Web Merchant Interface

last updated: December 12, 2024

Contents:¶

• Definitions
  • Merchant
  • Customer
• About Merchant WebMoney Transfer
  • Payments parameters
  • Payment workflow
  • HTML FORMS
    • Payment request form
    • Prerequest form
    • Payment notification form
    • Settled payment form
    • Unsettled payment form
  • Payment data verification
    • Data source verification
    • Data integrity verification
    • Control signature
    • Verification of the control signature
    • Payment amount verification
    • Merchant's purse verification
    • Payment mode verification
  • Samples
• Merchant WebMoney Transfer Testing

Definitions¶

MERCHANT¶

A Merchant is a WebMoney Transfer user accepting payments from other WebMoney Transfer users via Merchant WebMoney Transfer.
The merchant accepts WebMoney for goods or services rendered via the Internet, thus they are supposed to have their own website.

CUSTOMER¶

A Customer is a WebMoney Transfer user willing to pay for goods or services offered by the merchant via the Internet.

WebMoney Transfer Interface¶

PAYMENT RECEIPT PARAMETERS¶

In order to receive payments via Merchant WebMoney Transfer merchants must be registered with WebMoney Transfer. Moreover they must set up a number of parameters regulating the receipt of payments and notification about payments.
Parameters may be set up in 'Settings ' (https://merchant.wmtransfer.com).
Each purse that the merchant uses to accept payments has its own set of parameters in the service.
Parameters and their functions:

Payment workflow¶

Payment workflow is shown in the picture below.

HTML FORMS¶

Five HTML forms are used to transmit data between the merchant's website and the service:

• A Payment request form is generated on the merchant's website in order to request a payment in Merchant WebMoney Transfer and transfer it through the customer's browser.
• A Prerequest form is generated by Web Merchant Interface to send the parameters of a preliminary request for performing a payment to the merchant's website - if the flag "Send the parameters in a prerequest" is enabled. If the flag is disabled then the form is not used (the request is sent without parameters). The request is sent bypassing the user's browser.
• A Payment notification form is generated by Merchant WebMoney Transfer in order to notify the merchant about the payment. The customer's browser is not used during the transmission of payment notification to the merchant's website.
• A Settled payment form is generated by Merchant WebMoney Transfer if the payment was successful.
• An Unsettled payment form is generated by Merchant WebMoney Transfer if the payment failed. The form is transmitted to the merchant's website through the customer's web browser.

Payment request form¶

The form transmits the request from the merchant's site to Merchant WebMoney Transfer through the customer's browser. It has the following fields and parameters:

Action - https://merchant.wmtransfer.com/lmi/payment_utf.asp

Method - POST

accept-charset -UTF-8

content-type - application/x-www-form-urlencoded

Fields - fields transmitted in the form:

 LMI_PAYEE_PURSE;LMI_PAYMENT_AMOUNT;LMI_PAYMENT_NO;Secret Key X20;

 LMI_PAYEE_PURSE;LMI_PAYMENT_AMOUNT;LMI_HOLD;LMI_PAYMENT_NO;Secret Key X20;

* - Only one of LMI_PAYMENT_DESC and LMI_PAYMENT_DESC_BASE64 parameters presense is necessary.

The Action field of the form allows the merchant to redirect the customer to a specific payment method immediately. It is very easy when the merchant fully implements all the possible options when setting up a store. For this there is an 'at' parameter in the request URL. E.g. transmitting a payment form with URL https://merchant.wmtransfer.com/lmi/payment_utf.asp?at=authtype_8 redirects the customer to the 'payment from a WM-purse' payment method and at=authtype_3 - to WM-card payment. If the parameter is omitted the last used method will be chosen. All available payment methods are listed below:

• authtype_2 Keeper WebPro
• authtype_3 WM-card/Paymer check (we strongly recommend that you prompt the customer for their WM-card number/Paymer check and transmit it in the LMI_PAYMER_PINNUMBERINSIDE parameter if there is a separate item for the scratch-card/paymer check payment method at the merchant's site, for it will allow you to avoid redirecting and the customer will immediately get to the final page skipping the payment method selection and WM-card number/Paymer check entering steps.)
• authtype_8 Keeper WinPro
• authtype_9 Keeper Standard
• authtype_12 For social Network Keeper
• authtype_13 WebMoney Check
• authtype_16 Russian banks credit cards, for Z-purses only (we strongly recommend to transmit '4' in the LMI_ALLOW_SDP parameter if there is a separate item (icon, set) for the 'payment via bank cards' payment method at the merchant's site, for it will allow you to avoid redirecting and the customer will immediately get to the final page skipping the payment method selection step.)
• authtype_17 Quick payment with mobile phone number specifying (if the merchant knows the customer's mobile phone number specified in international format they can transmit it in the LMI_FAST_PHONENUMBER parameter and the customer will not have to enter it on our site when making a quick payment)
• authtype_20 Bitcoin
• authtype_22 RunPay MDL
• authtype_26 Litecoin
• authtype_27 Ethereum
• authtype_28 USDT

Sample 1. Fragment of the 'Payment request form ' without the URL replacement

 
<html> 
<head>
 ... 
</head> 
<body>
...
<form method="POST" action="https://merchant.webmoney.ru/lmi/payment_utf.asp" accept-charset="utf-8">  
  <input type="hidden" name="LMI_PAYMENT_AMOUNT" value="12.08">
  <input type="hidden" name="LMI_PAYMENT_DESC" value="платеж по счету">
  <input type="hidden" name="LMI_PAYMENT_NO" value="1234">
  <input type="hidden" name="LMI_PAYEE_PURSE" value="Z145179295679">
  <input type="hidden" name="LMI_SIM_MODE" value="0">
  <input type="hidden" name="FIELD_1" value="VALUE_1">
  <input type="hidden" name="FIELD_2" value="VALUE_2">
  ... 
  <input type="hidden" name="FIELD_N" value="VALUE_N"> 
  ... 
</form>
..
</body>
</html>

Sample 2. Fragment of the 'Payment request form' with the URL replacement

<html>
<head>
...
</head>
<body>
...
<form method="POST" action="https://merchant.wmtransfer.com/lmi/payment_utf.asp" accept-charset="utf-8">
    <input type="hidden" name="LMI_PAYMENT_AMOUNT" value="12.08">
    <input type="hidden" name="LMI_PAYMENT_DESC" value="payment under the bill">
    <input type="hidden" name="LMI_PAYMENT_NO" value="1234">
    <input type="hidden" name="LMI_PAYEE_PURSE" value="Z145179295679">
    <input type="hidden" name="LMI_SIM_MODE" value="0">

    <input type="hidden" name="LMI_RESULT_URL" value="http://www.shop.com/result.asp">
    <input type="hidden" name="LMI_SUCCESS_URL" value="http://www.shop.com/success.html">
    <input type="hidden" name="LMI_SUCCESS_METHOD" value="2">
    <input type="hidden" name="LMI_FAIL_URL" value="http://www.shop.com/fail.html">
    <input type="hidden" name="LMI_FAIL_METHOD" value="2">

    <input type="hidden" name="FIELD_1" value="VALUE_1">
    <input type="hidden" name="FIELD_2" value="VALUE_2">
    ...
    <input type="hidden" name="FIELD_N" value="VALUE_N">
    ...
</form>
..
</body>
</html>

Pay attention to the EXEMPLARY implementation of the payment request form in the Plati.ru store, where all variants of choosing a payment method as well as immediate redirecting to the necessary payment method with existing user's data are used.

Prerequest form¶

This form transmits details of initiated payment to the merchant directly before the payment. There are the following parameters and fields in the form:

Action - Result URL

Method - POST

Fields - fields transmitted in the form:

If the "parameters transmission" flag is enabled the payment processing will continue if the merchant's website returns "YES" (string). If the merchant's website returns anything else the payment will not be completed and the customer will receive an error message.

Sample. Fragment of "Prerequest form"

<html>
<head>
...
</head>
<body>
...
<form method="POST" action="<Result URL>">

    <input type="hidden" name="LMI_PREREQUEST" value="1">
    <input type="hidden" name="LMI_PAYMENT_AMOUNT" value="1.0">
    <input type="hidden" name="LMI_PAYMENT_NO" value="1">
    <input type="hidden" name="LMI_PAYEE_PURSE" value="R397656178472">
    <input type="hidden" name="LMI_MODE" value="1">
    <input type="hidden" name="LMI_PAYER_WM" value="809399319852">

    <input type="hidden" name="FIELD_1" value="VALUE_1">
    <input type="hidden" name="FIELD_2" value="VALUE_2">
    ...
</form>
..
</body>
</html>

Payment notification form¶

The form transmits the details of a settled payment to the merchant. It has the following fields:

Action - Result URL

Method - POST

Fields are described in the table:

Important!

The merchant should provide the verification of data sent in the 'Payment notification form' in accordance with the tips given here.

Sample. Fragment of the 'Payment notification form'

<html>
<head>
...
</head>
<body>
...
<form method="POST" action="<Result URL>">

    <input type="hidden" name="LMI_PAYMENT_AMOUNT" value="1.0">
    <input type="hidden" name="LMI_PAYMENT_NO" value="1">
    <input type="hidden" name="LMI_PAYEE_PURSE" value="R397656178472">
    <input type="hidden" name="LMI_MODE" value="1">
    <input type="hidden" name="LMI_SYS_INVS_NO" value="281">
    <input type="hidden" name="LMI_SYS_TRANS_NO" value="558">
    <input type="hidden" name="LMI_PAYER_PURSE" value="R397656178472">
    <input type="hidden" name="LMI_PAYER_WM" value="809399319852">
    <input type="hidden" name="LMI_SYS_TRANS_DATE" value="20020314 14:01:14">
    <input type="hidden" name="LMI_HASH" value="114128B8AEFD8CAA76D3CF75B9AEBC17">
        <input type="hidden" name="LMI_HASH2" value="8ACAC8C59D6CA6EB0AD56DF5C0CE8BB4D096557C8AF0C642D7E5CE1344C107D8">

    <input type="hidden" name="FIELD_1" value="VALUE_1">
    <input type="hidden" name="FIELD_2" value="VALUE_2">
    ...
</form>
..
</body>
</html>

Settled payment form¶

The form transmits details of a settled payment to the merchant's site. The data is transmitted through the customer's browser only if the method of requesting the Success URL is 'GET' or 'Post'. The form has the following parameters and fields:

Action - Success URL

Method - method of requesting Success URL

Fields - fields transmitted in the form:

Sample. Fragment of the 'Settled payment form"

<html>
<head>
...
</head>
<body>
...
<form method="<method of requesting Success URL>" action="<Success URL>">

    <input type="hidden" name="LMI_PAYMENT_NO" value="1">
    <input type="hidden" name="LMI_SYS_INVS_NO" value="281">
    <input type="hidden" name="LMI_SYS_TRANS_NO" value="558">
    <input type="hidden" name="LMI_SYS_TRANS_DATE" value="20020314 14:01:14">

    <input type="hidden" name="FIELD_1" value="VALUE_1">
    <input type="hidden" name="FIELD_2" value="VALUE_2">
    ...
</form>
..
</body>
</html>

Unsettled payment form¶

The form transmits the details of unsettled payments to the merchant's website. Data is transmitted through the customer's browser if the specified method of requesting the Success URL is 'GET' or 'POST'. The form has the following fields:

Action - Fail URL

Method - method of requesting Fail URL

Fields - fields are the same as in the settled payment form.

Sample. Fragment of the 'Unsettled payment form'

<html>
<head>
...
</head>
<body>
...
<form method="<method of requesting Fail URL>" action="<Fail URL>">

    <input type="hidden" name="LMI_PAYMENT_NO" value="1">
    <input type="hidden" name="LMI_SYS_INVS_NO" value="">
    <input type="hidden" name="LMI_SYS_TRANS_NO" value="">
    <input type="hidden" name="LMI_SYS_TRANS_DATE" value="">

    <input type="hidden" name="FIELD_1" value="VALUE_1">
    <input type="hidden" name="FIELD_2" value="VALUE_2">
    ...
</form>
..
</body>
</html>

VERIFICATION OF PAYMENT DATA¶

When the payment is made Merchant WebMoney Transfer sends a notification in the 'Payment notification form ' to the Result URL provided by the merchant.
We advise you to verify the data transmitted in the 'Payment notification form':

1. Verify if the data have been sent by Merchant WebMoney Transfer (data source)
2. Verify if the data has not been modified (data integrity)
3. Verify the payment amount
4. Verify the merchant's purse
5. Verify the payment mode (test or operative mode)

Data source verification¶

The Secret Key must be known only to the merchant and Merchant WebMoney Transfer. The Secret Key may be used for authentication of a sender. There is a number of different ways to authenticate the sender:

• If the Result URL is secured and cannot be changed (edited),
  the merchant may authenticate the sender in two different ways:
• If the merchant does not want to verify the control signature he must enable the 'Send the Secret Key to the Result URL' option. In this case Merchant WebMoney Transfer will send the Secret Key to the merchant's website (in the 'LMI_SECRET_KEY' field of the payment notification form. The merchant will have to verify the secret key each time he receives the payment notification.
• The other way is to verify the control signature. The control signature is generated by Merchant WebMoney Transfer and is transmitted in the 'LMI_HASH' field.
  This method is a bit more laborious but in this case the secret key will not be transmitted via the Internet.
• If the Result URL is not secured or it can be changed ,
  Merchant WebMoney Transfer will not send the Secret Key independent of whether or not the 'Send the Secret Key to the Result URL' option is enabled. Thus the merchant will have to verify the control signature.

Service Merchant use IP addresses

Data integrity verification¶

Merchant WebMoney Transfer notifies the merchant about the payment and sends payment details and control signature letting verify the integrity of data in a number of different ways depending on whether or not the Result URL is secured:

• If the Result URL is secured and cannot be changed ,
  the merchant does not need to verify the control signature because the SSL protocol provides the security and integrity of data.
• If the Result URL is not secured and can be changed ,
  we advise you to verify the integrity of data by the control signature.

Control signature¶

The control signature lets the merchant verify the source of data and the integrity of data transferred to the Result URL in the 'Payment notification form '.
The control signature is generating by 'sticking' together values of parameters transmitted in the 'Payment notification form' in the following order:

1. Merchant's purse (LMI_PAYEE_PURSE);
2. Amount (LMI_PAYMENT_AMOUNT);
3. Time-protection period for the payment with holding (LMI_HOLD); if missed, the string is generated excluding this parameter. If this parameter is present, it should be separated by the ; symbol (semicolon) on both sides from the other parameters of the string.
4. Purchase number (LMI_PAYMENT_NO);
5. Test mode flag (LMI_MODE);
6. Account number in WebMoney Transfer (LMI_SYS_INVS_NO);
7. Payment number in WebMoney Transfer (LMI_SYS_TRANS_NO);
8. Date and time of payment (LMI_SYS_TRANS_DATE);
9. Secret Key (LMI_SECRET_KEY);
10. Customer's purse (LMI_PAYER_PURSE);
11. Customer's WM id (LMI_PAYER_WM).

When merging the fields should be divided by the ; symbol (semicolon) or without any dividing symbols.
If dividing symbols are used the signed string should be sent in the LMI_HASH2 parameter. Otherwise - in the LMI_HASH parameter.

The control signature algorithm depends on parameters set by the merchant (SHA256 or SIGN).
SHA256 (* Secure Hash Algorithm *) computed with 32-bit words. SHA-256 algorithm generates an almost-unique, fixed size 256-bit (32-byte) hash (64 symbols string). Designed by the U.S. National Security Agency (NSA) and published in 2001 by the NIST as a U.S. Federal Information Processing Standard (FIPS).
SIGN generates a sequence of 132 hexadecimal digits on the WebMoney Transfer digital signature algorithm with use of WMSignerX.

Verification of the control signature¶

The control signature may be verified manually on these pages - (SHA256, SIGN) - and automatically on the merchant's site by the following algorithm:

• SHA256

1. Make a string by sticking together the parameters received in the 'Payment notification form' in the same order as in the control signature generation (see above). Remember that the Secret Key is used to generate the signature. Calculate the SHA256 of this string. Compare the calculated value with 'LMI_HASH' received through the 'Payment notification form'
2. Calculate the SHA256 of this string
3. Compare the calculated value with the value transmitted in the 'Payment notification form '.

If the generated signature coincides with the one transmitted in the ' Payment notification form', the data has not been changed and the source of the data is Merchant WebMoney Transfer.

• SIGN

1. Make a string by sticking the parameters received in the 'Payment notification form' in the same order as at the control signature generation (see above). Remember that the Secret Key is used to generate the signature.
2. Verify the digital signature. Use Interface X7. Specify the following parameters:

• TesterWMID - WM identifier of the merchant;
• ClientWMID - WM identifier of Merchant WebMoney Transfer that generates the digital signature of the payment notification. Its number is 967909998006.
• AccessMarker -string received at the first stage of sticking parameters of the 'Payment notification form ';
• ClientSignStr - control signature generated by Merchant WebMoney Transfer and transmitted to the website of the merchant in the 'Payment notification form' (the 'LMI_HASH' parameter);
• SignStr - digital signature of the request.

If the verification result is positive, the data has not been modified and has been sent by Merchant WebMoney Transfer.

Payment amount verification¶

The information forwarded through the parameter "LMI_PAYMENT_AMOUNT" containing the payment amount is to be obligatorily verified.

Verification of merchant's purse¶

Regardless of the fact that the customer cannot change the purse number we advise the merchant to verify the purse number transmitted in the 'LMI_PAYEE_PURSE' parameter, especially if he uses several purses in Merchant WebMoney Transfer.

Payment mode verification¶

Merchant WebMoney Transfer provides test payments. In order to set up the test mode, you should enable the 'Test/Work mode: '. The information about the current mode is transmitted in the 'LMI_MODE' parameter (1 - test mode, 0 - operative mode).
No real payments will be made in the test mode, but the service will transmit the data and imitate the payment.

Merchant WebMoney Transfer Testing¶

The 'Test/Work mode' parameter lets the merchants test the integration of their websites with Merchant WebMoney Transfer without making real payments. If the test mode is enabled the service will generate only test payments.

The merchant may set up the operative mode when he is sure that his website is integrated and operates correctly.

Samples¶

PHP

See also:
Checking transaction parameters, performed via Merchant WebMoney Transfer
Web Merchant Interface-Accepting payments via Paymer cheques WebMoney scratch cards or WM Note
Web Merchant Interface - Acceptance of payments from bank cards of Russian banks
Payment acceptance through bank cards P2P
Accepting payments in Bitcoin
Accepting payments in Ethereum
Accepting payments in USDT
Two Simple Steps to Accept WebMoney Payments
Merchant WebMoney Transfer
Paying for products and services using the Merchant service