Integration of 1C-Bitrix with the MIR Pay payment system

Integrating 1C-Bitrix with Mir Pay

Mir Pay is the Russian counterpart to Google Pay and Apple Pay, developed by NSPK (National Payment Card System). It works on Android devices with NFC and supports cards of the Mir payment system. Since 2022, following restrictions on Google Pay and Apple Pay for Russian cards, Mir Pay has become the primary mobile payment method for Mir cardholders. Integration into an online store built on 1C-Bitrix is implemented through the Mir Pay Web API or through a supporting acquiring service.

How Mir Pay Works on the Web

Mir Pay Web is an online payment protocol via the Mir Pay mobile app on a smartphone. The flow:

1. The buyer clicks the Mir Pay button on the website
2. The website initiates a transaction via the NSPK API
3. A push notification requesting confirmation is sent to the buyer's smartphone
4. The buyer confirms with a fingerprint or PIN
5. NSPK returns the transaction result

An alternative option is via Mir Pay QR code (similar to SBP, but using the Mir infrastructure).

Connection via Acquiring Service

Most banks participating in NSPK support Mir Pay in their internet acquiring services. Sber, Tinkoff, VTB, and Rosselkhozbank add the Mir Pay button to the payment form automatically. No specific actions are required on the 1C-Bitrix side — the payment method appears in the form when stipulated in the contract.

Direct Integration via NSPK Mir Pay Web API

For independent integration:

class MirPayWebGateway
{
    private const API_URL = 'https://payment.mirpay.ru/v1/';
    private string $merchantId;
    private string $merchantKey;
    private string $terminalId;

    public function createSession(array $data): array
    {
        $timestamp = date('Y-m-d\TH:i:s\Z');
        $nonce     = bin2hex(random_bytes(16));

        $payload = [
            'merchant_id'  => $this->merchantId,
            'terminal_id'  => $this->terminalId,
            'order_id'     => 'BX_' . $data['orderId'],
            'amount'       => (int)round($data['amount'] * 100), // kopecks
            'currency'     => 'RUB',
            'description'  => 'Order #' . $data['orderId'],
            'return_url'   => $data['returnUrl'],
            'notify_url'   => $data['notifyUrl'],
            'timestamp'    => $timestamp,
            'nonce'        => $nonce,
        ];

        $payload['signature'] = $this->sign($payload);

        $ch = curl_init(self::API_URL . 'sessions');
        curl_setopt_array($ch, [
            CURLOPT_POST           => true,
            CURLOPT_POSTFIELDS     => json_encode($payload),
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_HTTPHEADER     => ['Content-Type: application/json'],
        ]);
        $result = json_decode(curl_exec($ch), true);
        curl_close($ch);

        return $result;
    }

    private function sign(array $params): string
    {
        ksort($params);
        $signString = implode('|', array_values($params)) . '|' . $this->merchantKey;
        return hash('sha256', $signString);
    }
}

Button on the Page

// mir-pay-web.js — provided by NSPK
MirPayWeb.init({
    merchantId: 'YOUR_MERCHANT_ID',
    sessionId: mirPaySessionId,  // obtained from the server
    container: '#mir-pay-button',
    locale: 'ru',
    onSuccess: function(result) {
        // Redirect to the success page
        window.location.href = '/checkout/success/?order=' + orderId;
    },
    onError: function(error) {
        console.error('Mir Pay error:', error);
    },
});

Notification Handling

// /bitrix/tools/mirpay_notify.php
$body = file_get_contents('php://input');
$data = json_decode($body, true);

// Signature verification
$receivedSig = $data['signature'] ?? '';
$checkData   = $data;
unset($checkData['signature']);
ksort($checkData);
$expected = hash('sha256', implode('|', array_values($checkData)) . '|' . MIRPAY_KEY);

if (!hash_equals($expected, $receivedSig)) {
    http_response_code(403);
    exit('Invalid signature');
}

if (($data['status'] ?? '') === 'COMPLETED') {
    $orderId = str_replace('BX_', '', $data['order_id']);
    $order   = \Bitrix\Sale\Order::loadByAccountNumber($orderId);
    $payment = $order->getPaymentCollection()->current();
    $payment->setPaid('Y');
    $payment->save();
}

http_response_code(200);
echo 'OK';

Displaying the Button for Android Only

// Mir Pay Web works only on Android with the Mir Pay app installed
const isMirPayAvailable = () => {
    const ua = navigator.userAgent;
    const isAndroid = /Android/i.test(ua);
    // MirPayWeb.isAvailable() — SDK method for checking whether the app is installed
    return isAndroid && typeof MirPayWeb !== 'undefined' && MirPayWeb.isAvailable();
};

if (isMirPayAvailable()) {
    document.querySelector('.mirpay-btn-wrapper').style.display = 'block';
}

Timeline