Tài liệu API

API base: https://api.gdtguytin.xyz/api/v1/index.php

🔐 Xác thực

Mọi request cần Bearer token. Tạo trong admin/api-keys.php.

Authorization: Bearer slk_live_<40 ký tự hex>

🔗 Liên kết ngân hàng

1. Vào /admin/link-bank.php
2. Nhập STK + username IB + mật khẩu
3. Nhập OTP
4. Hệ thống lưu session đã mã hóa

GET /banks

curl -H "Authorization: Bearer slk_live_..." \
  "https://api.gdtguytin.xyz/api/v1/index.php?path=banks"

{ "object": "list", "data": [{ "id":1, "bank_code":"MBB", "bank_name":"MB Bank", "account_number":"0123", "status":"linked" }] }

GET /transactions

curl -H "Authorization: Bearer slk_live_..." \
  "https://api.gdtguytin.xyz/api/v1/index.php?path=transactions&bank_id=1"

GET /balance

curl -H "Authorization: Bearer slk_live_..." \
  "https://api.gdtguytin.xyz/api/v1/index.php?path=balance&bank_id=1"

POST /webhooks

curl -X POST -H "Authorization: Bearer slk_live_..." \
  -H "Content-Type: application/json" \
  -d '{"url":"https://your-app.com/hooks"}' \
  "https://api.gdtguytin.xyz/api/v1/index.php?path=webhooks"

🛡️ Verify HMAC

<?php
$raw=file_get_contents('php://input');
$ts=$_SERVER['HTTP_X_WEBHOOK_TIMESTAMP']??'';
$sig=$_SERVER['HTTP_X_WEBHOOK_SIGNATURE']??'';
$secret='whsec_...';
$exp='sha256='.hash_hmac('sha256',$ts.'.'.$raw,$secret);
if(!hash_equals($exp,$sig)){http_response_code(401);exit;}
if(abs(time()-(int)$ts)>300){http_response_code(401);exit;}
$data=json_decode($raw,true);
http_response_code(200);echo '{"ok":true}';

⚠️ Mã lỗi