Integrating 1C-Bitrix with PriorBank Internet Acquiring in Belarus

Integrating 1C-Bitrix with PriorBank acquiring in Belarus is a tricky task. The Computop Paygate payment gateway uses Blowfish encryption, not the familiar JSON REST API. An error in the algorithm leads to an empty response without any message, making it hard to find the cause. Our team has connected over 50 projects over 8 years, so we know every nuance. Below is a practical code guide that will save you days of debugging.

How the parameter encryption algorithm works

PriorBank uses Computop Paygate (paygate.computop.com). All request parameters are encrypted with the Blowfish algorithm in ECB mode with padding to a multiple of 8 bytes and then Base64-encoded. Additionally, HMAC-MD5 is computed for verification. This approach is fundamentally different from modern REST APIs, where data is sent in plain text or with JWT. Blowfish is faster than AES on older processors but requires strict key length compliance (up to 56 bytes). A one-byte key error results in an empty gateway response with no diagnostics.

Why URLNotify must be publicly accessible

Computop sends POST notifications to URLNotify only if the server is reachable from the internet. This is a problem for local development—localhost won't work. The solution is ngrok, which creates a temporary external URL. If notifications are not received, check that the link is not blocked by a firewall. In production, 99.9% of notifications are delivered within 1-2 seconds.

Step-by-step handler setup in Bitrix

1. Create a payment system handler in /bitrix/tools/sale_ps_result.php.
2. Obtain MerchantID, Blowfish key, and HMAC key from the bank.
3. Implement the ComputopCipher class (see listing below).
4. Generate an HTML payment form with fields MerchantID, Len, and Data.
5. Process notifications: decrypt Data, verify MAC, update order status.
6. Test in the test environment with provided test cards.
7. Switch to the production MerchantID and verify the payment.

Technical architecture and encryption

The PriorBank payment gateway is technically based on Computop Paygate. Key features:

• Parameters are transmitted encrypted — Blowfish (ECB) + Base64, plus HMAC-MD5 for verification
• The payment form redirects to the Computop page, not hosted-fields
• Notifications are synchronous via URLNotify (POST on status change) and parameters in URLSuccess/URLFailure

This integration fundamentally differs from common JSON REST APIs: all parameters are encrypted, and an encryption algorithm error results in an empty response without a clear error message.

class ComputopCipher { private string $blowfishKey; private string $merchantId; private string $hmacKey; public function __construct(string $merchantId, string $blowfishKey, string $hmacKey) { $this->merchantId = $merchantId; $this->blowfishKey = $blowfishKey; $this->hmacKey = $hmacKey; } public function encrypt(array $params): string { $queryString = http_build_query($params); $len = strlen($queryString); // Pad to multiple of 8 bytes (Blowfish ECB requirement) $pad = (8 - ($len % 8)) % 8; $queryString = str_pad($queryString, $len + $pad, "\0"); $encrypted = openssl_encrypt( $queryString, 'BF-ECB', $this->blowfishKey, OPENSSL_RAW_DATA | OPENSSL_ZERO_PADDING ); return base64_encode($encrypted); } public function decrypt(string $data): array { $decrypted = openssl_decrypt( base64_decode($data), 'BF-ECB', $this->blowfishKey, OPENSSL_RAW_DATA | OPENSSL_ZERO_PADDING ); parse_str(rtrim($decrypted, "\0"), $result); return $result; } public function getHmac(array $params): string { $data = implode('*', [ $params['PayID'] ?? '', $params['TransID'] ?? '', $this->merchantId, $params['Amount'] ?? '', $params['Currency'] ?? '', ]); return hash_hmac('md5', $data, $this->hmacKey); } } 

Generating the payment form

$cipher = new ComputopCipher($merchantId, $blowfishKey, $hmacKey); $params = [ 'MerchantID' => $merchantId, 'TransID' => 'ORDER_' . $orderId . '_' . time(), 'Amount' => (int)($orderAmount * 100), // in minor units 'Currency' => 'BYN', 'OrderDesc' => 'Order No. ' . $orderId, 'URLSuccess' => 'https://myshop.by/checkout/success/?order=' . $orderId, 'URLFailure' => 'https://myshop.by/checkout/fail/?order=' . $orderId, 'URLNotify' => 'https://myshop.by/bitrix/tools/sale_ps_result.php', 'Language' => 'ru', 'MAC' => $cipher->getHmac(['TransID' => 'ORDER_'.$orderId.'_'.time(), 'Amount' => (int)($orderAmount*100), 'Currency' => 'BYN']), ]; $encryptedData = $cipher->encrypt($params); $len = strlen(http_build_query($params)); 

HTML form for redirect:

<form method="POST" action="https://paygate.computop.com/pay/"> <input type="hidden" name="MerchantID" value="<?= $merchantId ?>"> <input type="hidden" name="Len" value="<?= $len ?>"> <input type="hidden" name="Data" value="<?= htmlspecialchars($encryptedData) ?>"> <button type="submit">Pay</button> </form> 

Processing notifications

Computop sends a POST to URLNotify with encrypted Data and Len:

// In the handler /bitrix/tools/sale_ps_result.php $encryptedData = $_POST['Data'] ?? ''; $len = (int)($_POST['Len'] ?? 0); $decrypted = $cipher->decrypt($encryptedData); parse_str(substr(http_build_query($decrypted), 0, $len), $params); // Always verify MAC $expectedMac = $cipher->getHmac($params); if (!hash_equals($expectedMac, $params['MAC'] ?? '')) { http_response_code(403); exit('Invalid MAC'); } // Success codes if (($params['Code'] ?? '') === '00000000') { $payment->setPaid('Y'); $payment->setField('PS_STATUS_CODE', $params['Code']); $payment->setField('PS_STATUS_MESSAGE', $params['Description'] ?? ''); $payment->save(); } 

Common Computop/PriorBank response codes:

Test environment

PriorBank provides a test MerchantID and test BlowfishKey. Computop test cards:

• VISA: 4200000000000000 — successful payment
• Mastercard: 5500000000000004 — successful payment
• Any card with Expiry = 1200 — decline

Important testing nuance: URLNotify must be reachable from Computop servers — localhost won't work. Use ngrok or a temporary public URL for local development.

Particularities for Belarus

• Payment currency is BYN (Belarusian ruble), ISO code 974
• Amount is passed in minor currency units (e.g., kopecks for BYN)
• For Belkart cards, a separate connection via Belkart protocol is needed — different from Computop
• Bank operating day is working days; settlements are next banking day
• Time savings on manual processing — up to 30% due to automatic fiscalization (via ATOL or SBIS)

What's included and timelines

We prepare full integration documentation, configure the payment system handler in Bitrix, set up URLNotify, perform testing in the test environment, and assist with production connection. We also train your team on basic administration. All work is delivered turnkey within 5–7 business days.

For an exact cost and timeline estimate, contact us — we'll evaluate your project individually. We guarantee post-launch support for one month. Order the integration, and we'll set up acquiring turnkey. Get a consultation: we'll answer any integration questions.

Computop Paygate API Reference — detailed parameter and error code description is available in the official documentation.

Blowfish (cipher) — Wikipedia HMAC — Wikipedia