eSewa Payment Integration in Laravel 12: Complete Step-by-Step Guide with Signature Verification

# eSewa v2 Sandbox Credentials (Official Test Keys)
ESEWA_PRODUCT_CODE=EPAYTEST
ESEWA_SECRET_KEY=8gBm/:&EnhH.1/q
ESEWA_GATEWAY_URL=https://rc-epay.esewa.com.np/api/epay/main/v2/form
ESEWA_VERIFICATION_URL=https://rc-epay.esewa.com.np/api/epay/transaction/status/
ESEWA_SUCCESS_URL=http://localhost:8000/payment/esewa/success
ESEWA_FAILURE_URL=http://localhost:8000/payment/esewa/failure

<?php

namespace AppHttpControllers;

use IlluminateHttpRequest;
use IlluminateSupportFacadesHttp;
use IlluminateSupportStr;

class EsewaPaymentController extends Controller
{
    /**
     * Initiate checkout: generate signature and redirect to eSewa
     */
    public function initiatePayment(Request $request)
    {
        $amount = 100.00; // Total amount in NPR
        $taxAmount = 0.00;
        $totalAmount = $amount + $taxAmount;
        $transactionUuid = Str::uuid()->toString();
        $productCode = config('services.esewa.product_code', env('ESEWA_PRODUCT_CODE'));
        $secretKey = config('services.esewa.secret_key', env('ESEWA_SECRET_KEY'));

        // Format: total_amount,transaction_uuid,product_code
        $dataToSign = "total_amount={$totalAmount},transaction_uuid={$transactionUuid},product_code={$productCode}";
        $signature = base64_encode(hash_hmac('sha256', $dataToSign, $secretKey, true));

        $formData = [
            'amount' => $amount,
            'tax_amount' => $taxAmount,
            'total_amount' => $totalAmount,
            'transaction_uuid' => $transactionUuid,
            'product_code' => $productCode,
            'product_service_charge' => 0,
            'product_delivery_charge' => 0,
            'success_url' => env('ESEWA_SUCCESS_URL'),
            'failure_url' => env('ESEWA_FAILURE_URL'),
            'signed_field_names' => 'total_amount,transaction_uuid,product_code',
            'signature' => $signature,
        ];

        return view('payment.esewa_redirect', [
            'gatewayUrl' => env('ESEWA_GATEWAY_URL'),
            'formData' => $formData
        ]);
    }

    /**
     * Handle payment success callback from eSewa
     */
    public function paymentSuccess(Request $request)
    {
        $encodedData = $request->query('data');
        if (!$encodedData) {
            return redirect()->route('cart')->with('error', 'Invalid callback payload from eSewa.');
        }

        // Decode base64 response from eSewa
        $decodedJson = base64_decode($encodedData);
        $response = json_decode($decodedJson, true);

        if (!$response || !isset($response['transaction_uuid'], $response['total_amount'])) {
            return redirect()->route('cart')->with('error', 'Malformed payment confirmation payload.');
        }

        // Double check status server-side
        $verifyRes = Http::get(env('ESEWA_VERIFICATION_URL'), [
            'product_code' => env('ESEWA_PRODUCT_CODE'),
            'total_amount' => $response['total_amount'],
            'transaction_uuid' => $response['transaction_uuid'],
        ]);

        if ($verifyRes->successful() && ($verifyRes->json('status') === 'COMPLETE' || $response['status'] === 'COMPLETE')) {
            // Fulfill order in database atomically
            // Order::where('transaction_uuid', $response['transaction_uuid'])->update(['status' => 'PAID']);
            return view('payment.success', ['details' => $response]);
        }

        return redirect()->route('cart')->with('error', 'Payment verification failed with eSewa.');
    }

    public function paymentFailure(Request $request)
    {
        return view('payment.failure', ['message' => 'Transaction was cancelled or declined by eSewa.']);
    }
}

<?php

use IlluminateFoundationApplication;
use IlluminateFoundationConfigurationExceptions;
use IlluminateFoundationConfigurationMiddleware;

return Application::configure(basePath: dirname(__DIR__))
    ->withRouting(
        web: __DIR__.'/../routes/web.php',
        commands: __DIR__.'/../routes/console.php',
        health: '/up',
    )
    ->withMiddleware(function (Middleware $middleware) {
        // Exclude eSewa and Khalti callback routes from CSRF verification
        $middleware->validateCsrfTokens(except: [
            'payment/esewa/*',
            'payment/khalti/*',
        ]);
    })
    ->withExceptions(function (Exceptions $exceptions) {
        //
    })->create();