Step 2: Create In-App Order

$timestamp    = (string) time();
$nonceStr     = bin2hex(random_bytes(16));
$merchOrderId = (string) time(); // alphanumeric only
 
$biz = [
    'notify_url'      => 'https://your-site.com/pay/notify',
    'trade_type'      => 'InApp',                 // <— key difference
    'appid'           => $merchantAppId,
    'merch_code'      => $merchantCode,
    'merch_order_id'  => $merchOrderId,
    'title'           => 'Diamond Pack',
    'total_amount'    => '50.00',
    'trans_currency'  => 'ETB',
    'timeout_express' => '120m',
];
 
$req = [
    'timestamp'   => $timestamp,
    'nonce_str'   => $nonceStr,
    'method'      => 'payment.preorder',
    'version'     => '1.0',
    'biz_content' => $biz,
];
 
$req['sign']      = signRequestObject($req);
$req['sign_type'] = 'SHA256WithRSA';
 
$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL            => $baseUrl . '/payment/v1/inapp/createOrder',
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => [
        'Content-Type: application/json',
        'X-APP-Key: ' . $fabricAppId,
        'Authorization: ' . $fabricToken,
    ],
    CURLOPT_POSTFIELDS => json_encode($req),
]);
 
$response    = json_decode(curl_exec($ch), true);
$receiveCode = $response['biz_content']['receiveCode'];

import crypto from 'crypto'
 
async function createInAppOrder(fabricToken: string, cfg: {
  fabricAppId: string
  merchantAppId: string
  merchantCode: string
  privateKeyPem: string
  notifyUrl: string
  baseUrl: string
}) {
  const timestamp = String(Math.floor(Date.now() / 1000))
  const nonceStr = crypto.randomBytes(16).toString('hex')
  const merchOrderId = Date.now().toString()
 
  const req: Record<string, unknown> = {
    timestamp,
    nonce_str: nonceStr,
    method: 'payment.preorder',
    version: '1.0',
    biz_content: {
      notify_url: cfg.notifyUrl,
      trade_type: 'InApp',  // <— key difference
      appid: cfg.merchantAppId,
      merch_code: cfg.merchantCode,
      merch_order_id: merchOrderId,
      title: 'Diamond Pack',
      total_amount: '50.00',
      trans_currency: 'ETB',
      timeout_express: '120m',
    },
  }
 
  req.sign = signRequestObject(req, cfg.privateKeyPem)
  req.sign_type = 'SHA256WithRSA'
 
  const res = await fetch(`${cfg.baseUrl}/payment/v1/inapp/createOrder`, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'X-APP-Key': cfg.fabricAppId,
      Authorization: fabricToken,
    },
    body: JSON.stringify(req),
  })
 
  const data = await res.json()
  return {
    receiveCode: data.biz_content.receiveCode as string,
    prepayId: data.biz_content.prepay_id as string,
    merchOrderId: data.biz_content.merch_order_id as string,
  }
}

import time, random, string, base64, requests
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import padding
from cryptography.hazmat.backends import default_backend
 
def create_inapp_order(fabric_token: str, cfg: dict) -> dict:
    timestamp = str(int(time.time()))
    nonce_str = "".join(random.choices(string.ascii_uppercase + string.digits, k=32))
    merch_order_id = str(int(time.time() * 1000))
 
    req = {
        "timestamp": timestamp,
        "nonce_str": nonce_str,
        "method": "payment.preorder",
        "version": "1.0",
        "biz_content": {
            "notify_url": cfg["notify_url"],
            "trade_type": "InApp",   # <— key difference
            "appid": cfg["merchant_app_id"],
            "merch_code": cfg["merchant_code"],
            "merch_order_id": merch_order_id,
            "title": "Diamond Pack",
            "total_amount": "50.00",
            "trans_currency": "ETB",
            "timeout_express": "120m",
        },
    }
    req["sign"] = sign_request_object(req, cfg["private_key_pem"])
    req["sign_type"] = "SHA256WithRSA"
 
    resp = requests.post(
        f"{cfg['base_url']}/payment/v1/inapp/createOrder",
        headers={
            "Content-Type": "application/json",
            "X-APP-Key": cfg["fabric_app_id"],
            "Authorization": fabric_token,
        },
        json=req,
        verify=False,
    )
    resp.raise_for_status()
    biz = resp.json()["biz_content"]
    return {
        "receiveCode": biz["receiveCode"],
        "prepayId": biz["prepay_id"],
        "merchOrderId": biz["merch_order_id"],
    }