function adsrekSign(string $canonical, string $secretKey): string
{
    return hash_hmac('sha256', $canonical, $secretKey);
}

$amount = number_format(10, 2, '.', '');
$canonical = 'create|1001|aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa|ORDER-1001|' . $amount . '|RUB';
$sign = adsrekSign($canonical, 'YOUR_SECRET_KEY');

<?php
$secretKey = getenv('ADSREK_PAY_SECRET');
$data = $_POST;

$required = ['invoice_id','shop_id','order_id','amount','currency','status','sign'];
foreach ($required as $field) {
    if (!isset($data[$field])) {
        http_response_code(400);
        exit('MISSING_FIELD');
    }
}

$canonical = implode('|', [
    (int)$data['invoice_id'],
    (int)$data['shop_id'],
    (string)$data['order_id'],
    (string)$data['amount'],
    (string)$data['currency'],
    (string)$data['status'],
]);
$expected = hash_hmac('sha256', $canonical, $secretKey);

if (!hash_equals($expected, strtolower((string)$data['sign']))) {
    http_response_code(401);
    exit('BAD_SIGNATURE');
}

// Найдите заказ по order_id и заблокируйте строку в транзакции БД.
// Повторный callback для уже оплаченного заказа должен вернуть 200 без повторного начисления.
if ($data['status'] === 'paid') {
    // Дополнительно сравните amount и currency с вашим заказом.
    // Отметьте заказ оплаченным атомарно.
}

http_response_code(200);
echo 'OK';

<?php
$shopId = 1001;
$apiKey = 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa';
$secretKey = getenv('ADSREK_PAY_SECRET');
$orderId = 'ORDER-1001';
$amount = number_format(10, 2, '.', '');
$currency = 'RUB';

$canonical = implode('|', ['create', $shopId, $apiKey, $orderId, $amount, $currency]);
$payload = [
    'shop_id' => $shopId,
    'api_key' => $apiKey,
    'order_id' => $orderId,
    'amount' => $amount,
    'currency' => $currency,
    'description' => 'Оплата заказа ' . $orderId,
    'sign' => hash_hmac('sha256', $canonical, $secretKey),
];

$ch = curl_init('https://adsrekpay.com/api/pay/create.php');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => json_encode($payload, JSON_UNESCAPED_UNICODE),
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 15,
    CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
]);
$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($response === false) {
    throw new RuntimeException(curl_error($ch));
}
curl_close($ch);

$data = json_decode($response, true, 512, JSON_THROW_ON_ERROR);
if ($httpCode !== 200 || empty($data['ok'])) {
    throw new RuntimeException($data['error'] ?? 'Adsrek Pay API error');
}
header('Location: ' . $data['payment_url']);
exit;

import hashlib
import hmac
import os
import requests

shop_id = 1001api_key = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
secret_key = os.environ["ADSREK_PAY_SECRET"]
order_id = "ORDER-1001"
amount = "10.00"
currency = "RUB"

canonical = f"create|{shop_id}|{api_key}|{order_id}|{amount}|{currency}"
sign = hmac.new(secret_key.encode(), canonical.encode(), hashlib.sha256).hexdigest()

payload = {
    "shop_id": shop_id,
    "api_key": api_key,
    "order_id": order_id,
    "amount": amount,
    "currency": currency,
    "description": f"Оплата заказа {order_id}",
    "sign": sign,
}
response = requests.post("https://adsrekpay.com/api/pay/create.php", json=payload, timeout=15)
response.raise_for_status()
data = response.json()
print(data["payment_url"])

// Счёт создаётся только на вашем сервере, где хранится SECRET KEY.
const response = await fetch('/your-server/create-adsrek-invoice', {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({order_id: 'ORDER-1001'})
});
const data = await response.json();
if (!data.payment_url) throw new Error('Не удалось создать счёт');
window.location.assign(data.payment_url);