.com/pay/notify',
    'appid'           => $merchantAppId,
    'merch_code'      => $merchantCode,
    'merch_order_id'  => $merchOrderId,
    'trade_type'      => 'Checkout',
    'title'           => 'Coffee x2',
    'total_amount'    => '45.00',
    'trans_currency'  => 'ETB',
    'timeout_express' => '120m',
    'redirect_url'    => 'https://your-site.com/pay/return',
];
 
$req = [
    'timestamp'   => $timestamp,
    'nonce_str'   => $nonceStr,
    'method'      => 'payment.preorder',
    'version'     => '1.0',
    'biz_content' => $biz,
];
 
// Sign ALL fields (including biz_content sub-fields) sorted by ASCII key order
$req['sign']      = signRequestObject($req);
$req['sign_type'] = 'SHA256WithRSA';
 
$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL            => $baseUrl . '/payment/v1/merchant/preOrder',
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => [
        'Content-Type: application/json',
        'X-APP-Key: ' . $fabricAppId,
        'Authorization: ' . $fabricToken,
    ],
    CURLOPT_POSTFIELDS => json_encode($req),
]);
 
$response = json_decode(curl_exec($ch), true);
$prepayId = $response['biz_content']['prepay_id'];

import crypto from 'crypto'
 
interface OrderConfig {
  fabricAppId: string
  merchantAppId: string
  merchantCode: string
  privateKeyPem: string
  notifyUrl: string
  redirectUrl: string
  baseUrl: string
}
 
function signRequestObject(obj: Record<string, unknown>, privateKeyPem: string): string {
  // Flatten biz_content fields into top-level, then sort all keys by ASCII
  const flat: Record<string, string> = {}
  for (const [k, v] of Object.entries(obj)) {
    if (k === 'sign' || k === 'sign_type' || v === null || v === undefined || v === '') continue
    if (k === 'biz_content' && typeof v === 'object') {
      for (const [bk, bv] of Object.entries(v as Record<string, unknown>)) {
        if (bv !== null && bv !== undefined && bv !== '') flat[bk] = String(bv)
      }
    } else {
      flat[k] = String(v)
    }
  }
  const rawStr = Object.keys(flat).sort().map(k => `${k}=${flat[k]}`).join('&')
  const sign = crypto.createSign('SHA256')
  sign.update(rawStr)
  return sign.sign({ key: privateKeyPem, padding: crypto.constants.RSA_PKCS1_PSS_PADDING }, 'base64')
}
 
async function createOrder(fabricToken: string, cfg: OrderConfig) {
  const timestamp = String(Math.floor(Date.now() / 1000))
  const nonceStr = crypto.randomBytes(16).toString('hex')
  const merchOrderId = Date.now().toString()
 
  const req: Record<string, unknown> = {
    timestamp,
    nonce_str: nonceStr,
    method: 'payment.preorder',
    version: '1.0',
    biz_content: {
      notify_url: cfg.notifyUrl,
      appid: cfg.merchantAppId,
      merch_code: cfg.merchantCode,
      merch_order_id: merchOrderId,
      trade_type: 'Checkout',
      title: 'Coffee x2',
      total_amount: '45.00',
      trans_currency: 'ETB',
      timeout_express: '120m',
      redirect_url: cfg.redirectUrl,
    },
  }
 
  req.sign = signRequestObject(req, cfg.privateKeyPem)
  req.sign_type = 'SHA256WithRSA'
 
  const res = await fetch(`${cfg.baseUrl}/payment/v1/merchant/preOrder`, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'X-APP-Key': cfg.fabricAppId,
      'Authorization': fabricToken,
    },
    body: JSON.stringify(req),
  })
 
  const data = await res.json()
  return data.biz_content.prepay_id as string
}

import hashlib, hmac, time, os, random, string, json, requests
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import padding
from cryptography.hazmat.backends import default_backend
import base64
 
def sign_request_object(obj: dict, private_key_pem: str) -> str:
    """Flatten biz_content, sort all keys by ASCII, sign with SHA256WithRSA PSS."""
    flat = {}
    for k, v in obj.items():
        if k in ("sign", "sign_type") or v is None or v == "":
            continue
        if k == "biz_content" and isinstance(v, dict):
            for bk, bv in v.items():
                if bv is not None and bv != "":
                    flat[bk] = str(bv)
        else:
            flat[k] = str(v)
 
    raw = "&".join(f"{k}={flat[k]}" for k in sorted(flat))
 
    private_key = serialization.load_pem_private_key(
        private_key_pem.encode(), password=None, backend=default_backend()
    )
    signature = private_key.sign(raw.encode(), padding.PSS(
        mgf=padding.MGF1(hashes.SHA256()),
        salt_length=padding.PSS.MAX_LENGTH,
    ), hashes.SHA256())
    return base64.b64encode(signature).decode()
 
 
def create_order(fabric_token: str, cfg: dict) -> str:
    timestamp = str(int(time.time()))
    nonce_str = "".join(random.choices(string.ascii_uppercase + string.digits, k=32))
    merch_order_id = str(int(time.time() * 1000))
 
    req = {
        "timestamp": timestamp,
        "nonce_str": nonce_str,
        "method": "payment.preorder",
        "version": "1.0",
        "biz_content": {
            "notify_url": cfg["notify_url"],
            "appid": cfg["merchant_app_id"],
            "merch_code": cfg["merchant_code"],
            "merch_order_id": merch_order_id,
            "trade_type": "Checkout",
            "title": "Coffee x2",
            "total_amount": "45.00",
            "trans_currency": "ETB",
            "timeout_express": "120m",
            "redirect_url": cfg["redirect_url"],
        },
    }
    req["sign"] = sign_request_object(req, cfg["private_key_pem"])
    req["sign_type"] = "SHA256WithRSA"
 
    resp = requests.post(
        f"{cfg['base_url']}/payment/v1/merchant/preOrder",
        headers={
            "Content-Type": "application/json",
            "X-APP-Key": cfg["fabric_app_id"],
            "Authorization": fabric_token,
        },
        json=req,
        verify=False,
    )
    resp.raise_for_status()
    return resp.json()["biz_content"]["prepay_id"]