Unschedule Payment
Introduction
Understanding Token
Token Flags
token_flag parameter to define the Transaction Context. This tells our system who is triggering the payment and whether the billing amount is fixed or variable.Customer-Initiated Transactions (CIT)
| Flag | Full name | Amount | Use case | API Endpoint |
|---|---|---|---|---|
CITI_FLEX | CIT Initial | Variable | Customer saves their method for future purchases with varying amounts. | Link Account, Link Card |
CITU_FLEX | CIT Unscheduled | Variable | Customer makes a one-time payment using a previously saved method. | Payment |
Merchant-Initiated Transactions (MIT)
| Flag | Full name | Amount | Use case | API Endpoint |
|---|---|---|---|---|
CITO_FLEX | CIT Other | Variable | Customer authorizes the merchant to charge variable amounts later (e.g. toll setup). | Link Account, Link Card |
MITU_FLEX | MIT Unscheduled | Variable | Merchant charges on-demand with no fixed schedule (e.g. auto-recharge for a toll card). | Payment |
Token lifecycle
Token lifecycle
How it works
ABA Account
Credit/Debit card
Link Account
Initiation: The customer selects "Link ABA Account" on your platform. Request: Your server sends a request to PayWay to initiate the account linking process. Response: PayWay returns a QR string or an ABA Mobile deep link. Display: Web: Convert the QR string into a QR code image for the user to scan. Mobile: Use the deep link to automatically launch the ABA Mobile app. Authorization: Once redirected or after scanning, the user selects their preferred ABA account and authorizes the link within the app. Tokenization: PayWay generates a secure payment token and sends it to your server via the callback_url. Storage: Store this token securely to enable seamless, one-click purchases in the future.
Link Account Flow
1.
2.
3.
4.
5.
6.
7.
This flow supports both Customer-Initiated and Merchant-Initiated unscheduled transactions.
1.
2.
3.
4.
5.
6.
callback_url.7.
Set up your UI
Integration Steps
Linking Process
Link ABA Account
Link Credit/Debit Card
To allow your customers to link their ABA account on your platform, use the Link Account API. Below is a sample of a successful API response:
{
"status": {
"code": "00",
"message": "Success",
"trace_id": "bce9c83c-922e-4672-87f5-7f92cd15047c"
},
"data": {
"deeplink": "abamobilebank://ababank.com?type=account_on_file&qrcode=ABA...gFses",
"qr_string": "ABAAOF+hEGxkym...6SbF19enqLB2xU46jTzVY",
"expire_in": 1627113926
}
}Web Browser
Mobile Browser
Android
iOS
Display a QR code using
qr_string for customers to scan with ABA Mobile and authorise the account linking.Callback handling
callback_url. This allows your system to capture the linking status and store the necessary tokens for future transactions.callback_url passed dynamically as a request parameter; however, if this parameter is absent, the system defaults to the callback_url configured within your Outlet Profile > Services > Credential on File.To ensure a successful handshake between PayWay and your server, your endpoint must adhere to the following specifications:
{
"request_id": "175317626731593",
"payment_credential": {
"ctid": "64513556cc930062e8cb3ae59eee8fbf459c53e",
"pwt": "6451355C97035CDE21FB13..E0945C21007136F3D423A1B",
"source_of_fund": "*****5312",
"type": "ABA ACCOUNT",
"status": 1,
"expired_at": "2025-10-20T08:20:03",
"token_flag": "CITI_FLEX",
"frequency": "",
"subscribed_amount": 0.0,
"amount_limit_per_tran": 0.0,
"currency": "USD",
}
}stringYour original requst ID.
objectstringYour consumer identification number.
stringPWT (PayWay Token) is a unique token automatically generated by the PayWay system and is used to complete the purchase..
stringThis field displays either the card number or the ABA account number, depending on the payer's selected payment method. For security reasons, the number is masked and only the last 4 digits are shown.
stringVisa - Visa cardMC - MastercardCUP - UnionPay cardJCB - JCB cardABA ACCOUNT - ABA Accountnumber0 - Token has been removed.1 - Token is active.2 - Token has been frozen.stringExpiry date of the token.
stringPossible values:
CITI_FLEX, CITO_FLEX.stringAlways return empty string for token flag is
CITI_FLEX or CITO_FLEX.numberAlways return
0 for token flag CITI_FLEX or CITO_FLEX.numberToken payment amount limit per transaction.
stringPayment amount limit transaction currency. Possible value
KHR or USD.Important Note
Purchase using token
To perform purchase using the token, please follow the specification of Payment API.Once the customer completes the payment, PayWay will send the transaction details and other important information to the If If you provide a custom Your Accept the HTTP POST method Accept Content-Type: application/json 💡 We highly recommend securing this URL to ensure that only PayWay has access to it. Sample Pushback Data
tran_id
Transaction ID sent during the initial payment process.
apv
Transaction approval code.
status
Payment status
For security purposes, PayWay includes a hash signature in the request header.
You should verify this signature to confirm that the callback was sent by PayWay and that the data has not been modified. Below is an example in PHP demonstrating how to: Read the callback data Generate the signature Compare it with the signature received in the header PHP Example You should receive a real-time callback response within 3 seconds. If you do not receive a response, we recommend using the Check transaction API to verify the payment status.
callback_url.callback_url is not provided in the request, PayWay will use the default callback_url configured in the API Settings.callback_url, make sure the domain is whitelisted in your merchant profile.callback_url endpoint must:{
"tran_id": "6605586317",
"apv": "541181",
"status": 0
}stringTransaction ID sent during the initial payment process.
stringTransaction approval code.
numberPayment status
Verify Callback Signature
You should verify this signature to confirm that the callback was sent by PayWay and that the data has not been modified.
1.
2.
3.
// Read request body
$response = json_decode(file_get_contents('php://input'), true);
$secretKey = "YOUR_SECRET_KEY";
// 1. Sort fields by key (ascending)
ksort($response);
// 2. Concatenate all values
$b4hash = '';
foreach ($response as $value) {
if (is_array($value)) {
$value = json_encode($value);
}
$b4hash .= $value;
}
// 3. Generate HMAC-SHA512 signature
$signature = base64_encode(
hash_hmac('sha512', $b4hash, $secretKey, true)
);
// 4. Get signature from request header
$receivedSignature = $_SERVER['HTTP_X_PAYWAY_HMAC_SHA512'] ?? '';
// 5. Compare signatures
if (hash_equals($signature, $receivedSignature)) {
// Valid request – process the notification
} else {
// Invalid request
http_response_code(401);
exit('Invalid signature');
}