Implementation¶

This section details the process of integrating the Checkout API for your business.

Setup¶

You must first have a vendor account with the Checkout API enabled. Follow these steps:

Login to the Vendor Portal at https://portal.brighte.com.au/login.
From the Developer area, click the API keys section.
Create a new public API key with restrictions for referrer and redirect URLs.
- The referrer URL restriction specifies the URLs from which API requests are accepted.
- The redirect URL is a page provided in the API request and to which the customer is redirected after an application. API requests providing invalid redirect URLs will not be accepted.
You can also create a private key if you want to authenticate the origin of the request.
Integrate the Checkout API into your web application.

API request¶

API requests are HTTP requests sent by the customer. They must meet the following conditions:

The request is sent to https://portal.brighte.com.au/checkout?key=YOUR_API_KEY
The request must be sent via POST method.
The request is sent from a URL conforming to the restrictions set on the public API key.
The redirect URL must conform to the restrictions set on the public API key. This URL can contain a query string component can be used to store parameters between sessions.
The deposit amount and repayment term must be valid according to your vendor account.
The product category must be one of the following:
- Storage Battery(s)
- Solar Panel Package
- Solar Panel and Battery Combo
- Solar Inverter(s)
- Flooring
- Guttering
- Roofing
- Air-Conditioning
- Window Shutters
- Hot Water Systems
- Pool Heating Systems (Solar/Pump/Gas)
- Smart Home Technology
- Trailers and Campers
- Carports/Patio/Pergolas
- Doors/Garage Doors
- Home Improvements
- Windows/Blinds/Shutters/Glazing
- Plumbing and Electrical
- Heating/Cooling Solutions
- Security System

Required paramters:

Parameter Data type Description

redirect string Redirect URL upon application completion

total_purchase_amount double Purchase total

deposit_amount double Deposit amount

repayment_term integer Repayment term in months

product_category string Product category

product_description string Product description

reference_number string Optional reference number (max 20 chars)

checksum string SHA-256 hash of the POST parameters in the order listed below

The checksum parameter must be a SHA-256 hash of a concatenated string in this order

redirect
total_purchase_amount
deposit_amount
repayment_term
product_category
product_description

JSON-formatted sample request:

{
  "redirect":"http://yourwebsite.com/checkout-success?yourtrackingid=S888",
  "total_purchase_amount":"7000.12",
  "deposit_amount":"750.24",
  "repayment_term":"24",
  "product_category":"Storage Battery(s)",
  "product_description":"Powerwall Home Battery",
  "reference_number":"12345J",
  "checksum":"5bf7eef1a95160f47134717996d6c5ae"
}

Sample HTML code that sends an API request:

<html>
<head><title>Some Solar Purchase</title></head>
<body>
    <h1>Some Solar</h1>
    <h2>Powerwall Battery: $7,000</h2>
    <p><img src="Powerwall-Battery.jpg"/></p>
    <h3>Buy now with Brighte</h3>
    <h4>[ Include full details and description of item that makes up the price here ]</h4>
    <ul>
        <li>Pay with interest free payment plans.</li>
        <li>Fees apply.</li>
        <li>Repayments of $136.05 per fortnight.</li>
        <li>Total repayable $7,314.48.</li>
    </ul>
    <form action="https://portal.brighte.com.au/checkout?key=YOUR_API_KEY" method="POST">
        <input type="hidden" name="redirect" value="http://yourwebsite.com/checkout-success.html">
        <input type="hidden" name="total_purchase_amount" value="7000">
        <input type="hidden" name="deposit_amount" value="700">
        <input type="hidden" name="repayment_term" value="24">
        <input type="hidden" name="product_category" value="Storage Battery(s)">
        <input type="hidden" name="product_description" value="Powerwall Home Battery">
        <input type="hidden" name="checksum" value="5bf7eef1a95160f47134717996d6c5ae">
        <button type="submit">Buy now with Brighte</button>
    </form>
     <p>*Terms, conditions and lending criteria apply. Repayments based on RRP of $7,000 and 0% deposit.  Minimum amount payable $7,314.48 over 24 months.<br>Fees and charges apply includes $75 Application Fee, $3.50 monthly Account Keeping Fee and $2.99 fortnightly Payment Processing Fee. Ask in-store for details or visit Brighte.com.au. Continuing credit provided by Brighte Ptd Ltd</p>
</body>
</html>

API response¶

If the API request has an invalid redirect value, a HTTP 400 error is returned. If the API request is invalid but has a valid redirect value, the customer is redirected to the redirect URL with details of the error provided through GET parameters error_code and error_msg. The error codes are as follows:

Error code Meaning

10002 Invalid data given. See error_msg for more information.

After the customer submits an application successfully, the customer is redirected to the redirect URL with the following GET values:

Parameter Value

error_code 10000

transaction_id ID of the application. Unique numeric value.

Sample HTML and PHP code that receives an API response:

<html>
<head>
<title>Some Solar Purchase</title>
</head>
<body>
    <h1>Some Solar</h1>
    <?php switch ($_GET['error_code']) : ?>
    <?php case 10000 : ?>
    <h2>Payment application submitted successfully.</h2>
    <p>You should receive an email from Brighte to complete your application.</p>
    <p>Your transaction ID is: <?php echo htmlspecialchars($_GET['transaction_id']); ?></p>
    <?php break; ?>
    <?php default: ?>
    <h2>Payment application failed.</h2>
    <p>Error: <?php echo htmlspecialchars($_GET['error_code']); ?> - <?php echo htmlspecialchars($_GET['error_msg']); ?></p>
</body>
</html>

Securing webhook¶

As the redirect address is public, you may verify the request came from Brighte using a private API key. If you have created a private API key, extra GET parameters signature, timestamp and token are sent. Follow these steps to verify the request:

Login to the Vendor Portal at https://portal.brighte.com.au/login.
From the Developer area, Create a new private API key.
Verify every request by concatenating the timestamp and token values and encoding the resulting string with the HMAC algorithm. Use the private API key as the key and SHA256 digest mode. The resulting HEX digest should match the signature value.

Sample PHP code that verifies an API response:

if ($_GET['signature'] !== hash_hmac('sha256', $_GET['timestamp'] . $_GET['token'], utf8_encode(BRIGHTE_PRIVATE_KEY))) {
    exit;
}