# SL DEMON Payment Gateway — API endpoint starter

## Important
This package is a **demo-only PHP endpoint scaffold**. It does not collect money, connect to Google Pay/Paytm/FamPay, verify a real payment, issue merchant API credentials, or process refunds. Do not treat a browser redirect, screenshot, or client-supplied status as proof of payment.

## Requirements
- PHP 8.1+
- PDO and PDO_SQLite extensions
- HTTPS when hosted
- Set a long random `SL_DEMON_API_KEY` environment variable on the server. Send it as `X-API-Key` for protected demo routes. Never put the key in browser JavaScript or a public repository.

## Routes
| Method | Route | Purpose |
|---|---|---|
| POST | `/api/v1/order/create.php` | Creates a local pending demo order |
| GET | `/api/v1/order/status.php?order_id=...` | Reads local demo order status |
| POST | `/api/v1/payment/verify.php` | Reports current status; never approves payment |
| GET | `/api/v1/payment/providers.php` | Lists provider placeholders |
| POST | `/api/v1/payment/callback.php` | Disabled placeholder |
| POST | `/api/v1/payment/webhook.php` | Disabled placeholder |
| POST | `/api/v1/payment/refund.php` | Disabled placeholder |

## Create order example
```bash
curl -X POST https://your-host.example/api/v1/order/create.php \\
  -H 'Content-Type: application/json' \\
  -H 'X-API-Key: YOUR_SERVER_SIDE_DEMO_KEY' \\
  -d '{"amount":"125.50","currency":"INR","provider":"paytm"}'
```

## PHP hosting
Upload the project, enable PDO_SQLite, and ensure `storage/` is writable by the PHP process but not publicly accessible. The included `.htaccess` blocks direct storage access on Apache. For Nginx, add an equivalent deny rule.

## Before any real payment integration
A responsible adult/business account owner must handle merchant onboarding, eligibility, legal/compliance checks and provider credentials. Confirm official merchant API availability for the exact product and country. Then implement the provider's documented server-to-server order creation, signature verification, webhook authentication, idempotency, reconciliation, refund flow, logging and rate limits. Google Pay may be a UPI payment app rather than a standalone merchant gateway; provider capability differs by product. Do not invent provider URLs or API keys.