public class AuthenticationService
{
    private readonly HttpClient _httpClient;
    private readonly string _baseUrl;

    public AuthenticationService(HttpClient httpClient, string baseUrl)
    {
        _httpClient = httpClient;
        _baseUrl = baseUrl;
    }

    public async Task<AuthResponse> AuthenticateAsync(string publicKey, string secretKey)
    {
        var request = new { publicKey, secretKey };
        var json = JsonSerializer.Serialize(request);
        var content = new StringContent(json, Encoding.UTF8, "application/json");

        var response = await _httpClient.PostAsync($"{_baseUrl}/api/Account/Authenticate", content);
        var body = await response.Content.ReadAsStringAsync();

        if (!response.IsSuccessStatusCode)
        {
            var error = JsonSerializer.Deserialize<ErrorResponse>(body);
            throw new ApiException(error?.Error?.Code ?? "UNKNOWN", error?.Error?.Message ?? "Authentication failed");
        }

        var result = JsonSerializer.Deserialize<AuthResponse>(body);
        if (result == null || !result.Success)
            throw new ApiException("AUTH_FAILED", "Authentication response was unsuccessful");

        return result;
    }
}

// Usage:
var httpClient = new HttpClient();
var authService = new AuthenticationService(httpClient, "https://payo.mangir.biz");
var auth = await authService.AuthenticateAsync("your-public-key", "your-secret-key");
httpClient.DefaultRequestHeaders.Add("token", auth.Token);

<?php

function authenticate(string $publicKey, string $secretKey): string
{
    $ch = curl_init('https://payo.mangir.biz/api/Account/Authenticate');
    curl_setopt_array($ch, [
        CURLOPT_POST => true,
        CURLOPT_POSTFIELDS => json_encode([
            'publicKey' => $publicKey,
            'secretKey' => $secretKey
        ]),
        CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT => 30
    ]);

    $response = curl_exec($ch);
    $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);

    if ($httpCode !== 200) {
        throw new Exception("Authentication failed: HTTP $httpCode");
    }

    $data = json_decode($response, true);
    if (!$data['success']) {
        throw new Exception("Auth error: " . ($data['error']['message'] ?? 'Unknown'));
    }

    return $data['token'];
}

// Usage:
$token = authenticate('your-public-key', 'your-secret-key');
?>

public class WithdrawService
{
    private readonly HttpClient _httpClient;
    private readonly string _baseUrl;

    public WithdrawService(HttpClient httpClient, string baseUrl)
    {
        _httpClient = httpClient;
        _baseUrl = baseUrl;
    }

    public async Task<List<BankListItem>> GetBanksAsync(string token)
    {
        var request = new HttpRequestMessage(HttpMethod.Get, $"{_baseUrl}/api/Withdraw/Banks");
        request.Headers.Add("token", token);
        var response = await _httpClient.SendAsync(request);
        response.EnsureSuccessStatusCode();
        var body = await response.Content.ReadAsStringAsync();
        return JsonSerializer.Deserialize<List<BankListItem>>(body,
            new JsonSerializerOptions { PropertyNameCaseInsensitive = true });
    }

    public async Task<WithdrawResponse> CreateWithdrawalAsync(string token, WithdrawRequest req)
    {
        var json = JsonSerializer.Serialize(req);
        var content = new StringContent(json, Encoding.UTF8, "application/json");
        var request = new HttpRequestMessage(HttpMethod.Post, $"{_baseUrl}/api/Withdraw/Send");
        request.Headers.Add("token", token);
        request.Content = content;
        var response = await _httpClient.SendAsync(request);
        var body = await response.Content.ReadAsStringAsync();
        return JsonSerializer.Deserialize<WithdrawResponse>(body,
            new JsonSerializerOptions { PropertyNameCaseInsensitive = true });
    }
}

<?php
// Get bank list
function getBanks(string $token): array {
    $ch = curl_init('https://payo.mangir.biz/api/Withdraw/Banks');
    curl_setopt_array($ch, [
        CURLOPT_HTTPHEADER => ['Content-Type: application/json', 'token: ' . $token],
        CURLOPT_RETURNTRANSFER => true, CURLOPT_TIMEOUT => 30
    ]);
    $response = curl_exec($ch); curl_close($ch);
    return json_decode($response, true) ?? [];
}

// Create withdrawal
function createWithdrawal(string $token, array $data): array {
    $ch = curl_init('https://payo.mangir.biz/api/Withdraw/Send');
    curl_setopt_array($ch, [
        CURLOPT_POST => true, CURLOPT_POSTFIELDS => json_encode($data),
        CURLOPT_HTTPHEADER => ['Content-Type: application/json', 'token: ' . $token],
        CURLOPT_RETURNTRANSFER => true, CURLOPT_TIMEOUT => 30
    ]);
    $response = curl_exec($ch); curl_close($ch);
    return json_decode($response, true) ?? [];
}

// Usage:
$banks = getBanks($token);
$result = createWithdrawal($token, [
    'userName' => 'johndoe', 'fullName' => 'John Doe',
    'iban' => 'TR330006100519786457841326', 'amount' => 500.00,
    'bankId' => $banks[0]['id'], 'merchantOrderId' => 'WITHDRAW-001'
]);
?>

[ApiController, Route("api/[controller]")]
public class CallbackController : ControllerBase
{
    private readonly string _secretKey;

    public CallbackController(IConfiguration config)
    {
        _secretKey = config["MangirApi:SecretKey"];
    }

    [HttpPost]
    public async Task<IActionResult> HandleCallback([FromBody] CallbackRequest request)
    {
        var signature = Request.Headers["X-Mangir-Signature"].FirstOrDefault();
        var timestamp = Request.Headers["X-Mangir-Timestamp"].FirstOrDefault();

        if (!VerifySignature(request, signature, timestamp))
            return Unauthorized("Invalid signature");

        switch (request.Status)
        {
            case 2: // Completed
                await ProcessCompletedTransaction(request);
                break;
            case 3: // Rejected
                await ProcessRejectedTransaction(request);
                break;
        }

        return Ok(new { success = true });
    }

    private bool VerifySignature(CallbackRequest request, string signature, string timestamp)
    {
        if (string.IsNullOrEmpty(signature) || string.IsNullOrEmpty(timestamp)) return false;
        var signatureService = new SignatureService(_secretKey);
        return signatureService.VerifyCallback(request, signature, timestamp);
    }
}

<?php
$rawBody = file_get_contents('php://input');
$data = json_decode($rawBody, true);

$signature = $_SERVER['HTTP_X_MANGIR_SIGNATURE'] ?? '';
$timestamp = $_SERVER['HTTP_X_MANGIR_TIMESTAMP'] ?? '';

// Verify signature
if (!verifySignature($data, $signature, $timestamp, 'your-secret-key')) {
    http_response_code(401);
    die(json_encode(['error' => 'Invalid signature']));
}

// Process
switch ($data['status'] ?? 0) {
    case 2: // Completed
        // markTransactionComplete($data['orderNo'], $data['amount']);
        break;
    case 3: // Rejected
        // markTransactionRejected($data['orderNo'], $data['message']);
        break;
}

http_response_code(200);
echo json_encode(['success' => true]);
?>

public class SignatureService
{
    private readonly string _secretKey;

    public SignatureService(string secretKey) { _secretKey = secretKey; }

    public string GenerateSignature(Dictionary<string, string> data, string timestamp)
    {
        var sortedPairs = data.OrderBy(kvp => kvp.Key).Select(kvp => $"{kvp.Key}={kvp.Value}");
        var dataString = string.Join("&", sortedPairs);
        var signatureBase = $"{dataString}|{timestamp}";

        using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(_secretKey));
        var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(signatureBase));
        return Convert.ToBase64String(hash);
    }

    public bool VerifyCallback(CallbackRequest request, string signature, string timestamp)
    {
        var data = new Dictionary<string, string>
        {
            { "orderNo", request.OrderNo },
            { "merchantOrderId", request.MerchantOrderId ?? "" },
            { "status", request.Status.ToString() },
            { "transactionType", request.TransactionType.ToString() },
            { "amount", request.Amount.ToString("F2", CultureInfo.InvariantCulture) },
            { "message", request.Message ?? "" }
        };

        var expected = GenerateSignature(data, timestamp);
        return CryptographicOperations.FixedTimeEquals(
            Encoding.UTF8.GetBytes(expected), Encoding.UTF8.GetBytes(signature));
    }
}

<?php
function verifySignature(array $data, string $signature, string $timestamp, string $secretKey): bool
{
    ksort($data);
    $pairs = [];
    foreach ($data as $key => $value) { $pairs[] = "$key=$value"; }
    $dataString = implode('&', $pairs);
    $signatureBase = "$dataString|$timestamp";
    $expected = base64_encode(hash_hmac('sha256', $signatureBase, $secretKey, true));
    return hash_equals($expected, $signature);
}
?>

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.util.*;
import java.util.stream.Collectors;

public class SignatureService {
    private final String secretKey;

    public SignatureService(String secretKey) { this.secretKey = secretKey; }

    public String generateSignature(Map<String, String> data, String timestamp) throws Exception {
        String dataString = data.entrySet().stream()
            .sorted(Map.Entry.comparingByKey())
            .map(e -> e.getKey() + "=" + e.getValue())
            .collect(Collectors.joining("&"));

        String signatureBase = dataString + "|" + timestamp;
        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(secretKey.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
        byte[] hash = mac.doFinal(signatureBase.getBytes(StandardCharsets.UTF_8));
        return Base64.getEncoder().encodeToString(hash);
    }

    public boolean verifyCallback(Map<String, String> data, String signature, String timestamp) throws Exception {
        String expected = generateSignature(data, timestamp);
        return MessageDigest.isEqual(expected.getBytes(StandardCharsets.UTF_8), signature.getBytes(StandardCharsets.UTF_8));
    }
}

public static HttpClient CreateSecureClient()
{
    var handler = new HttpClientHandler
    {
        SslProtocols = System.Security.Authentication.SslProtocols.Tls12 |
                       System.Security.Authentication.SslProtocols.Tls13
    };

    var client = new HttpClient(handler) { Timeout = TimeSpan.FromSeconds(30) };
    client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
    return client;
}

public class ErrorHandlingMiddleware
{
    private readonly RequestDelegate _next;

    public ErrorHandlingMiddleware(RequestDelegate next) { _next = next; }

    public async Task InvokeAsync(HttpContext context)
    {
        try { await _next(context); }
        catch (ApiException ex)
        {
            context.Response.ContentType = "application/json";
            context.Response.StatusCode = ex.Code switch
            {
                "AUTH_001" or "AUTH_002" or "AUTH_003" or "VAL_002" => 401,
                "SEC_001" or "SEC_002" => 403,
                _ when ex.Code.StartsWith("VAL_") => 400,
                _ when ex.Code.StartsWith("BANK_") || ex.Code.StartsWith("BAL_") => 400,
                _ => 500
            };

            await context.Response.WriteAsJsonAsync(new {
                success = false, error = new { code = ex.Code, message = ex.Message }
            });
        }
        catch (Exception)
        {
            context.Response.ContentType = "application/json";
            context.Response.StatusCode = 500;
            await context.Response.WriteAsJsonAsync(new {
                success = false, error = new { code = "SYS_001", message = "An internal server error occurred." }
            });
        }
    }
}

public class TransactionTracker
{
    private readonly ConcurrentDictionary<string, TransactionRecord> _transactions = new();

    public string CreateOrder(decimal amount, string customerId)
    {
        var merchantOrderId = $"ORD-{DateTime.UtcNow:yyyyMMddHHmmss}-{Guid.NewGuid().ToString("N")[..8]}";
        _transactions[merchantOrderId] = new TransactionRecord
        {
            MerchantOrderId = merchantOrderId,
            Amount = amount,
            CustomerId = customerId,
            Status = "Pending",
            CreatedAt = DateTime.UtcNow
        };
        return merchantOrderId;
    }

    public void UpdateFromCallback(string merchantOrderId, int status, string orderNo)
    {
        if (_transactions.TryGetValue(merchantOrderId, out var record))
        {
            record.OrderNo = orderNo;
            record.Status = status == 2 ? "Completed" : status == 3 ? "Rejected" : "Processing";
            record.UpdatedAt = DateTime.UtcNow;
        }
    }
}

public class TransactionRecord
{
    public string MerchantOrderId { get; set; }
    public string OrderNo { get; set; }
    public decimal Amount { get; set; }
    public string CustomerId { get; set; }
    public string Status { get; set; }
    public DateTime CreatedAt { get; set; }
    public DateTime? UpdatedAt { get; set; }
}