$parts = array_filter([
  $secretKey,
  $shopId,
  $price,
  $control,
  $description,
  $email,
  $notifyURL,
  $returnUrlSuccess
], fn($v) => $v !== null && $v !== '');

$signature = hash('sha256', implode('|', $parts));

import crypto from 'crypto';

function sig(...fields) {
  const nonEmpty = fields.filter(v => v !== undefined && v !== null && v !== '');
  return crypto.createHash('sha256').update(nonEmpty.join('|')).digest('hex');
}

import hashlib

def sig(*fields):
    parts = [str(f) for f in fields if f not in (None, '')]
    return hashlib.sha256('|'.join(parts).encode()).hexdigest()

{
  "errorCode": 403,
  "error": "invalid signature"
}

SECRET_KEY|shopId|price|control|description|email|notifyURL|returnUrlSuccess

$price = number_format(29.70, 2, '.', '');
$control = 'order-123';
$description = 'Zamówienie 123';
$email = '[email protected]';
$notifyURL = 'https://example.com/pbl/notify';
$returnUrlSuccess = 'https://example.com/dziekujemy';

$parts = array_filter([
  $secretKey, $shopId, $price, $control,
  $description, $email, $notifyURL, $returnUrlSuccess
], fn($v) => $v !== null && $v !== '');

$payload = [
  'shopId' => $shopId,
  'price' => (float) $price,
  'control' => $control,
  'description' => $description,
  'email' => $email,
  'notifyURL' => $notifyURL,
  'returnUrlSuccess' => $returnUrlSuccess,
  'signature' => hash('sha256', implode('|', $parts))
];

$ch = curl_init('https://secure.paybylink.pl/api/v1/transfer/generate');
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
  CURLOPT_POSTFIELDS => json_encode($payload, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE),
]);

$data = json_decode(curl_exec($ch), true);
echo $data['url'];

const price = (29.70).toFixed(2);
const control = 'order-123';
const notifyURL = 'https://example.com/pbl/notify';
const returnUrlSuccess = 'https://example.com/dziekujemy';

const signature = sig(SECRET, SHOP_ID, price, control, '', '', notifyURL, returnUrlSuccess);

const res = await fetch('https://secure.paybylink.pl/api/v1/transfer/generate', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    shopId: SHOP_ID,
    price: Number(price),
    control, notifyURL, returnUrlSuccess, signature
  })
});

console.log(await res.json());

curl -X POST https://secure.paybylink.pl/api/v1/transfer/generate \
  -H 'Content-Type: application/json' \
  -d '{"shopId":1234,"price":29.70,"control":"order-123","signature":"..."}'

{
  "url": "https://secure.pbl.pl/transfer/XYZ...",
  "transactionId": "XYZ..."
}

SECRET_KEY|shopId|transactionId|customReason

{ "cancelled": true }

{ "cancelled": false, "cancelError": "Transaction already cancelled" }

SECRET_KEY|shopId|price|code|customerIP|control|notifyPaymentURL|notifyStatusURL

{ "transactionId": "w3WUQX...JLJ" }

SECRET_KEY|transactionId|control|email|amountPaid|notificationAttempt|paymentType|apiVersion

$body = json_decode(file_get_contents('php://input'), true);

$parts = array_filter([
  $secretKey,
  $body['transactionId'],
  $body['control'],
  $body['email'],
  number_format($body['amountPaid'], 2, '.', ''),
  $body['notificationAttempt'],
  $body['paymentType'],
  $body['apiVersion']
], fn($v) => $v !== null && $v !== '');

if (!hash_equals(hash('sha256', implode('|', $parts)), $body['signature'])) {
  http_response_code(403);
  exit;
}

header('Content-Type: text/plain');
echo 'OK';

{ "transactionId":"...", "price":"1.01", "status":"CONFIRMED" }
{ "transactionId":"...", "price":"1.01", "status":"TIMEOUT" }
{ "transactionId":"...", "price":"1.01", "status":"USER_DECLINED" }
{ "transactionId":"...", "price":"1.01", "status":"WRONG_TICKET" }

SECRET_KEY|transactionId|control|price|status

"Connection error"              // błędne dane wejściowe
"Code does not exist"           // brak kodu w zapytaniu
"User or service does not exist" // zły kanał lub partner
"Number does not exist"         // brak numeru w zapytaniu