PHP
No official PHP backend SDK is published yet — call the REST API directly with cURL/Guzzle or your HTTP client of choice.
No wajub/wajub-php package
There is no published wajub/wajub-php (or wajub/sdk-php) Composer package and no
github.com/wajub/wajub-php repository — composer require wajub/wajub-php and
new \Wajub\Wajub(...) do not work. Call the REST API directly, as shown below.
Initialization
Using Guzzle (composer require guzzlehttp/guzzle) — or any HTTP client, no Wajub-specific
package required:
<?php
use GuzzleHttp\Client;
$client = new Client([
'base_uri' => 'https://api.wajub.com',
'headers' => [
'Authorization' => getenv('WAJUB_SECRET_KEY'), // no "Bearer" prefix
'Content-Type' => 'application/json',
],
]);Use cases
Collect a payment
<?php
$response = $client->post('/payments', [
'json' => [
'amount' => 5000,
'currency' => 'XAF',
'customer' => ['email' => 'amina@example.com'],
'callback' => 'https://example.com/return',
],
]);
$data = json_decode($response->getBody(), true);
header('Location: ' . $data['authorization_url']);Pay out
<?php
$response = $client->post('/transfers', [
'headers' => ['Idempotency-Key' => bin2hex(random_bytes(12))],
'json' => [
'amount' => 100000,
'currency' => 'XAF',
'beneficiary' => ['phone' => '+237670000000', 'channel' => 'cm.mtn', 'name' => 'Amina'],
],
]);Verify a webhook (Laravel)
Wajub signs webhooks with HMAC-SHA256 over "{timestamp}.{rawBody}", sent as
X-Wajub-Signature: v1={hex}. See Signature verification
for the full algorithm; a minimal check:
<?php
// routes/web.php
Route::post('/webhooks/wajub', function (\Illuminate\Http\Request $request) {
$payload = $request->getContent();
$header = $request->header('x-wajub-signature', ''); // "v1=<hex>"
$timestamp = $request->header('x-wajub-timestamp', '');
[, $signature] = explode('=', $header, 2) + [null, null];
$expected = hash_hmac('sha256', "{$timestamp}.{$payload}", env('WAJUB_WEBHOOK_SECRET'));
if (!$signature || !hash_equals($expected, $signature)) {
return response()->json(['error' => 'Invalid signature'], 400);
}
$event = json_decode($payload, true);
if ($event['type'] === 'payment.succeeded') {
fulfill($event['data']);
}
return response()->noContent();
});Verify against the real algorithm
Double-check the exact header names and payload construction on Signature verification before shipping this to production — do not assume this snippet alone is complete. Exclude this route from CSRF protection so Wajub can POST to it.
Local development
Use the real, published Wajub CLI (npm install -g @wajub/cli) to forward
webhooks to localhost and trigger test events while you build — no SDK required:
wajub listen --forward-to localhost:8000/webhooks/wajub
wajub trigger payment.complete