DOCSEARCHbyAlgolia
Submit Docs

Luxtak Documentation

website·Indexed 31 days ago

https://docs.luxtak.com

API documentation for Luxtak's payin and payout services. Includes guides for submitting payouts and payins via methods such as Pix, SBP, SPEI, Bank Transfer, Crypto, and Binance across regions including Brazil, Argentina, Mexico, Russia, Paraguay, and Peru. Features technical details on bank codes, tokenization, security signatures using SHA256, and environment configurations for sandbox and production.

Tokens
48.2K
Snippets
143
Records
227
Agent score
50%

What's inside Luxtak

  1. Overview of luxtak Payment Solutions

    luxtak provides payment infrastructure for merchants to enter new markets, specifically focusing on local payment methods across Latin American countries. The platform offers two primary capabilities: receiving international payments via the Payin solution and sending funds to customers via the Payout solution.

  2. Overview of Virtual SPEI for Mexican Bank Transfers

    Virtual SPEI allows the creation of virtual accounts (CLABE) to receive payins via bank transfers in Mexico. Key constraints and characteristics include:

    • Amount Limit: 1 to 400,000.00 MXN
    • Settlement: Real-time (instant after payment is made)
    • Refunds: Not supported

  3. General requirements for Luxtak Payin API requests

    All interactions with the Luxtak Payin API must adhere to the following technical requirements:

    1. All API calls must use the HTTP POST method.
    2. All requests must include parameters within a JSON body.
    3. All responses, including error messages, are returned in JSON format.

  4. Configure and receive Luxtak IPN notifications

    Luxtak uses Instant Payment Notification (IPN) to inform your server about transaction events via HTTP POST requests. To receive these notifications, you must specify a notify_url when submitting the initial payin transaction request. Luxtak will send JSON-formatted notifications to this URL whenever a relevant event occurs.

  5. Verify luxtak notification authorization

    To ensure a notification is authentic, verify the Authorization header using the following steps:

    1. Extract the parameters from the request body.
    2. Sort the parameters ascendingly (strip any parameters that have no value).
    3. Concatenate the sorted parameters with your app_key.
    4. Generate a SHA256 hash of the resulting string: sha256(sorted_params + app_key).
    5. Compare this generated hash with the Authorization value found in the request header.

  6. Verify Luxtak notification signatures

    To ensure a notification is authentic, verify the Luxtak-Signature header using these steps:

    1. Extract Data: Split the Luxtak-Signature header by commas and equals signs to extract the timestamp (t) and the signature (v2).
    2. Prepare Body: Use the raw, original RequestBody string. Do not re-serialize or format the JSON, as this will change the signature.
    3. Compute HMAC: Calculate an HMAC SHA256 hash using the SecretKey from the merchant dashboard as the key and the original RequestBody string as the message.
    4. Compare: Match the computed signature against the v2 value from the header. Additionally, verify that the difference between the current time and the extracted timestamp (t) is within your acceptable tolerance.
    Example Header:
luxtak-Signature: t=1577808000,v2=5257a869e7ecebeda32affa62cdca3fa51cad7e77a0e56ff536d0ce8e108d8bd

  7. Connect to the LuxTak Production environment

    Once integration testing is successful in the Sandbox, use the Production base URL to go live and process real transactions.
    Base URL: https://api.luxtak.com/

  8. Submit a payout request using the Luxtak Payout API

    To request a payout, send a POST request to the Luxtak Payout API. Note that while this is the base method, specific countries may have additional requirements and different payment schedules.
    POST https://sandbox.luxtak.com/api/payout

  9. Install and initialize the luxtak JavaScript library

    Include the luxtak.js library in your website. It is recommended to load the script from the remote URL rather than caching it locally to ensure you have the latest version. Initialize the library using luxtak.setPublishableKey with your application ID, public key, and the environment ('sandbox' or 'prod').
    <script src="https://res.luxtak.com/lib/js/luxtak.js"></script>
<script>
  luxtak.setPublishableKey('${app_id}', '${public_key}', 'sandbox | prod')
</script>

  10. Test PIXParaguay payouts in Sandbox

    When testing in the sandbox environment, use the following logic to simulate different payout outcomes:

    • To simulate a REJECTED payout: Use EMAIL as the account_type and [email protected] as the account.
    • To simulate a SUCCESSFUL (PAID) payout: Use any other valid PIXParaguay account combination.

  11. Authenticate payout requests using SHA256 signatures

    To make safe payment requests to the payout platform, you must include specific headers in your request. The Authorization header is a SHA256 hash generated by concatenating sorted request parameters with your application key.

    Required Headers:

    • Content-Type: application/json; charset=UTF-8
    • AppId: Your App ID from the merchant dashboard.
    • Authorization: The generated SHA256 signature (must be lowercase).

    Signature Generation Process:

    1. Sort all request parameters in ascending alphabetical order.
    2. Strip any parameters that have no value.
    3. Concatenate the sorted parameters into a query string (e.g., key1=value1&key2=value2).
    4. Append the app_key (found in the merchant dashboard) to the end of the concatenated string.
    5. Apply the SHA256 hash function to the resulting string to produce the Authorization value.
    // Example Logic:
Sorted Params: account_digit=4&account_number=1234567...
Concatenated: account_digit=4&account_number=1234567...ABCDE (where ABCDE is app_key)
Final Hash: 1aca3a17c029278be58f8b78faf66b370a76697a63984f5c934c88c990f7bf79

  12. PIXParaguay account and document requirements

    Depending on the account_type and document_type selected, the account and document_id fields must follow these formats:

    TypeFormat/RequirementDescription
    CPF11 digitsIndividual identification
    CNPJ14 digitsBusiness identification
    Phonee.g., +5511987654321Country code (+55) is optional
    EmailValid email addressBeneficiary email
    EVP32-digit alphanumeric UUIDString sent from the central bank to the institution

    For validation of CPF/CNPJ, the following third-party libraries are recommended:

    • Go: github.com/paemuri/brdoc
    • Java: github.com/LuisGuadagnin/cpf-cnpj-handler