API specification

• Content-Type:

application/x-www-form-urlencoded

application/json

application/xml

Request data

Specific embed_data's fields

Create authentication information

mac = HMAC(hmac_algorithm, key1, hmac_input)

Trong đó:

• hmac_algorithm: is a security method registered by Merchant with ZaloPay, the default is HmacSHA256
• key1: Mac Key provided by ZaloPay at registration
• hmac_input: app_id +”|”+ app_trans_id +”|”+ app_user +”|”+ amount +"|"+ app_time +”|”+ embed_data +"|"+ item +"|"+ paymentCodeRaw

Response data

• Content-Type: application/json

Sample code

/**
 * .Net core 2.1.505
 */
using System;
using System.Text;
using System.Collections.Generic;
using System.Threading.Tasks;
using ZaloPay.Helper; // HmacHelper, RSAHelper, HttpHelper, Utils (download at DOWNLOADS page)
using ZaloPay.Helper.Crypto;
using Newtonsoft.Json; // https://www.newtonsoft.com/json

namespace ZaloPayExample
{
    class Program
    {
        static string app_id = "2553";
        static string key1 = "PcY4iZIKFCIdgZvA6ueMcMHHUbRLYjPL";
        static string quickPayUrl = "https://sb-openapi.zalopay.vn/v2/quick_pay";
        static string rsaPublicKey = "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAMsHyik+FG0NjTxCu3yHTo8EczhRIlZA6Y1IE0yTGEOwfqN4hD2prbrO0HxaWrVBUjHholVyhkmGpMm56vGHQ7UCAwEAAQ==";

        static async Task Main(string[] args)
        {
            var transid = Guid.NewGuid().ToString(); 
            var embed_data = new { merchantinfo = "embed_data123" };
            var items = new []{
                new { itemid = "knb", itemname = "kim nguyen bao", itemprice = 198400, itemquantity = 1 }
            };
            var paymentCodeRaw = "174830909300000096"; 
            var param = new Dictionary<string, string>();

            param.Add("app_id", app_id);
            param.Add("app_user", "demo");
            param.Add("app_time", Utils.GetTimeStamp().ToString());
            param.Add("amount", "1000");
            param.Add("app_trans_id", DateTime.Now.ToString("yyMMdd") + "_" + transid);
            param.Add("embed_data", JsonConvert.SerializeObject(embed_data));
            param.Add("item", JsonConvert.SerializeObject(items));
            param.Add("description", "ZaloPay QickPay Demo");
            param.Add("payment_code", RSAHelper.Encrypt(paymentCodeRaw, rsaPublicKey)); 
            param.Add("order_code", "GOODS");

            var data = app_id + "|" + param["app_trans_id"] + "|" + param["app_user"] + "|" + param["amount"] + "|" 
                + param["app_time"] + "|" + param["embed_data"] + "|" + param["item"] + "|" + paymentCodeRaw;
            param.Add("mac", HmacHelper.Compute(ZaloPayHMAC.HMACSHA256, key1, data));

            var result = await HttpHelper.PostFormAsync(quickPayUrl, param);

            foreach(var entry in result) {
                Console.WriteLine("{0} = {1}", entry.Key, entry.Value);
            }
        }
    }
}

// Java version "1.8.0_201"
import org.apache.http.NameValuePair; // https://mvnrepository.com/artifact/org.apache.httpcomponents/httpclient
import org.apache.http.client.entity.UrlEncodedFormEntity;
import org.apache.http.client.methods.CloseableHttpResponse;
import org.apache.http.client.methods.HttpPost;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.message.BasicNameValuePair;
import org.json.JSONObject; // https://mvnrepository.com/artifact/org.json/json
import vn.zalopay.crypto.HMACUtil; // download at DOWNLOADS page
import vn.zalopay.crypto.RSAUtil; // download at DOWNLOADS page

import java.io.BufferedReader;
import java.io.InputStreamReader;
import java.text.SimpleDateFormat;
import java.util.*;
import java.util.logging.Logger;

public class QuickPay {
    private static Logger logger = Logger.getLogger(App.class.getName());

    private static Map<String, String> config = new HashMap<String, String>(){{
        put("app_id", "2553");
        put("key1", "PcY4iZIKFCIdgZvA6ueMcMHHUbRLYjPL");
        put("key2", "kLtgPl8HHhfvMuDHPwKfgfsY4Ydm9eIz");
        put("endpoint", "https://sb-openapi.zalopay.vn/v2/quick_pay");
        put("publicKey", "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAOfB6/x0b5UiLkU3pOdcnXIkuCSzmvlVhDJKv1j3yBCyvsgAHacVXd+7WDPcCJmjSEKlRV6bBJWYam5vo7RB740CAwEAAQ==");
    }};

    private static String getCurrentTimeString(String format) {
        Calendar cal = new GregorianCalendar(TimeZone.getTimeZone("GMT+7"));
        SimpleDateFormat fmt = new SimpleDateFormat(format);
        fmt.setCalendar(cal);
        return fmt.format(cal.getTimeInMillis());
    }

    public static void main( String[] args ) throws Exception
    {
        final Map embed_data = new HashMap(){{
            put("merchantinfo", "embed_data123");
        }};

        final Map[] item = {
            new HashMap(){{
                put("itemid", "knb");
                put("itemname", "kim nguyen bao");
                put("itemprice", 198400);
                put("itemquantity", 1);
            }}
        };

        final String paymentCodeRaw = "977254910200000006"; // được scan từ ứng dụng ZaloPay bởi thiết bị đầu cuối của Merchant

        Map<String, Object> order = new HashMap<String, Object>(){{
            put("app_id", config.get("app_id"));
            put("app_trans_id", getCurrentTimeString("yyMMdd") +"_"+ UUID.randomUUID()); // translation missing: en.docs.shared.sample_code.comments.app_trans_id
            put("app_time", System.currentTimeMillis()); // miliseconds
            put("app_user", "demo");
            put("amount", 50000);
            put("description", "ZaloPay Intergration Demo");
            put("item", new JSONObject(item).toString());
            put("embed_data", new JSONObject(embed_data).toString());
            put("userip", "127.0.0.1");
            put("payment_code", RSAUtil.encrypt(config.get("publicKey"), paymentCodeRaw));
        }};

        // app_id +”|”+ app_trans_id +”|”+ app_user +”|”+ amount +"|" + app_time +”|”+ embed_data +"|" +item
        String data = order.get("app_id") +"|"+ order.get("app_trans_id") +"|"+ order.get("app_user") +"|"+ order.get("amount")
                +"|"+ order.get("app_time") +"|"+ order.get("embed_data") +"|"+ order.get("item") +"|"+ paymentCodeRaw;
        order.put("mac", HMACUtil.HMacHexStringEncode(HMACUtil.HMACSHA256, config.get("key1"), data));

        CloseableHttpClient client = HttpClients.createDefault();
        HttpPost post = new HttpPost(config.get("endpoint"));

        List<NameValuePair> params = new ArrayList<>();
        for (Map.Entry<String, Object> e : order.entrySet()) {
            params.add(new BasicNameValuePair(e.getKey(), e.getValue().toString()));
        }

        post.setEntity(new UrlEncodedFormEntity(params));

        CloseableHttpResponse res = client.execute(post);
        BufferedReader rd = new BufferedReader(new InputStreamReader(res.getEntity().getContent()));
        StringBuilder resultJsonStr = new StringBuilder();
        String line;

        while ((line = rd.readLine()) != null) {
            resultJsonStr.append(line);
        }

        JSONObject result = new JSONObject(resultJsonStr.toString());
        for (String key : result.keySet()) {
            System.out.format("%s = %s\n", key, result.get(key));
        }
    }
}

// go version go1.11.1 linux/amd64
package main

import (
    "crypto/rand"
    "crypto/rsa"
    "encoding/base64"
    "encoding/json"
    "fmt"
    "io/ioutil"
    "log"
    "net/http"
    "net/url"
    "strconv"
    "time"

    "github.com/google/uuid" // go get github.com/google/uuid
    "github.com/zpmep/hmacutil" // go get github.com/zpmep/hmacutil
    "github.com/zpmep/rsautil" // go get github.com/zpmep/rsautil
)

var (
    endpoint = "https://sb-openapi.zalopay.vn/v2/quick_pay"
    app_id    = "2553"
    key1     = "PcY4iZIKFCIdgZvA6ueMcMHHUbRLYjPL"
    key2     = "kLtgPl8HHhfvMuDHPwKfgfsY4Ydm9eIz"
)
var rsaPublicKey = []byte(`
-----BEGIN PUBLIC KEY-----
MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAMsHyik+FG0NjTxCu3yHTo8EczhRIlZA6Y1IE0yTGEOwfqN4hD2prbrO0HxaWrVBUjHholVyhkmGpMm56vGHQ7UCAwEAAQ==
-----END PUBLIC KEY-----
`)

func check(err error) {
    if err != nil {
        log.Fatal(err)
    }
}

type object map[string]interface{}

func main() {
    embed_data, _ := json.Marshal(object{
        "merchantinfo": "embed_data123",
    })
    items, _ := json.Marshal([]object{
        object{"itemid": "knb", "itemname": "kim nguyen bao", "itemprice": 198400, "itemquantity": 1},
    })
    params := make(url.Values)
    params.Add("machineid", app_id)
    params.Add("app_id", app_id)                         
    params.Add("amount", "1000")                       
    params.Add("app_user", "dungpqt@vng.com.vn")        
    params.Add("embed_data", string(embed_data))         
    params.Add("item", string(items))                  
    params.Add("description", "ZaloPay Quickpay Demo") 

    pub, err := rsautil.BytesToPublicKey(rsaPublicKey)
    check(err)

    paymentCodeRaw := "215956908800000020" // được scan từ ứng dụng ZaloPay bởi thiết bị đầu cuối của Merchant
    cipherText, err := rsa.EncryptPKCS1v15(rand.Reader, pub, []byte(paymentCodeRaw))
    check(err)

    payment_code := base64.StdEncoding.EncodeToString(cipherText)
    params.Add("payment_code", payment_code)

    ip := "127.0.0.1"
    params.Add("userip", ip)

    now := time.Now()
    params.Add("app_time", strconv.FormatInt(now.UnixNano()/int64(time.Millisecond), 10)) // miliseconds

    transid := uuid.New().String()                                                                                 // unique id
    params.Add("app_trans_id", fmt.Sprintf("%02d%02d%02d_%v", now.Year()%100, int(now.Month()), now.Day(), transid)) // translation missing: en.docs.shared.sample_code.comments.app_trans_id

    data := fmt.Sprintf("%v|%v|%v|%v|%v|%v|%v|%v", params.Get("app_id"), params.Get("app_trans_id"), params.Get("app_user"),
        params.Get("amount"), params.Get("app_time"), params.Get("embed_data"), params.Get("item"), paymentCodeRaw)
    params.Add("mac", hmacutil.HexStringEncode(hmacutil.SHA256, key1, data))

    // Content-Type: application/x-www-form-urlencoded
    res, err := http.PostForm(endpoint, params)
    check(err)

    // parse response
    defer res.Body.Close()

    body, _ := ioutil.ReadAll(res.Body)

    log.Printf("%+v", string(body))
}

// Node v10.15.3
const NodeRSA = require('node-rsa'); // npm install node-rsa
const axios = require('axios').default; // npm install axios
const CryptoJS = require('crypto-js'); // npm install crypto-js
const uuid = require('uuid/v1'); // npm install uuid
const moment = require('moment'); // npm install moment

// APP INFO
const config = {
  app_id: "2553",
  key1: "PcY4iZIKFCIdgZvA6ueMcMHHUbRLYjPL",
  key2: "kLtgPl8HHhfvMuDHPwKfgfsY4Ydm9eIz",
  endpoint: "https://sb-openapi.zalopay.vn/v2/quick_pay"
};

config.rsaPublicKey = `
-----BEGIN PUBLIC KEY-----
MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAMsHyik+FG0NjTxCu3yHTo8EczhRIlZA6Y1IE0yTGEOwfqN4hD2prbrO0HxaWrVBUjHholVyhkmGpMm56vGHQ7UCAwEAAQ==
-----END PUBLIC KEY-----
`;

const embed_data = {
  merchantinfo: "embed_data123"
};

const items = [{
  itemid: "knb",
  itename: "kim nguyen bao",
  itemprice: 198400,
  itemquantity: 1
}];

const paymentCodeRaw = "542373909900000106"; // được scan từ ứng dụng ZaloPay bởi thiết bị đầu cuối của Merchant
const key = new NodeRSA(config.rsaPublicKey, {
  encryptionScheme: 'pkcs1'
});
const payment_code = key.encrypt(paymentCodeRaw, 'base64');

const order = {
  app_id: config.app_id, 
  app_trans_id: `${moment().format('YYMMDD')}_${uuid()}`, // translation missing: en.docs.shared.sample_code.comments.app_trans_id
  app_user: "demo", 
  app_time: Date.now(), // miliseconds
  item: JSON.stringify(items), 
  embed_data: JSON.stringify(embed_data), 
  amount: 1000, 
  description: "ZaloPay Integration Demo",  
  userip: "127.0.0.1",
  payment_code,
};

// app_id|app_trans_id|app_user|amount|app_time|embed_data|item|paymentCodeRaw
const data = config.app_id + "|" + order.app_trans_id + "|" + order.app_user + "|" + order.amount + "|" +
  order.app_time + "|" + order.embed_data + "|" + order.item + "|" + paymentCodeRaw;
order.mac = CryptoJS.HmacSHA256(data, config.key1).toString();

axios.post(config.endpoint, null, { params: order })
  .then(res => {
    console.log(res.data);
  })
  .catch(err => console.log(err));

<?php

// PHP Version 7.3.3

$config = [
  "app_id" => 2553,
  "key1" => "PcY4iZIKFCIdgZvA6ueMcMHHUbRLYjPL",
  "key2" => "kLtgPl8HHhfvMuDHPwKfgfsY4Ydm9eIz",
  "endpoint" => "https://sb-openapi.zalopay.vn/v2/quick_pay",
  "publickey" => "
-----BEGIN PUBLIC KEY-----
MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAOfB6/x0b5UiLkU3pOdcnXIkuCSzmvlV
hDJKv1j3yBCyvsgAHacVXd+7WDPcCJmjSEKlRV6bBJWYam5vo7RB740CAwEAAQ==
-----END PUBLIC KEY-----
"
];

$embed_data = [
  "merchantinfo" => "embed_data123"
];
$items = [
  [ "itemid" => "knb", "itemname" => "kim nguyen bao", "itemprice" => 198400, "itemquantity" => 1 ]
];
$paymentCodeRaw = "885313909500000206";
$ok = openssl_public_encrypt($paymentCodeRaw, $encrypted, $config["publickey"]);
if (!$ok) {
  die("Can not encrypt payment_code");
}

$order = [
  "app_id" => $config["app_id"],
  "app_time" => round(microtime(true) * 1000), // miliseconds
  "app_trans_id" => date("ymd")."_".uniqid(), // translation missing: en.docs.shared.sample_code.comments.app_trans_id
  "app_user" => "demo",
  "item" => json_encode($items, JSON_UNESCAPED_UNICODE),
  "embed_data" => json_encode($embed_data, JSON_UNESCAPED_UNICODE),
  "amount" => 50000,
  "description" => "ZaloPay Intergration Demo",
  "userip" => "127.0.0.1",
  "payment_code" => base64_encode($encrypted)
];

// app_id|app_trans_id|app_user|amount|app_time|embed_data|item|paymentCodeRaw
$data = $order["app_id"]."|".$order["app_trans_id"]."|".$order["app_user"]."|".$order["amount"]
  ."|".$order["app_time"]."|".$order["embed_data"]."|".$order["item"]."|".$paymentCodeRaw;
$order["mac"] = hash_hmac("sha256", $data, $config["key1"]);

$context = stream_context_create([
  "http" => [
    "header" => "Content-type: application/x-www-form-urlencoded\r\n",
    "method" => "POST",
    "content" => http_build_query($order)
  ]
]);

$resp = file_get_contents($config["endpoint"], false, $context);
$result = json_decode($resp, true);

foreach ($result as $key => $value) {
  echo "$key: $value<br>";
}

# ruby 2.5.1p57

require 'securerandom'
require 'json'
require 'openssl' # gem install openssl
require 'net/http'
require 'base64'

# cat public_key.pem
#
# -----BEGIN PUBLIC KEY-----
# MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAOfB6/x0b5UiLkU3pOdcnXIkuCSzmvlV
# hDJKv1j3yBCyvsgAHacVXd+7WDPcCJmjSEKlRV6bBJWYam5vo7RB740CAwEAAQ==
# -----END PUBLIC KEY-----

config = {
  app_id: '2553',
  key1: 'PcY4iZIKFCIdgZvA6ueMcMHHUbRLYjPL',
  key2: 'kLtgPl8HHhfvMuDHPwKfgfsY4Ydm9eIz',
  endpoint: 'https://sb-openapi.zalopay.vn/v2/quick_pay',
  publickey: 'public_key.pem'
}

app_time = (Time.now.to_f.round(3) * 1000).to_i
app_trans_id = Time.now.strftime('%y%m%d') + '_' + SecureRandom.uuid

embed_data = {
  merchantinfo: 'embed_data123'
}
items = [{
  itemid: 'knb',
  itemname: 'kim nguyen bao',
  itemprice: 198_400,
  itemquantity: 1
}]

pubkey = OpenSSL::PKey::RSA.new(File.read(config[:publickey]))

paymentCodeRaw = '508920910200000017'
encrypted = pubkey.public_encrypt(paymentCodeRaw)

order = {
  app_id: config[:app_id],
  app_trans_id: app_trans_id, # translation missing: en.docs.shared.sample_code.comments.app_trans_id
  app_user: 'demo',
  app_time: app_time, # miliseconds
  item: items.to_json, 
  embed_data: embed_data.to_json, 
  amount: 50_000, 
  description: 'ZaloPay Integration Demo', 
  userip: '127.0.0.1',
  payment_code: Base64.urlsafe_encode64(encrypted)
}

# app_id|app_trans_id|app_user|amount|app_time|embed_data|item
data = config[:app_id] + '|' + app_trans_id + '|' + order[:app_user] + '|' + order[:amount].to_s + '|' +
       order[:app_time].to_s + '|' + order[:embed_data].to_s + '|' + order[:item].to_s + '|' + paymentCodeRaw

order[:mac] = OpenSSL::HMAC.hexdigest('sha256', config[:key1], data)

res = Net::HTTP.post_form(URI.parse(config[:endpoint]), order)
result = JSON.parse(res.body)

result.each do |key, value|
  puts "#{key}: #{value}"
end

# coding=utf-8
# Python 3.6

from time import time
from datetime import datetime

import uuid, json, hmac, hashlib, urllib.request, urllib.parse, base64

from Crypto.PublicKey import RSA # pip3 install pycrypto
from Crypto.Cipher import PKCS1_v1_5
from Crypto import Random

config = {
  "app_id": 2553,
  "key1": "PcY4iZIKFCIdgZvA6ueMcMHHUbRLYjPL",
  "key2": "kLtgPl8HHhfvMuDHPwKfgfsY4Ydm9eIz",
  "endpoint": "https://sb-openapi.zalopay.vn/v2/quick_pay"
}

# Public key lấy ở trang quản lý app của merchant
config["rsaPublicKey"] = "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAMsHyik+FG0NjTxCu3yHTo8EczhRIlZA6Y1IE0yTGEOwfqN4hD2prbrO0HxaWrVBUjHholVyhkmGpMm56vGHQ7UCAwEAAQ=="

# RSA encrypt payment_code
paymentCodeRaw = "542373909900000106" # được scan từ ứng dụng ZaloPay bởi thiết bị đầu cuối của Merchant

keyPub = RSA.importKey(base64.b64decode(config["rsaPublicKey"]))
cipher = PKCS1_v1_5.new(keyPub)

cipherText = cipher.encrypt(paymentCodeRaw.encode())
payment_code = base64.b64encode(cipherText)

order = {
  "app_id": config["app_id"],
  "app_trans_id": "{:%y%m%d}_{}".format(datetime.today(), uuid.uuid4()), # translation missing: en.docs.shared.sample_code.comments.app_trans_id
  "app_user": "demo",
  "app_time": int(round(time() * 1000)), # miliseconds
  "embed_data": json.dumps({ 
    "merchantinfo": "embed_data123"
  }),
  "item": json.dumps([
    { "itemid": "knb", "itemname": "kim nguyen bao", "itemprice": 198400, "itemquantity": 1 }
  ]),
  "amount": 50000,
  "description": "ZaloPay Integration Demo",
  "userip": "127.0.0.1",
  "payment_code": payment_code
}

# app_id|app_trans_id|app_user|amount|app_time|embed_data|item|paymentCodeRaw
data = "{}|{}|{}|{}|{}|{}|{}|{}".format(order["app_id"], order["app_trans_id"], order["app_user"], 
order["amount"], order["app_time"], order["embed_data"], order["item"], paymentCodeRaw)

# tính mac
order["mac"] = hmac.new(config['key1'].encode(), data.encode(), hashlib.sha256).hexdigest()

response = urllib.request.urlopen(url=config["endpoint"], data=urllib.parse.urlencode(order).encode())
result = json.loads(response.read())

for k, v in result.items():
  print("{}: {}".format(k, v))

curl -X POST https://sb-openapi.zalopay.vn/v2/quick_pay \
  -H "Content-type: application/x-www-form-urlencoded" \
  -d app_id=2553 \
  -d app_trans_id=190419_56355af0-624a-11e9-8cbe-2bcce7cb9c36 \
  -d app_user=demo \
  -d app_time=1555640702494 \
  -d item='[{"itemid":"knb","itemname":"kim nguyen bao","itemprice":198400,"itemquantity":1}]' \
  -d embed_data='{"merchantinfo":"embed_data123"}' \
  -d amount=1000 \
  -d description='ZaloPay Intergration Demo' \
  -d userip=127.0.0.1 \
  -d payment_code=W0QduaBV3oeAFp%2BV0Hhp8Pyoqt3s7TjryXWH8upqTK4bl1dJv431SKNwqumQyKgMxU%2FsM2SPaYjWUeiMOBoUsw%3D%3D \
  -d mac=ddf063288219e3d82d4058faf7403b436e20a8324ba3d6b29cff85060b19f413