Fondy Integration: Hosted Page, Webhooks, Recurring & Split Payments

Ukraine payment acceptance via Fondy? We often handle requests to integrate Fondy — a popular EU-licensed payment gateway. Fondy supports Visa, Mastercard, Google Pay, Apple Pay, and local methods (Privat24, MONO, Ukrbank). Fondy API reference is available in Russian and English, REST API is stable. A common mistake is incorrect signature generation, which leads to transaction rejection. Another is a missed callback due to wrong webhook configuration. In this article, we break down key scenarios: request signing, Fondy webhook handling, avoiding duplicate orders, and provide working Fondy PHP integration solutions. Based on our experience with over 50 integrations, we provide typical solutions that cut implementation time by 3x compared to self-development, reducing costs by $500 on average. According to Fondy API Reference, consider transaction fees charged by the gateway — keep that in mind for calculations. Our certified engineers guarantee 99.9% uptime.

What Problems Does Fondy Integration Solve?

• Request signing: wrong parameter order or missing ksort breaks signature verification.
• Webhook handling: callback forgery vulnerability with weak signature checks.
• Order duplication: repeated order_id causes transaction rejection; need uniqueness mechanism.
• Refunds: partial refunds require correct amount calculation in kopecks.
• Fondy recurring payments: for subscriptions, you need to store the card token.

Choosing a Fondy Integration Method

Choice depends on UX requirements and implementation time. Hosted Page Fondy is the fastest: redirect to Fondy's payment page. Checkout JS provides an embedded form on your site, giving full UI control. API direct offers maximum flexibility but takes longer to implement.

Hosted Page is the optimal start; Checkout JS for maximum UX.

How We Integrate Fondy: Hosted Page Case Study

The fastest method is redirecting to Fondy's payment page. Hosted Page integrates in 2-3 days, 3-5 times faster than API direct. Our engineers implemented this for an online store with 5000 orders per month, reducing payment failures by 20%. Here's the key block:

function buildFondyPayment(int $orderId, int $amountInKopecks, string $currency = 'UAH'): array { $merchantId = env('FONDY_MERCHANT_ID'); $secretKey = env('FONDY_SECRET_KEY'); $params = [ 'merchant_id' => $merchantId, 'order_id' => $orderId . '_' . time(), 'order_desc' => "Order #{$orderId}", 'amount' => $amountInKopecks, 'currency' => $currency, 'response_url' => 'https://your-callback-url.com/return', // Replace with your actual response URL 'server_callback_url' => 'https://your-callback-url.com/webhook/fondy', // Replace with your actual webhook URL 'lang' => 'en', ]; ksort($params); $signString = $secretKey . '|' . implode('|', array_values($params)); $params['signature'] = sha1($signString); return $params; } 

Then POST to https://pay.fondy.eu/api/checkout/url/ and get checkout_url for redirect. Alternatively, use an HTML form POST to https://pay.fondy.eu/api/checkout/redirect/.

Handling Webhooks Without Signature Mistakes

Critically important — verify signature in the callback. Below is a reliable handler:

public function handleCallback(Request $request): Response { $data = $request->all(); $received = $data['signature']; unset($data['signature']); $data = array_filter($data, fn($v) => $v !== '' && $v !== null); ksort($data); $expected = sha1(env('FONDY_SECRET_KEY') . '|' . implode('|', array_values($data))); if (!hash_equals($expected, $received)) { return response('Bad signature', 403); } if ($data['order_status'] === 'approved') { $orderId = (int) explode('_', $data['order_id'])[0]; Order::where('id', $orderId)->update([ 'status' => 'paid', 'transaction_id' => $data['payment_id'], ]); } return response()->json(['response' => 'accept']); } 

Statuses: approved, declined, expired, processing, reversed. Never trust unverified callbacks.

Importance of ksort Before Signing

Fondy requires strict parameter ordering for signature generation. Skipping ksort will result in an invalid signature. Even an extra space or order differing from the documentation will cause errors. Always perform ksort after assembling parameters and before concatenation.

Embedded Checkout JS Form

If you prefer not to redirect the user away, use Fondy checkout JS. The script loads from Fondy servers, and the signature is generated server-side:

<script src="https://pay.fondy.eu/static_common/v1/checkout/ipsp.js"></script> 

$ipsp.get('checkout').config({ merchantId: FONDY_MERCHANT_ID, amount: 1500, currency: 'UAH', orderId: 'order-12345', orderDesc: 'Test order', signature: serverGeneratedSignature, lang: 'en', fields: false, fee: false, theme: { preset: 'silver', }, }); 

Important: never pass secret_key to the client — signature is created only server-side.

Refunds and Partial Refunds (Fondy Refunds)

To cancel a transaction, use the API:

$params = [ 'merchant_id' => env('FONDY_MERCHANT_ID'), 'order_id' => $originalOrderId, 'amount' => 75000, // partial refund 'currency' => 'UAH', 'comment' => 'Customer request', ]; ksort($params); $params['signature'] = sha1(env('FONDY_SECRET_KEY') . '|' . implode('|', array_values($params))); Http::post('https://pay.fondy.eu/api/reverse/order/', ['request' => $params]); 

Note: amount in kopecks, currency required.

Integration Process and Timelines

Basic Hosted Page integration takes 2-5 business days. Cost is calculated individually based on complexity (Checkout JS, Fondy split payments, custom logic). We'll assess your project free of charge — just contact us.

What We Deliver

• Full API documentation and integration guide
• Access to staging environment for testing
• 30-day post-launch support and monitoring
• Performance tuning for high-volume transactions

Typical Mistakes and How to Avoid Them

• Duplicate order_id: always add timestamp/UUID to the order ID.
• Incorrect ksort: signature is built from values sorted by key — use ksort before concatenation.
• Ignoring callback: even if the client redirects successfully, the final status comes via webhook — handle both.
• Secret key in client code: never pass secret_key to the frontend.

Our experience of over 50 integrations ensures stable operation and complete documentation. Order Fondy integration today as a turnkey solution (под ключ) within 2-10 business days. Get a free quote — we'll assess your project within a day.