QIWI PAY

What you need

QIWI PAY is opened by application (bss@qiwi.com). QIWI gives you two values:

• merchant_id: QIWI's merchant_site number (numeric, e.g. 555)
• secret_key: the signing key ("secret key parameter obtained with other integration settings")

In your panel choose Settings → Payments → Add method → QIWI PAY and enter both.

Test environment: QIWI has no separate test host; every new merchant_site starts in the test environment and is moved to production by your QIWI support manager on request. In test mode only RUB (643) is accepted, a single transaction is at most 10 rubles and there are at most 100 test transactions per day. The panel's sandbox (test) mode box has no effect for QIWI.

The notification (callback) URL is attached to every payment as callback_url; nothing has to be configured in QIWI's panel, but if a fixed address is requested during integration give this one:

https://<your-panel-domain>/payments/qiwi/callback

QIWI delivers notifications only over HTTPS on port 443 to a host with a valid certificate.

Flow

1. The customer enters an amount and picks QIWI PAY. (No phone number is required.)
2. The panel submits a form from the customer's browser to https://pay.qiwi.com/paypage/initial carrying merchant_site, amount, currency, order_id (our payment reference) and an HMAC-SHA256 signature. Card entry and 3-D Secure happen on QIWI's page; card data never touches your server.
3. When the payment finishes, QIWI sends a server-to-server JSON notification. The panel verifies its sign field with the secret key; a notification whose signature does not match is rejected (400) and credits nothing.
4. A verified notification with txn_status 2 or higher (Authorized / Captured / Reconciled / Settled) credits the balance. If the signed amount is below the payment amount the record becomes "underpaid"; if the currency differs from the method's currency the record stays pending for a decision under Admin → Payments.
5. The customer comes back from QIWI's result page through success_url / decline_url; that return only redirects and never credits.

QIWI may send two notifications for one transaction (immediate and background) and retries for 24 hours until it receives a 200. A second delivery of the same txn_id + status is ignored; balance is never credited twice.

Statuses

txn_status	QIWI name	Result in the panel
0	Init	pending
1	Declined	failed (the error_code description goes into the memo)
2, 3, 4, 5	Authorized / Captured / Reconciled / Settled	completed

Refund (txn_type 3), reversal (4) and payout (8) notifications never touch the balance (a completed record stays as it is).

Currencies

The form wants the ISO 4217 numeric code; the panel converts RUB, USD, EUR, TRY, KZT, UAH, GBP, BYN, AZN and UZS. Which currencies are actually enabled depends on your merchant_site (QIWI answers 8059 Currency is not allowed otherwise). The test environment is RUB only.

Common problems

• "Invalid signature" (8054): the secret_key is wrong or has leading/trailing whitespace. Paste it exactly as QIWI gave it.
• "Merchant site not found" (8021) / "Merchant disabled" (8051): the merchant_id is wrong or the merchant_site is not activated yet; write to your QIWI support manager.
• Payment succeeded at QIWI but no balance: the notification could not reach your panel, the domain is not pointed at us yet or the TLS certificate is not valid. QIWI retries for 24 hours; once fixed, the notification arrives. Check the record's memo under Admin → Payments.
• Test transaction declined: amount above 10 rubles or the 100-per-day limit (8070 / 8069). On test cards an expiry month of 02 forces a failure, 03 a success after a 3 s delay, 04 a failure after a 3 s delay.