Take payments the way Pakistan actually pays.

curl -X POST https://pakpay.org/api/v1/create.php \
  -d api_key=pk_live_xxx \
  -d order_id=INV-10428 \
  -d amount=2500.00 \
  -d return_url=https://yourstore.pk/thanks \
  -d sign=$SIGN

# { "status": true,
#   "payment_url": "https://pakpay.org/pay/?t=…",
#   "fee": 87.50, "net_amount": 2,412.50 }

$p = [
    'api_key'    => PAKPAY_PUBLIC,
    'order_id'   => 'INV-10428',
    'amount'     => '2500.00',
    'return_url' => 'https://yourstore.pk/thanks',
];
ksort($p);
$q = [];
foreach ($p as $k => $v) $q[] = "$k=$v";
$p['sign'] = hash_hmac('sha256', implode('&', $q), PAKPAY_SECRET);

$r = json_decode(file_get_contents(
    'https://pakpay.org/api/v1/create.php', false,
    stream_context_create(['http' => [
        'method'  => 'POST',
        'header'  => 'Content-Type: application/x-www-form-urlencoded',
        'content' => http_build_query($p),
    ]])
), true);

header('Location: ' . $r['payment_url']);

import crypto from 'node:crypto';

const p = {
  api_key:    process.env.PAKPAY_PUBLIC,
  order_id:   'INV-10428',
  amount:     '2500.00',
  return_url: 'https://yourstore.pk/thanks',
};

const base = Object.keys(p).sort().map(k => `${k}=${p[k]}`).join('&');
p.sign = crypto.createHmac('sha256', process.env.PAKPAY_SECRET)
               .update(base).digest('hex');

const res = await fetch('https://pakpay.org/api/v1/create.php', {
  method:  'POST',
  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
  body:    new URLSearchParams(p),
});

const { payment_url } = await res.json();

import hmac, hashlib, requests

p = {
    "api_key":    PAKPAY_PUBLIC,
    "order_id":   "INV-10428",
    "amount":     "2500.00",
    "return_url": "https://yourstore.pk/thanks",
}

base = "&".join(f"{k}={p[k]}" for k in sorted(p))
p["sign"] = hmac.new(
    PAKPAY_SECRET.encode(), base.encode(), hashlib.sha256
).hexdigest()

r = requests.post("https://pakpay.org/api/v1/create.php", data=p).json()
redirect(r["payment_url"])