Skip to content
ZeroKYC Pay
Get started
DocsIntegrationPricingBlogSign inGet started

SDKs: PHP, Python, Node.js

Official PHP, Python and Node.js SDKs: install, create invoices with idempotency keys and verify webhook signatures in one call.

Official SDKs wrap the ZeroKYC Pay REST API: invoice creation, webhook signature verification, idempotency and status normalization are done for you. All three are MIT-licensed, zero-dependency where possible and share the same contract and test vectors.

Installation

PHP

composer require zerokyc/zkp-sdk-php

GitHub repository: github.com/zerokyc-payments/zkp-sdk-php

Python

pip install zkp-sdk-python

GitHub repository: github.com/zerokyc-payments/zkp-sdk-python

Node.js

npm install zkp-sdk-node

GitHub repository: github.com/zerokyc-payments/zkp-sdk-node

npm / PyPI / Packagist: If the package is not yet on the registry of your ecosystem, install straight from the GitHub repository — the README of each SDK shows the one-line fallback.

Create an invoice

One call creates an invoice and returns a hosted-checkout URL. Pass an idempotency key so a timeout + retry returns the same invoice instead of a duplicate:

PHP

$zkp = new ZeroKYC(['api_key' => getenv('ZEROKYC_API_KEY'),
    'environment' => 'sandbox']);

$response = $zkp->createInvoice(
    CreateInvoiceRequest::make('19.90', 'USD')->withOrderId('INV-1042'),
    IdempotencyKey::make('myshop', 'invoice', 1042)
);
echo $response->invoice->checkoutUrl;

Python

zkp = ZeroKYC(api_key=os.environ["ZEROKYC_API_KEY"],
         environment="sandbox")

response = zkp.create_invoice(
    "19.90", "USD", order_id="INV-1042",
    idempotency_key=idempotency_key("myshop", "order", 1042))
print(response.invoice.checkout_url)

Node.js

const zkp = new ZeroKYC({
  apiKey: process.env.ZEROKYC_API_KEY,
  environment: "sandbox",
});

const response = await zkp.createInvoice({
  amount: "19.90",
  currency: "USD",
  orderId: "INV-1042",
  idempotencyKey: idempotencyKey("myshop", "order", 1042),
});
console.log(response.invoice.checkoutUrl);

Verify webhooks

Every SDK ships a constant-time verifier for the X-ZKP-Signature header with the same ±300-second replay window and byte-for-byte identical test vectors:

PHP

$event = $zkp->verifyWebhook($rawBody, $_SERVER['HTTP_X_ZKP_SIGNATURE'] ?? '');

Python

event = zkp.verify_webhook(request.body,
                           request.headers["X-ZKP-Signature"])

Node.js

const event = zkp.verifyWebhook(rawBody,
  req.header("X-ZKP-Signature") ?? "");

Never trust the browser: A success/return URL is not proof of payment. Mark an order paid only after a verified webhook or a server-side getInvoice() check, and match the invoice id, amount and asset first.

What's next