AIPowerCreate
Create the order on the server. Store the returned references and inspect the returned payment-method information.
DEVELOPERS / API INTEGRATION REFERENCEConnect to
Connect to
AIPower Pay.
Gateway endpoints, authentication and transaction lifecycle guidance based on the supplied AIPowerPay integration manual. Use the recommended gateway routes for new integrations.
Request integration credentials ↗Environments and merchant access.
| Environment | API base URL | Merchant portal |
|---|---|---|
| Test | https://testapi.aipowerpay.com | Test merchant login ↗ |
| Production | https://api.aipowerpay.com | Production merchant login ↗ |
Authenticate from your server.
Obtain an appKey and secretKey from the administrator. Base64-encode the string appKey:secretKey and send it with the Basic authorization scheme. Base64 is encoding, not encryption; requests use HTTPS.
Authorization: Basic <base64(appKey:secretKey)> siteDomain: https://your-approved-domain.example
The siteDomain must match a site added to the merchant account and approved. The older request-body appKey and token fields are compatibility fields, not the primary authentication method on the recommended routes.
Keep credentials in server-side secret storage. Do not place real keys in client-side code, public repositories or logs.
Gateway endpoint reference.
| Method | Path | Purpose |
|---|---|---|
| POST | /payment/gateway/order/createOrder | Create a physical-goods order. |
| POST | /payment/gateway/order/createVirtualOrder | Create a virtual-product order. |
| POST | /payment/gateway/order/createPayment | Create and submit a direct payment. |
| GET | /payment/gateway/order/list | List orders. |
| GET | /payment/gateway/order/{orderNo} | Retrieve a specific order. |
| POST | /payment/gateway/order/updateShipNo | Update shipping reference and carrier. |
| POST | /payment/gateway/order/refund | Request a refund. |
| GET | /payment/gateway/order/refund/{merchantRefundNo} | Retrieve a refund by merchant refund reference. |
| GET | /payment/gateway/order/refund/list | Retrieve refunds by original order or platform ID. |
Prepare an order request.
| Field group | Implementation notes |
|---|---|
| Order identifiers | Use order_no and invoice_id within their documented length limits. Keep merchant and platform references associated in your system. |
| Amount and currency | Send amount as a decimal string and currency as a three-character ISO 4217 code. Confirm your enabled currencies. |
| Product body | body is a JSON-array string. Each item includes a unique sku, name, string price and positive integer qty. The array cannot be empty. |
| Return and notification URLs | return_uri is the browser return location; notify_url receives server notifications. Do not equate a browser return with a confirmed successful payment. |
| Customer details | Physical orders require billing and contact information. The virtual-order flow uses a different required-field set; confirm the schema before implementation. |
| Payment choice | way_type is CARD or WALLET. For wallets, send the enabled way_code; Apple Pay and Google Pay use APPLE_PAY and GOOGLE_PAY. |
| Direct card payment | createPayment accepts holder_name, card_number, card_expire_month, card_expire_year and security_code for CARD payments, plus required browser context. Confirm your PCI responsibilities before using this flow. |
Redirect and direct-payment flows.
Complete
For the redirect flow, use the returned bsiteUrl. For direct payments, follow the direct-payment response and any required authentication steps.
Confirm
Process verified callbacks and use the order query to resolve status. Reconcile the result with your own order before fulfillment.
Verify payment and refund notifications.
The recommended callback is a JSON POST to notify_url. Payment event types are order.payment.success and order.payment.fail; refunds use order.refund.
- Read the JSON body and exclude the
tokenandsignfields. - Sort the remaining field names lexicographically and omit null values.
- Join the fields as
key=value&key=value, then appendappKeydirectly. - Calculate HMAC-SHA256 using
secretKeyand encode the result as lowercase hexadecimal. - Compare against the supplied
signbefore processing the event. Handle repeated notifications without repeating fulfillment.
Legacy query parameters may also be present. Use the recommended JSON-body signature for the new callback flow. Confirm exact field-string serialization against test callbacks before launch.
Track the refund lifecycle.
Send the original order reference or platform ID, amount, original currency and reason. A unique merchantRefundNo is strongly recommended for idempotency and lookup.
REFUNDINGREFUNDEDREFUND_FAILREFUND_TIMEOUT
The manual’s sample responses use string refund statuses, although some query-field tables label them as integers. Confirm the response contract in testing. A refund request is not the same as a completed refund.
Discuss technical requirements ↗