Robokassa Integration in Mobile App

Robokassa Payment Gateway Integration in Mobile Application

Robokassa does not provide native mobile SDK — integration is built via WebView or via server API with custom UI on client. This is not a disadvantage, but a feature: WebView approach is faster to implement, API approach gives full UX control.

Option 1: WebView with Robokassa Payment Form

Fastest method. Server generates payment form URL, client opens it in WebView:

https://auth.robokassa.ru/Merchant/Index.aspx
    ?MerchantLogin=your_login
    &OutSum=1500.00
    &InvId=1234
    &Description=Order #1234
    &SignatureValue=md5_signature
    &IsTest=0

Signature SignatureValue = MD5(MerchantLogin:OutSum:InvId:Password1).

// Android: open in CustomTabs for better UX
val customTabsIntent = CustomTabsIntent.Builder()
    .setShowTitle(false)
    .build()
customTabsIntent.launchUrl(context, Uri.parse(paymentUrl))

// iOS: SFSafariViewController
let safariVC = SFSafariViewController(url: URL(string: paymentUrl)!)
present(safariVC, animated: true)

To track payment completion Robokassa calls ResultURL — server callback. Configure it in Robokassa cabinet → Settings → Notifications.

Option 2: API Integration with Custom UI

Robokassa supports direct card data transmission via API (only for registered merchants with fulfilled security requirements):

POST https://auth.robokassa.ru/Merchant/Payment/CreateV2
{
    "MerchantLogin": "your_login",
    "OutSum": "1500.00",
    "InvId": "1234",
    "Description": "Order",
    "SignatureValue": "...",
    "PaymentMethod": "BankCard",
    "CardNumber": "4111111111111111",
    "CardExpiryDate": "1225",
    "CardCvv": "123"
}

If bank requires 3DS, API returns PaymentUrl to redirect to ACS page. Then — standard 3DS flow via WebView.

Getting Result: ResultURL vs SuccessURL

Robokassa distinguishes two notification types:

• ResultURL — server POST request with transaction result. Called regardless of user actions. Main way to know actual payment status.
• SuccessURL — user redirect after successful payment. Unreliable: user could close browser before redirect.

In mobile app to intercept SuccessURL use deeplink:

// SuccessURL when creating payment: yourapp://payment/success?InvId={InvId}&OutSum={OutSum}

// In Activity with intent-filter for yourapp://
override fun onNewIntent(intent: Intent?) {
    super.onNewIntent(intent)
    val uri = intent?.data ?: return
    if (uri.host == "payment" && uri.path == "/success") {
        val invId = uri.getQueryParameter("InvId")
        // Check status on server, do not trust only deeplink
        verifyPaymentOnServer(invId)
    }
}

Signature Verification on Server

Must verify signature of incoming ResultURL:

SignatureValue_incoming == MD5(OutSum:InvId:Password2)

Password2 is second Robokassa password, different from first. Skip verification — anyone can fake successful payment with GET-request to ResultURL.

Work Scope

• Server generation of payment link with signature
• WebView or CustomTabs/SFSafariViewController implementation
• Deeplink configuration for SuccessURL / FailURL handling
• Server ResultURL handler with signature verification
• Testing in Robokassa test mode

Timeline

2–3 days for WebView integration. API with custom UI — 3–4 days. Cost calculated individually.