How to Integrate FamPay UPI Payment Gateway in SMM Panels (Rental, Perfect Panel & SmartPanel)

+-------------------+ +-----------------------+ +------------------------+ | SMM Panel User | | SMM Panel Server | | FamGateway Cluster | +-------------------+ +-----------------------+ +------------------------+ | | | | 1. Enter INR 100 | | | Click "Add Funds (UPI)" | | |---------------------------->| | | | 2. POST /api/create-order | | | Headers: X-Api-Key | | |------------------------------>| | | | 3. Generate Order | | | TTL: Exactly 300s | | 4. Return Checkout URL & QR | Unique dynamic QR | |<------------------------------| | 5. Redirect to Checkout | | |<----------------------------| | | | | | 6. Scan QR & Pay INR 100 via UPI App (GPay/PhonePe/FamPay) | |------------------------------------------------------------>| | | | 7. Ingest Bank Receipt | | | Verify 12-Digit UTR | | 8. Signed Webhook Callback | Apply Mutex Lock | | Header: Signature (HMAC) | | |<------------------------------| | | | | | 9. Validate Signature | | | Deduplicate Bank UTR | | | Execute SQL Transaction: | | | balance = balance + 100 | | | | | 10. Dashboard Reflects New Balance in Under 3 Seconds | |<----------------------------| |

<?php
function createFamGatewayOrder($userId, $amount, $userEmail) {
    $apiKey = "YOUR_LIVE_FAMGATEWAY_API_KEY"; // Retrieved from FamGateway Merchant Dashboard
    $endpoint = "https://famgateway.in/api/create-order";

    $postData = [
        "amount"       => number_format($amount, 2, '.', ''),
        "redirect_url" => "https://yourpanel.com/addfunds?status=success",
        "webhook_url"  => "https://yourpanel.com/api/famgateway-callback.php",
        "custom_id"    => "USER_" . $userId . "_" . time()
    ];

    $ch = curl_init($endpoint);
    curl_setopt_array($ch, [
        CURLOPT_POST           => true,
        CURLOPT_POSTFIELDS     => json_encode($postData),
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT        => 10,
        CURLOPT_HTTPHEADER     => [
            "Content-Type: application/json",
            "X-Api-Key: " . $apiKey
        ]
    ]);

    $response = curl_exec($ch);
    $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    $curlError = curl_error($ch);
    curl_close($ch);

    if ($curlError) {
        throw new Exception("cURL error: " . $curlError);
    }

    $result = json_decode($response, true);
    if ($httpCode === 200 && isset($result['checkout_url'])) {
        return $result; // Contains order_id, checkout_url, qr_image, expires_in (300s)
    }

    throw new Exception("Order creation failed: " . ($result['message'] ?? 'Unknown error'));
}

async function createSmmOrder(userId, amount) {
    const response = await fetch("https://famgateway.in/api/create-order", {
        method: "POST",
        headers: {
            "Content-Type": "application/json",
            "X-Api-Key": process.env.FAMGATEWAY_API_KEY
        },
        body: JSON.stringify({
            amount: parseFloat(amount).toFixed(2),
            redirect_url: "https://yourpanel.com/addfunds?status=success",
            webhook_url: "https://yourpanel.com/api/famgateway-callback.php",
            custom_id: `USER_${userId}_${Date.now()}`
        })
    });

    const data = await response.json();
    if (!response.ok) {
        throw new Error(data.message || "Failed to create order");
    }
    return data; // Returns checkout_url, order_id, qr_image
}

-- 1. Create Dedicated Payments Audit Table
CREATE TABLE IF NOT EXISTS `smm_payments` (
  `id` INT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
  `user_id` INT UNSIGNED NOT NULL,
  `order_id` VARCHAR(64) NOT NULL UNIQUE,
  `amount` DECIMAL(10,2) NOT NULL,
  `utr` VARCHAR(32) DEFAULT NULL,
  `status` ENUM('pending', 'completed', 'expired', 'failed') NOT NULL DEFAULT 'pending',
  `created_at` TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
  `updated_at` TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
  INDEX `idx_user_status` (`user_id`, `status`),
  UNIQUE KEY `uk_utr_completed` (`utr`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

-- 2. Ensure Users Table Has Fast Indexing on Primary Key
-- UPDATE users SET balance = balance + :amount WHERE id = :user_id;

<?php
// api/famgateway-callback.php
declare(strict_types=1);
header('Content-Type: application/json; charset=utf-8');

// 1. Read Raw Incoming HTTP Payload
$rawPayload = file_get_contents('php://input');
if (empty($rawPayload)) {
    http_response_code(400);
    echo json_encode(['status' => 'error', 'message' => 'Empty request body']);
    exit;
}

$data = json_decode($rawPayload, true);
if (!is_array($data) || empty($data['order_id']) || empty($data['status'])) {
    http_response_code(400);
    echo json_encode(['status' => 'error', 'message' => 'Malformed payload']);
    exit;
}

// 2. Cryptographic Signature Verification
// FamGateway signs the payload using HMAC-SHA256 with the merchant API key
$apiKey = "YOUR_LIVE_FAMGATEWAY_API_KEY";
$receivedSignature = $_SERVER['HTTP_X_FAMGATEWAY_SIGNATURE'] ?? '';

if (empty($receivedSignature)) {
    http_response_code(401);
    echo json_encode(['status' => 'error', 'message' => 'Missing cryptographic signature header']);
    exit;
}

$expectedSignature = hash_hmac('sha256', $rawPayload, $apiKey);
if (!hash_equals($expectedSignature, $receivedSignature)) {
    http_response_code(401);
    echo json_encode(['status' => 'error', 'message' => 'Signature mismatch']);
    exit;
}

// 3. Process Only Cleared Payments
if ($data['status'] !== 'success') {
    http_response_code(200);
    echo json_encode(['status' => 'ignored', 'message' => 'Non-success event acknowledged']);
    exit;
}

$orderId = trim((string)$data['order_id']);
$amount  = (float)$data['amount'];
$utr     = trim((string)($data['utr'] ?? ''));

// 4. Database Connection via PDO
$dbHost = '127.0.0.1';
$dbName = 'your_smm_database';
$dbUser = 'your_db_username';
$dbPass = 'your_db_password';

try {
    $pdo = new PDO("mysql:host={$dbHost};dbname={$dbName};charset=utf8mb4", $dbUser, $dbPass, [
        PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
        PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC
    ]);

    // Begin ACID Transaction
    $pdo->beginTransaction();

    // Acquire Exclusive Row Lock on Payment Record
    $stmt = $pdo->prepare("SELECT id, user_id, amount, status FROM smm_payments WHERE order_id = :order_id FOR UPDATE");
    $stmt->execute([':order_id' => $orderId]);
    $payment = $stmt->fetch();

    if (!$payment) {
        // Order not found in local table
        $pdo->rollBack();
        http_response_code(404);
        echo json_encode(['status' => 'error', 'message' => 'Order record not found']);
        exit;
    }

    if ($payment['status'] === 'completed') {
        // Already processed via polling or duplicate webhook
        $pdo->rollBack();
        http_response_code(200);
        echo json_encode(['status' => 'success', 'message' => 'Order already fulfilled']);
        exit;
    }

    // Verify Bank UTR Uniqueness Across All Completed Payments
    if (!empty($utr)) {
        $utrStmt = $pdo->prepare("SELECT id FROM smm_payments WHERE utr = :utr AND status = 'completed'");
        $utrStmt->execute([':utr' => $utr]);
        if ($utrStmt->fetch()) {
            $pdo->rollBack();
            http_response_code(409);
            echo json_encode(['status' => 'error', 'message' => 'Bank UTR collision detected']);
            exit;
        }
    }

    // Update Payment Record to Completed
    $updatePayment = $pdo->prepare("UPDATE smm_payments SET status = 'completed', utr = :utr, updated_at = NOW() WHERE id = :id");
    $updatePayment->execute([
        ':utr' => $utr,
        ':id'  => $payment['id']
    ]);

    // Atomically Credit User Account Balance in SMM Users Table
    $updateUser = $pdo->prepare("UPDATE users SET balance = balance + :credit_amount WHERE id = :user_id");
    $updateUser->execute([
        ':credit_amount' => $payment['amount'],
        ':user_id'       => $payment['user_id']
    ]);

    // Commit Transaction
    $pdo->commit();

    http_response_code(200);
    echo json_encode([
        'status'  => 'success',
        'message' => 'SMM account balance updated successfully',
        'order_id' => $orderId,
        'credited' => $payment['amount']
    ]);

} catch (Throwable $e) {
    if (isset($pdo) && $pdo->inTransaction()) {
        $pdo->rollBack();
    }
    http_response_code(500);
    echo json_encode(['status' => 'error', 'message' => 'Internal database processing failure']);
}

<?php
function pollOrderStatus($orderId) {
    $url = "https://famgateway.in/api/checkout-status.php?order_id=" . urlencode($orderId);
    $response = file_get_contents($url);
    if ($response === false) {
        return ['status' => 'unknown'];
    }
    return json_decode($response, true);
}
// Returns: {"status": "success", "amount": 100.00, "utr": "624389102455", ...}