FamUpiGateway REST API Reference

You are a senior Laravel payment-integration engineer and security reviewer.

Use the project’s existing controllers, services, models, migrations, middleware, routes, Blade views and .env/config architecture. Use Laravel DB transactions/locks and its HTTP client where appropriate.

I am attaching the COMPLETE source code of an EXISTING project. FIRST inspect the entire project and understand its current architecture, authentication, users, existing Deposit/Add Money/Wallet flow, database/schema, transaction tables, routes/controllers, callback handling, webhook handling and hosting constraints.

=== ABSOLUTE PROJECT PRESERVATION RULE — HIGHEST PRIORITY ===
THIS IS AN INTEGRATION-ONLY TASK. DO NOT REDESIGN, REBUILD, CLEAN UP, MODERNIZE OR REWRITE THE PROJECT. DO NOT REMOVE, DISABLE, RENAME, REPLACE OR CHANGE ANY EXISTING FEATURE, PAGE, LOGIN, REGISTER, OTP, ADMIN PANEL, USER PANEL, DASHBOARD, CSS, HTML, JavaScript, API, route, database table, authentication logic, permissions, settings or business logic unless a change is strictly necessary for the payment integration itself.

Keep the existing project 100% intact except for the MINIMUM files/lines required to connect the EXISTING Deposit / Add Money / Pay button and its existing amount field to FamGateway. NEVER remove a login page or any other page because it appears unrelated. NEVER replace the whole project with a new template or sample project. NEVER create a simplified replacement project.

Before editing, make a complete inventory of existing files/features. After editing, verify that every pre-existing feature and page still exists and that no unrelated file was deleted or overwritten. If something is not required for FamGateway payment integration, DO NOT TOUCH IT. Preserve existing UI, design, URLs, routes, sessions, database structure and user experience. If integration can be done by adding a small new payment service/callback/webhook file, prefer that over rewriting existing files. If an existing file must change, make the smallest possible surgical change and preserve all unrelated code exactly.

If you cannot safely integrate without changing unrelated functionality, STOP and clearly explain what exact dependency is blocking the integration. Do not invent a replacement.

DO NOT guess or replace the project architecture.

=== TASK ===
Fully integrate FamGateway (https://famgateway.shop) ONLY into the EXISTING Deposit / Add Money flow. The existing Deposit/Add Money/Pay button and amount input must remain the same UI and behavior except for the payment-provider handoff. Do not alter any unrelated feature. The user enters an amount, clicks the existing button, gets the real FamGateway payment page, and after successful payment the EXACT paid amount is credited to the correct user's existing wallet/account exactly once.

=== OFFICIAL GATEWAY ===
Base API: https://famgateway.shop/api
Create Order: POST https://famgateway.shop/api/create-order
Check Status: POST https://famgateway.shop/api/check-status
Auth header: X-API-Key: YOUR_FAMGATEWAY_API_KEY
Content-Type: application/json

Create Order JSON:
{
  "amount": 100.00,
  "order_id": "ORD_UNIQUE_ID",
  "customer_name": "User Name",
  "customer_mobile": "9876543210",
  "callback_url": "https://YOUR-PROJECT-DOMAIN.com/payment-callback.php",
  "description": "Wallet Deposit",
  "expiry_minutes": 5
}

Successful create-order response contains data.payment_url, data.order_id, data.token, data.amount and data.expires_at.

=== REQUIRED END-TO-END FLOW ===
1. Find the EXISTING Deposit/Add Money/Pay button and amount field. Preserve its UI.
2. Authenticate the current user on the server and validate the amount against the project's rules.
3. Create a unique local pending deposit/order BEFORE calling the gateway.
4. Call FamGateway create-order with the EXACT amount entered by the user.
5. Save gateway order_id/token/payment_url and the local user_id/order mapping.
6. Use expiry_minutes=5.
7. Generate callback_url automatically from the REAL deployed project domain.
8. Redirect the user to the returned payment_url.
9. On callback, call FamGateway check-status using the stored order_id.
10. Credit only when gateway status is successful/paid, gateway amount EXACTLY equals the local order amount, and the order belongs to the correct user.
11. Use a database transaction, unique order ID and/or row locking so repeated requests can NEVER double-credit.
12. Add a server-side webhook POST endpoint. Verify X-FamUpiGateway-Signature with the configured webhook secret when used, then verify the payment with check-status before crediting.
13. Callback and webhook must both be idempotent. Webhook is not the only source of truth.
14. Never trust amount, status, order_id or user_id supplied by browser JavaScript.
15. Handle pending, failed, expired, duplicate and already-paid cases safely.

=== DATABASE/WALLET ===
Reuse the project's EXISTING user/wallet/balance/deposit/transaction tables whenever possible. Do NOT create a second wallet system if one already exists. Add only the necessary columns/tables/indexes. Store gateway order_id as unique, local user/order mapping, amount, status, token/reference/UTR when available, timestamps and failure/pending information.

=== ONE CONFIG FILE ===
Create exactly ONE obvious server-side place for the real credentials, such as config/famgateway.php or .env:
FAMGATEWAY_BASE_URL=https://famgateway.shop/api
FAMGATEWAY_API_KEY=YOUR_FAMGATEWAY_API_KEY
FAMGATEWAY_WEBHOOK_SECRET=YOUR_WEBHOOK_SECRET_IF_USED
FAMGATEWAY_EXPIRY_MINUTES=5

The REAL API key must never be included in the prompt, frontend, HTML, JavaScript, public API response, logs, Git repository or screenshots. Tell me exactly which ONE file I must edit after upload.

=== SECURITY ===
Use server-side authentication, CSRF where applicable, prepared statements/ORM safety, HTTPS, output escaping, signature verification, idempotency and atomic wallet credit. Never log secrets. Never credit from a client-side success message alone.

=== HOSTING ===
Make the implementation suitable for the project's actual hosting. Avoid unnecessary Composer/dependencies where possible. For PHP/shared hosting, prefer plain PHP + cURL with a safe HTTPS-stream fallback when practical.

=== FINAL NO-REGRESSION CHECK — MANDATORY ===
Before returning the result, compare the original project with the modified project. Confirm that NO unrelated file, page, feature or functionality was removed or redesigned. Specifically verify that existing login, registration, OTP/authentication behavior, admin panel, user dashboard, CSS/theme, navigation, APIs, database tables and all non-payment features remain present and functional. Only payment-integration changes are allowed.

=== DELIVERABLE ===
Do the implementation against my attached source; do not merely explain it.
Return COMPLETE modified/new files, database migration/SQL, changed-file list, exact API-key location, exact callback URL, exact webhook URL, merchant-dashboard webhook setup, hosting/upload steps, ₹1/₹5 test procedure, expected success/pending/failed behaviour and final security checklist. If file creation is available, package everything as a ready-to-upload ZIP.

IMPORTANT: Preserve existing UI and working features. No pseudo-code, no incomplete snippets, no “you can implement this later”. Analyse first, implement second, test the integration logic third.

You are a senior Node.js/Express payment-integration engineer and security reviewer.

Use the project’s existing routes/controllers/services/models and database layer. Store secrets in environment variables and use the existing HTTP/database libraries.

I am attaching the COMPLETE source code of an EXISTING project. FIRST inspect the entire project and understand its current architecture, authentication, users, existing Deposit/Add Money/Wallet flow, database/schema, transaction tables, routes/controllers, callback handling, webhook handling and hosting constraints.

=== ABSOLUTE PROJECT PRESERVATION RULE — HIGHEST PRIORITY ===
THIS IS AN INTEGRATION-ONLY TASK. DO NOT REDESIGN, REBUILD, CLEAN UP, MODERNIZE OR REWRITE THE PROJECT. DO NOT REMOVE, DISABLE, RENAME, REPLACE OR CHANGE ANY EXISTING FEATURE, PAGE, LOGIN, REGISTER, OTP, ADMIN PANEL, USER PANEL, DASHBOARD, CSS, HTML, JavaScript, API, route, database table, authentication logic, permissions, settings or business logic unless a change is strictly necessary for the payment integration itself.

Keep the existing project 100% intact except for the MINIMUM files/lines required to connect the EXISTING Deposit / Add Money / Pay button and its existing amount field to FamGateway. NEVER remove a login page or any other page because it appears unrelated. NEVER replace the whole project with a new template or sample project. NEVER create a simplified replacement project.

Before editing, make a complete inventory of existing files/features. After editing, verify that every pre-existing feature and page still exists and that no unrelated file was deleted or overwritten. If something is not required for FamGateway payment integration, DO NOT TOUCH IT. Preserve existing UI, design, URLs, routes, sessions, database structure and user experience. If integration can be done by adding a small new payment service/callback/webhook file, prefer that over rewriting existing files. If an existing file must change, make the smallest possible surgical change and preserve all unrelated code exactly.

If you cannot safely integrate without changing unrelated functionality, STOP and clearly explain what exact dependency is blocking the integration. Do not invent a replacement.

DO NOT guess or replace the project architecture.

=== TASK ===
Fully integrate FamGateway (https://famgateway.shop) ONLY into the EXISTING Deposit / Add Money flow. The existing Deposit/Add Money/Pay button and amount input must remain the same UI and behavior except for the payment-provider handoff. Do not alter any unrelated feature. The user enters an amount, clicks the existing button, gets the real FamGateway payment page, and after successful payment the EXACT paid amount is credited to the correct user's existing wallet/account exactly once.

=== OFFICIAL GATEWAY ===
Base API: https://famgateway.shop/api
Create Order: POST https://famgateway.shop/api/create-order
Check Status: POST https://famgateway.shop/api/check-status
Auth header: X-API-Key: YOUR_FAMGATEWAY_API_KEY
Content-Type: application/json

Create Order JSON:
{
  "amount": 100.00,
  "order_id": "ORD_UNIQUE_ID",
  "customer_name": "User Name",
  "customer_mobile": "9876543210",
  "callback_url": "https://YOUR-PROJECT-DOMAIN.com/payment-callback.php",
  "description": "Wallet Deposit",
  "expiry_minutes": 5
}

Successful create-order response contains data.payment_url, data.order_id, data.token, data.amount and data.expires_at.

=== REQUIRED END-TO-END FLOW ===
1. Find the EXISTING Deposit/Add Money/Pay button and amount field. Preserve its UI.
2. Authenticate the current user on the server and validate the amount against the project's rules.
3. Create a unique local pending deposit/order BEFORE calling the gateway.
4. Call FamGateway create-order with the EXACT amount entered by the user.
5. Save gateway order_id/token/payment_url and the local user_id/order mapping.
6. Use expiry_minutes=5.
7. Generate callback_url automatically from the REAL deployed project domain.
8. Redirect the user to the returned payment_url.
9. On callback, call FamGateway check-status using the stored order_id.
10. Credit only when gateway status is successful/paid, gateway amount EXACTLY equals the local order amount, and the order belongs to the correct user.
11. Use a database transaction, unique order ID and/or row locking so repeated requests can NEVER double-credit.
12. Add a server-side webhook POST endpoint. Verify X-FamUpiGateway-Signature with the configured webhook secret when used, then verify the payment with check-status before crediting.
13. Callback and webhook must both be idempotent. Webhook is not the only source of truth.
14. Never trust amount, status, order_id or user_id supplied by browser JavaScript.
15. Handle pending, failed, expired, duplicate and already-paid cases safely.

=== DATABASE/WALLET ===
Reuse the project's EXISTING user/wallet/balance/deposit/transaction tables whenever possible. Do NOT create a second wallet system if one already exists. Add only the necessary columns/tables/indexes. Store gateway order_id as unique, local user/order mapping, amount, status, token/reference/UTR when available, timestamps and failure/pending information.

=== ONE CONFIG FILE ===
Create exactly ONE obvious server-side place for the real credentials, such as config/famgateway.php or .env:
FAMGATEWAY_BASE_URL=https://famgateway.shop/api
FAMGATEWAY_API_KEY=YOUR_FAMGATEWAY_API_KEY
FAMGATEWAY_WEBHOOK_SECRET=YOUR_WEBHOOK_SECRET_IF_USED
FAMGATEWAY_EXPIRY_MINUTES=5

The REAL API key must never be included in the prompt, frontend, HTML, JavaScript, public API response, logs, Git repository or screenshots. Tell me exactly which ONE file I must edit after upload.

=== SECURITY ===
Use server-side authentication, CSRF where applicable, prepared statements/ORM safety, HTTPS, output escaping, signature verification, idempotency and atomic wallet credit. Never log secrets. Never credit from a client-side success message alone.

=== HOSTING ===
Make the implementation suitable for the project's actual hosting. Avoid unnecessary Composer/dependencies where possible. For PHP/shared hosting, prefer plain PHP + cURL with a safe HTTPS-stream fallback when practical.

=== FINAL NO-REGRESSION CHECK — MANDATORY ===
Before returning the result, compare the original project with the modified project. Confirm that NO unrelated file, page, feature or functionality was removed or redesigned. Specifically verify that existing login, registration, OTP/authentication behavior, admin panel, user dashboard, CSS/theme, navigation, APIs, database tables and all non-payment features remain present and functional. Only payment-integration changes are allowed.

=== DELIVERABLE ===
Do the implementation against my attached source; do not merely explain it.
Return COMPLETE modified/new files, database migration/SQL, changed-file list, exact API-key location, exact callback URL, exact webhook URL, merchant-dashboard webhook setup, hosting/upload steps, ₹1/₹5 test procedure, expected success/pending/failed behaviour and final security checklist. If file creation is available, package everything as a ready-to-upload ZIP.

IMPORTANT: Preserve existing UI and working features. No pseudo-code, no incomplete snippets, no “you can implement this later”. Analyse first, implement second, test the integration logic third.

You are a senior Python payment-integration engineer and security reviewer.

Detect whether the project is Flask, Django, FastAPI or another framework and use its existing architecture, ORM/database and routing.

I am attaching the COMPLETE source code of an EXISTING project. FIRST inspect the entire project and understand its current architecture, authentication, users, existing Deposit/Add Money/Wallet flow, database/schema, transaction tables, routes/controllers, callback handling, webhook handling and hosting constraints.

=== ABSOLUTE PROJECT PRESERVATION RULE — HIGHEST PRIORITY ===
THIS IS AN INTEGRATION-ONLY TASK. DO NOT REDESIGN, REBUILD, CLEAN UP, MODERNIZE OR REWRITE THE PROJECT. DO NOT REMOVE, DISABLE, RENAME, REPLACE OR CHANGE ANY EXISTING FEATURE, PAGE, LOGIN, REGISTER, OTP, ADMIN PANEL, USER PANEL, DASHBOARD, CSS, HTML, JavaScript, API, route, database table, authentication logic, permissions, settings or business logic unless a change is strictly necessary for the payment integration itself.

Keep the existing project 100% intact except for the MINIMUM files/lines required to connect the EXISTING Deposit / Add Money / Pay button and its existing amount field to FamGateway. NEVER remove a login page or any other page because it appears unrelated. NEVER replace the whole project with a new template or sample project. NEVER create a simplified replacement project.

Before editing, make a complete inventory of existing files/features. After editing, verify that every pre-existing feature and page still exists and that no unrelated file was deleted or overwritten. If something is not required for FamGateway payment integration, DO NOT TOUCH IT. Preserve existing UI, design, URLs, routes, sessions, database structure and user experience. If integration can be done by adding a small new payment service/callback/webhook file, prefer that over rewriting existing files. If an existing file must change, make the smallest possible surgical change and preserve all unrelated code exactly.

If you cannot safely integrate without changing unrelated functionality, STOP and clearly explain what exact dependency is blocking the integration. Do not invent a replacement.

DO NOT guess or replace the project architecture.

=== TASK ===
Fully integrate FamGateway (https://famgateway.shop) ONLY into the EXISTING Deposit / Add Money flow. The existing Deposit/Add Money/Pay button and amount input must remain the same UI and behavior except for the payment-provider handoff. Do not alter any unrelated feature. The user enters an amount, clicks the existing button, gets the real FamGateway payment page, and after successful payment the EXACT paid amount is credited to the correct user's existing wallet/account exactly once.

=== OFFICIAL GATEWAY ===
Base API: https://famgateway.shop/api
Create Order: POST https://famgateway.shop/api/create-order
Check Status: POST https://famgateway.shop/api/check-status
Auth header: X-API-Key: YOUR_FAMGATEWAY_API_KEY
Content-Type: application/json

Create Order JSON:
{
  "amount": 100.00,
  "order_id": "ORD_UNIQUE_ID",
  "customer_name": "User Name",
  "customer_mobile": "9876543210",
  "callback_url": "https://YOUR-PROJECT-DOMAIN.com/payment-callback.php",
  "description": "Wallet Deposit",
  "expiry_minutes": 5
}

Successful create-order response contains data.payment_url, data.order_id, data.token, data.amount and data.expires_at.

=== REQUIRED END-TO-END FLOW ===
1. Find the EXISTING Deposit/Add Money/Pay button and amount field. Preserve its UI.
2. Authenticate the current user on the server and validate the amount against the project's rules.
3. Create a unique local pending deposit/order BEFORE calling the gateway.
4. Call FamGateway create-order with the EXACT amount entered by the user.
5. Save gateway order_id/token/payment_url and the local user_id/order mapping.
6. Use expiry_minutes=5.
7. Generate callback_url automatically from the REAL deployed project domain.
8. Redirect the user to the returned payment_url.
9. On callback, call FamGateway check-status using the stored order_id.
10. Credit only when gateway status is successful/paid, gateway amount EXACTLY equals the local order amount, and the order belongs to the correct user.
11. Use a database transaction, unique order ID and/or row locking so repeated requests can NEVER double-credit.
12. Add a server-side webhook POST endpoint. Verify X-FamUpiGateway-Signature with the configured webhook secret when used, then verify the payment with check-status before crediting.
13. Callback and webhook must both be idempotent. Webhook is not the only source of truth.
14. Never trust amount, status, order_id or user_id supplied by browser JavaScript.
15. Handle pending, failed, expired, duplicate and already-paid cases safely.

=== DATABASE/WALLET ===
Reuse the project's EXISTING user/wallet/balance/deposit/transaction tables whenever possible. Do NOT create a second wallet system if one already exists. Add only the necessary columns/tables/indexes. Store gateway order_id as unique, local user/order mapping, amount, status, token/reference/UTR when available, timestamps and failure/pending information.

=== ONE CONFIG FILE ===
Create exactly ONE obvious server-side place for the real credentials, such as config/famgateway.php or .env:
FAMGATEWAY_BASE_URL=https://famgateway.shop/api
FAMGATEWAY_API_KEY=YOUR_FAMGATEWAY_API_KEY
FAMGATEWAY_WEBHOOK_SECRET=YOUR_WEBHOOK_SECRET_IF_USED
FAMGATEWAY_EXPIRY_MINUTES=5

The REAL API key must never be included in the prompt, frontend, HTML, JavaScript, public API response, logs, Git repository or screenshots. Tell me exactly which ONE file I must edit after upload.

=== SECURITY ===
Use server-side authentication, CSRF where applicable, prepared statements/ORM safety, HTTPS, output escaping, signature verification, idempotency and atomic wallet credit. Never log secrets. Never credit from a client-side success message alone.

=== HOSTING ===
Make the implementation suitable for the project's actual hosting. Avoid unnecessary Composer/dependencies where possible. For PHP/shared hosting, prefer plain PHP + cURL with a safe HTTPS-stream fallback when practical.

=== FINAL NO-REGRESSION CHECK — MANDATORY ===
Before returning the result, compare the original project with the modified project. Confirm that NO unrelated file, page, feature or functionality was removed or redesigned. Specifically verify that existing login, registration, OTP/authentication behavior, admin panel, user dashboard, CSS/theme, navigation, APIs, database tables and all non-payment features remain present and functional. Only payment-integration changes are allowed.

=== DELIVERABLE ===
Do the implementation against my attached source; do not merely explain it.
Return COMPLETE modified/new files, database migration/SQL, changed-file list, exact API-key location, exact callback URL, exact webhook URL, merchant-dashboard webhook setup, hosting/upload steps, ₹1/₹5 test procedure, expected success/pending/failed behaviour and final security checklist. If file creation is available, package everything as a ready-to-upload ZIP.

IMPORTANT: Preserve existing UI and working features. No pseudo-code, no incomplete snippets, no “you can implement this later”. Analyse first, implement second, test the integration logic third.

You are a senior web/payment-security engineer.

This project may be static HTML/JS. If no backend exists, add the smallest secure server-side backend required; NEVER put the FamGateway API key in frontend JavaScript. LocalStorage-only wallet balances are not acceptable for a real payment wallet.

I am attaching the COMPLETE source code of an EXISTING project. FIRST inspect the entire project and understand its current architecture, authentication, users, existing Deposit/Add Money/Wallet flow, database/schema, transaction tables, routes/controllers, callback handling, webhook handling and hosting constraints.

=== ABSOLUTE PROJECT PRESERVATION RULE — HIGHEST PRIORITY ===
THIS IS AN INTEGRATION-ONLY TASK. DO NOT REDESIGN, REBUILD, CLEAN UP, MODERNIZE OR REWRITE THE PROJECT. DO NOT REMOVE, DISABLE, RENAME, REPLACE OR CHANGE ANY EXISTING FEATURE, PAGE, LOGIN, REGISTER, OTP, ADMIN PANEL, USER PANEL, DASHBOARD, CSS, HTML, JavaScript, API, route, database table, authentication logic, permissions, settings or business logic unless a change is strictly necessary for the payment integration itself.

Keep the existing project 100% intact except for the MINIMUM files/lines required to connect the EXISTING Deposit / Add Money / Pay button and its existing amount field to FamGateway. NEVER remove a login page or any other page because it appears unrelated. NEVER replace the whole project with a new template or sample project. NEVER create a simplified replacement project.

Before editing, make a complete inventory of existing files/features. After editing, verify that every pre-existing feature and page still exists and that no unrelated file was deleted or overwritten. If something is not required for FamGateway payment integration, DO NOT TOUCH IT. Preserve existing UI, design, URLs, routes, sessions, database structure and user experience. If integration can be done by adding a small new payment service/callback/webhook file, prefer that over rewriting existing files. If an existing file must change, make the smallest possible surgical change and preserve all unrelated code exactly.

If you cannot safely integrate without changing unrelated functionality, STOP and clearly explain what exact dependency is blocking the integration. Do not invent a replacement.

DO NOT guess or replace the project architecture.

=== TASK ===
Fully integrate FamGateway (https://famgateway.shop) ONLY into the EXISTING Deposit / Add Money flow. The existing Deposit/Add Money/Pay button and amount input must remain the same UI and behavior except for the payment-provider handoff. Do not alter any unrelated feature. The user enters an amount, clicks the existing button, gets the real FamGateway payment page, and after successful payment the EXACT paid amount is credited to the correct user's existing wallet/account exactly once.

=== OFFICIAL GATEWAY ===
Base API: https://famgateway.shop/api
Create Order: POST https://famgateway.shop/api/create-order
Check Status: POST https://famgateway.shop/api/check-status
Auth header: X-API-Key: YOUR_FAMGATEWAY_API_KEY
Content-Type: application/json

Create Order JSON:
{
  "amount": 100.00,
  "order_id": "ORD_UNIQUE_ID",
  "customer_name": "User Name",
  "customer_mobile": "9876543210",
  "callback_url": "https://YOUR-PROJECT-DOMAIN.com/payment-callback.php",
  "description": "Wallet Deposit",
  "expiry_minutes": 5
}

Successful create-order response contains data.payment_url, data.order_id, data.token, data.amount and data.expires_at.

=== REQUIRED END-TO-END FLOW ===
1. Find the EXISTING Deposit/Add Money/Pay button and amount field. Preserve its UI.
2. Authenticate the current user on the server and validate the amount against the project's rules.
3. Create a unique local pending deposit/order BEFORE calling the gateway.
4. Call FamGateway create-order with the EXACT amount entered by the user.
5. Save gateway order_id/token/payment_url and the local user_id/order mapping.
6. Use expiry_minutes=5.
7. Generate callback_url automatically from the REAL deployed project domain.
8. Redirect the user to the returned payment_url.
9. On callback, call FamGateway check-status using the stored order_id.
10. Credit only when gateway status is successful/paid, gateway amount EXACTLY equals the local order amount, and the order belongs to the correct user.
11. Use a database transaction, unique order ID and/or row locking so repeated requests can NEVER double-credit.
12. Add a server-side webhook POST endpoint. Verify X-FamUpiGateway-Signature with the configured webhook secret when used, then verify the payment with check-status before crediting.
13. Callback and webhook must both be idempotent. Webhook is not the only source of truth.
14. Never trust amount, status, order_id or user_id supplied by browser JavaScript.
15. Handle pending, failed, expired, duplicate and already-paid cases safely.

=== DATABASE/WALLET ===
Reuse the project's EXISTING user/wallet/balance/deposit/transaction tables whenever possible. Do NOT create a second wallet system if one already exists. Add only the necessary columns/tables/indexes. Store gateway order_id as unique, local user/order mapping, amount, status, token/reference/UTR when available, timestamps and failure/pending information.

=== ONE CONFIG FILE ===
Create exactly ONE obvious server-side place for the real credentials, such as config/famgateway.php or .env:
FAMGATEWAY_BASE_URL=https://famgateway.shop/api
FAMGATEWAY_API_KEY=YOUR_FAMGATEWAY_API_KEY
FAMGATEWAY_WEBHOOK_SECRET=YOUR_WEBHOOK_SECRET_IF_USED
FAMGATEWAY_EXPIRY_MINUTES=5

The REAL API key must never be included in the prompt, frontend, HTML, JavaScript, public API response, logs, Git repository or screenshots. Tell me exactly which ONE file I must edit after upload.

=== SECURITY ===
Use server-side authentication, CSRF where applicable, prepared statements/ORM safety, HTTPS, output escaping, signature verification, idempotency and atomic wallet credit. Never log secrets. Never credit from a client-side success message alone.

=== HOSTING ===
Make the implementation suitable for the project's actual hosting. Avoid unnecessary Composer/dependencies where possible. For PHP/shared hosting, prefer plain PHP + cURL with a safe HTTPS-stream fallback when practical.

=== FINAL NO-REGRESSION CHECK — MANDATORY ===
Before returning the result, compare the original project with the modified project. Confirm that NO unrelated file, page, feature or functionality was removed or redesigned. Specifically verify that existing login, registration, OTP/authentication behavior, admin panel, user dashboard, CSS/theme, navigation, APIs, database tables and all non-payment features remain present and functional. Only payment-integration changes are allowed.

=== DELIVERABLE ===
Do the implementation against my attached source; do not merely explain it.
Return COMPLETE modified/new files, database migration/SQL, changed-file list, exact API-key location, exact callback URL, exact webhook URL, merchant-dashboard webhook setup, hosting/upload steps, ₹1/₹5 test procedure, expected success/pending/failed behaviour and final security checklist. If file creation is available, package everything as a ready-to-upload ZIP.

IMPORTANT: Preserve existing UI and working features. No pseudo-code, no incomplete snippets, no “you can implement this later”. Analyse first, implement second, test the integration logic third.

You are a senior Java/Spring Boot payment-integration engineer and security reviewer.

Use the project’s existing controllers/services/entities/repositories/configuration and database transactions.

I am attaching the COMPLETE source code of an EXISTING project. FIRST inspect the entire project and understand its current architecture, authentication, users, existing Deposit/Add Money/Wallet flow, database/schema, transaction tables, routes/controllers, callback handling, webhook handling and hosting constraints.

=== ABSOLUTE PROJECT PRESERVATION RULE — HIGHEST PRIORITY ===
THIS IS AN INTEGRATION-ONLY TASK. DO NOT REDESIGN, REBUILD, CLEAN UP, MODERNIZE OR REWRITE THE PROJECT. DO NOT REMOVE, DISABLE, RENAME, REPLACE OR CHANGE ANY EXISTING FEATURE, PAGE, LOGIN, REGISTER, OTP, ADMIN PANEL, USER PANEL, DASHBOARD, CSS, HTML, JavaScript, API, route, database table, authentication logic, permissions, settings or business logic unless a change is strictly necessary for the payment integration itself.

Keep the existing project 100% intact except for the MINIMUM files/lines required to connect the EXISTING Deposit / Add Money / Pay button and its existing amount field to FamGateway. NEVER remove a login page or any other page because it appears unrelated. NEVER replace the whole project with a new template or sample project. NEVER create a simplified replacement project.

Before editing, make a complete inventory of existing files/features. After editing, verify that every pre-existing feature and page still exists and that no unrelated file was deleted or overwritten. If something is not required for FamGateway payment integration, DO NOT TOUCH IT. Preserve existing UI, design, URLs, routes, sessions, database structure and user experience. If integration can be done by adding a small new payment service/callback/webhook file, prefer that over rewriting existing files. If an existing file must change, make the smallest possible surgical change and preserve all unrelated code exactly.

If you cannot safely integrate without changing unrelated functionality, STOP and clearly explain what exact dependency is blocking the integration. Do not invent a replacement.

DO NOT guess or replace the project architecture.

=== TASK ===
Fully integrate FamGateway (https://famgateway.shop) ONLY into the EXISTING Deposit / Add Money flow. The existing Deposit/Add Money/Pay button and amount input must remain the same UI and behavior except for the payment-provider handoff. Do not alter any unrelated feature. The user enters an amount, clicks the existing button, gets the real FamGateway payment page, and after successful payment the EXACT paid amount is credited to the correct user's existing wallet/account exactly once.

=== OFFICIAL GATEWAY ===
Base API: https://famgateway.shop/api
Create Order: POST https://famgateway.shop/api/create-order
Check Status: POST https://famgateway.shop/api/check-status
Auth header: X-API-Key: YOUR_FAMGATEWAY_API_KEY
Content-Type: application/json

Create Order JSON:
{
  "amount": 100.00,
  "order_id": "ORD_UNIQUE_ID",
  "customer_name": "User Name",
  "customer_mobile": "9876543210",
  "callback_url": "https://YOUR-PROJECT-DOMAIN.com/payment-callback.php",
  "description": "Wallet Deposit",
  "expiry_minutes": 5
}

Successful create-order response contains data.payment_url, data.order_id, data.token, data.amount and data.expires_at.

=== REQUIRED END-TO-END FLOW ===
1. Find the EXISTING Deposit/Add Money/Pay button and amount field. Preserve its UI.
2. Authenticate the current user on the server and validate the amount against the project's rules.
3. Create a unique local pending deposit/order BEFORE calling the gateway.
4. Call FamGateway create-order with the EXACT amount entered by the user.
5. Save gateway order_id/token/payment_url and the local user_id/order mapping.
6. Use expiry_minutes=5.
7. Generate callback_url automatically from the REAL deployed project domain.
8. Redirect the user to the returned payment_url.
9. On callback, call FamGateway check-status using the stored order_id.
10. Credit only when gateway status is successful/paid, gateway amount EXACTLY equals the local order amount, and the order belongs to the correct user.
11. Use a database transaction, unique order ID and/or row locking so repeated requests can NEVER double-credit.
12. Add a server-side webhook POST endpoint. Verify X-FamUpiGateway-Signature with the configured webhook secret when used, then verify the payment with check-status before crediting.
13. Callback and webhook must both be idempotent. Webhook is not the only source of truth.
14. Never trust amount, status, order_id or user_id supplied by browser JavaScript.
15. Handle pending, failed, expired, duplicate and already-paid cases safely.

=== DATABASE/WALLET ===
Reuse the project's EXISTING user/wallet/balance/deposit/transaction tables whenever possible. Do NOT create a second wallet system if one already exists. Add only the necessary columns/tables/indexes. Store gateway order_id as unique, local user/order mapping, amount, status, token/reference/UTR when available, timestamps and failure/pending information.

=== ONE CONFIG FILE ===
Create exactly ONE obvious server-side place for the real credentials, such as config/famgateway.php or .env:
FAMGATEWAY_BASE_URL=https://famgateway.shop/api
FAMGATEWAY_API_KEY=YOUR_FAMGATEWAY_API_KEY
FAMGATEWAY_WEBHOOK_SECRET=YOUR_WEBHOOK_SECRET_IF_USED
FAMGATEWAY_EXPIRY_MINUTES=5

The REAL API key must never be included in the prompt, frontend, HTML, JavaScript, public API response, logs, Git repository or screenshots. Tell me exactly which ONE file I must edit after upload.

=== SECURITY ===
Use server-side authentication, CSRF where applicable, prepared statements/ORM safety, HTTPS, output escaping, signature verification, idempotency and atomic wallet credit. Never log secrets. Never credit from a client-side success message alone.

=== HOSTING ===
Make the implementation suitable for the project's actual hosting. Avoid unnecessary Composer/dependencies where possible. For PHP/shared hosting, prefer plain PHP + cURL with a safe HTTPS-stream fallback when practical.

=== FINAL NO-REGRESSION CHECK — MANDATORY ===
Before returning the result, compare the original project with the modified project. Confirm that NO unrelated file, page, feature or functionality was removed or redesigned. Specifically verify that existing login, registration, OTP/authentication behavior, admin panel, user dashboard, CSS/theme, navigation, APIs, database tables and all non-payment features remain present and functional. Only payment-integration changes are allowed.

=== DELIVERABLE ===
Do the implementation against my attached source; do not merely explain it.
Return COMPLETE modified/new files, database migration/SQL, changed-file list, exact API-key location, exact callback URL, exact webhook URL, merchant-dashboard webhook setup, hosting/upload steps, ₹1/₹5 test procedure, expected success/pending/failed behaviour and final security checklist. If file creation is available, package everything as a ready-to-upload ZIP.

IMPORTANT: Preserve existing UI and working features. No pseudo-code, no incomplete snippets, no “you can implement this later”. Analyse first, implement second, test the integration logic third.

You are a senior C#/.NET payment-integration engineer and security reviewer.

Use the existing ASP.NET controllers/services/EF Core/database/configuration and transaction mechanisms.

I am attaching the COMPLETE source code of an EXISTING project. FIRST inspect the entire project and understand its current architecture, authentication, users, existing Deposit/Add Money/Wallet flow, database/schema, transaction tables, routes/controllers, callback handling, webhook handling and hosting constraints.

=== ABSOLUTE PROJECT PRESERVATION RULE — HIGHEST PRIORITY ===
THIS IS AN INTEGRATION-ONLY TASK. DO NOT REDESIGN, REBUILD, CLEAN UP, MODERNIZE OR REWRITE THE PROJECT. DO NOT REMOVE, DISABLE, RENAME, REPLACE OR CHANGE ANY EXISTING FEATURE, PAGE, LOGIN, REGISTER, OTP, ADMIN PANEL, USER PANEL, DASHBOARD, CSS, HTML, JavaScript, API, route, database table, authentication logic, permissions, settings or business logic unless a change is strictly necessary for the payment integration itself.

Keep the existing project 100% intact except for the MINIMUM files/lines required to connect the EXISTING Deposit / Add Money / Pay button and its existing amount field to FamGateway. NEVER remove a login page or any other page because it appears unrelated. NEVER replace the whole project with a new template or sample project. NEVER create a simplified replacement project.

Before editing, make a complete inventory of existing files/features. After editing, verify that every pre-existing feature and page still exists and that no unrelated file was deleted or overwritten. If something is not required for FamGateway payment integration, DO NOT TOUCH IT. Preserve existing UI, design, URLs, routes, sessions, database structure and user experience. If integration can be done by adding a small new payment service/callback/webhook file, prefer that over rewriting existing files. If an existing file must change, make the smallest possible surgical change and preserve all unrelated code exactly.

If you cannot safely integrate without changing unrelated functionality, STOP and clearly explain what exact dependency is blocking the integration. Do not invent a replacement.

DO NOT guess or replace the project architecture.

=== TASK ===
Fully integrate FamGateway (https://famgateway.shop) ONLY into the EXISTING Deposit / Add Money flow. The existing Deposit/Add Money/Pay button and amount input must remain the same UI and behavior except for the payment-provider handoff. Do not alter any unrelated feature. The user enters an amount, clicks the existing button, gets the real FamGateway payment page, and after successful payment the EXACT paid amount is credited to the correct user's existing wallet/account exactly once.

=== OFFICIAL GATEWAY ===
Base API: https://famgateway.shop/api
Create Order: POST https://famgateway.shop/api/create-order
Check Status: POST https://famgateway.shop/api/check-status
Auth header: X-API-Key: YOUR_FAMGATEWAY_API_KEY
Content-Type: application/json

Create Order JSON:
{
  "amount": 100.00,
  "order_id": "ORD_UNIQUE_ID",
  "customer_name": "User Name",
  "customer_mobile": "9876543210",
  "callback_url": "https://YOUR-PROJECT-DOMAIN.com/payment-callback.php",
  "description": "Wallet Deposit",
  "expiry_minutes": 5
}

Successful create-order response contains data.payment_url, data.order_id, data.token, data.amount and data.expires_at.

=== REQUIRED END-TO-END FLOW ===
1. Find the EXISTING Deposit/Add Money/Pay button and amount field. Preserve its UI.
2. Authenticate the current user on the server and validate the amount against the project's rules.
3. Create a unique local pending deposit/order BEFORE calling the gateway.
4. Call FamGateway create-order with the EXACT amount entered by the user.
5. Save gateway order_id/token/payment_url and the local user_id/order mapping.
6. Use expiry_minutes=5.
7. Generate callback_url automatically from the REAL deployed project domain.
8. Redirect the user to the returned payment_url.
9. On callback, call FamGateway check-status using the stored order_id.
10. Credit only when gateway status is successful/paid, gateway amount EXACTLY equals the local order amount, and the order belongs to the correct user.
11. Use a database transaction, unique order ID and/or row locking so repeated requests can NEVER double-credit.
12. Add a server-side webhook POST endpoint. Verify X-FamUpiGateway-Signature with the configured webhook secret when used, then verify the payment with check-status before crediting.
13. Callback and webhook must both be idempotent. Webhook is not the only source of truth.
14. Never trust amount, status, order_id or user_id supplied by browser JavaScript.
15. Handle pending, failed, expired, duplicate and already-paid cases safely.

=== DATABASE/WALLET ===
Reuse the project's EXISTING user/wallet/balance/deposit/transaction tables whenever possible. Do NOT create a second wallet system if one already exists. Add only the necessary columns/tables/indexes. Store gateway order_id as unique, local user/order mapping, amount, status, token/reference/UTR when available, timestamps and failure/pending information.

=== ONE CONFIG FILE ===
Create exactly ONE obvious server-side place for the real credentials, such as config/famgateway.php or .env:
FAMGATEWAY_BASE_URL=https://famgateway.shop/api
FAMGATEWAY_API_KEY=YOUR_FAMGATEWAY_API_KEY
FAMGATEWAY_WEBHOOK_SECRET=YOUR_WEBHOOK_SECRET_IF_USED
FAMGATEWAY_EXPIRY_MINUTES=5

The REAL API key must never be included in the prompt, frontend, HTML, JavaScript, public API response, logs, Git repository or screenshots. Tell me exactly which ONE file I must edit after upload.

=== SECURITY ===
Use server-side authentication, CSRF where applicable, prepared statements/ORM safety, HTTPS, output escaping, signature verification, idempotency and atomic wallet credit. Never log secrets. Never credit from a client-side success message alone.

=== HOSTING ===
Make the implementation suitable for the project's actual hosting. Avoid unnecessary Composer/dependencies where possible. For PHP/shared hosting, prefer plain PHP + cURL with a safe HTTPS-stream fallback when practical.

=== FINAL NO-REGRESSION CHECK — MANDATORY ===
Before returning the result, compare the original project with the modified project. Confirm that NO unrelated file, page, feature or functionality was removed or redesigned. Specifically verify that existing login, registration, OTP/authentication behavior, admin panel, user dashboard, CSS/theme, navigation, APIs, database tables and all non-payment features remain present and functional. Only payment-integration changes are allowed.

=== DELIVERABLE ===
Do the implementation against my attached source; do not merely explain it.
Return COMPLETE modified/new files, database migration/SQL, changed-file list, exact API-key location, exact callback URL, exact webhook URL, merchant-dashboard webhook setup, hosting/upload steps, ₹1/₹5 test procedure, expected success/pending/failed behaviour and final security checklist. If file creation is available, package everything as a ready-to-upload ZIP.

IMPORTANT: Preserve existing UI and working features. No pseudo-code, no incomplete snippets, no “you can implement this later”. Analyse first, implement second, test the integration logic third.

You are a senior Go payment/API engineer and security reviewer.

Use the project’s existing handlers/services/database and environment configuration. Keep the implementation idiomatic and dependency-light.

I am attaching the COMPLETE source code of an EXISTING project. FIRST inspect the entire project and understand its current architecture, authentication, users, existing Deposit/Add Money/Wallet flow, database/schema, transaction tables, routes/controllers, callback handling, webhook handling and hosting constraints.

=== ABSOLUTE PROJECT PRESERVATION RULE — HIGHEST PRIORITY ===
THIS IS AN INTEGRATION-ONLY TASK. DO NOT REDESIGN, REBUILD, CLEAN UP, MODERNIZE OR REWRITE THE PROJECT. DO NOT REMOVE, DISABLE, RENAME, REPLACE OR CHANGE ANY EXISTING FEATURE, PAGE, LOGIN, REGISTER, OTP, ADMIN PANEL, USER PANEL, DASHBOARD, CSS, HTML, JavaScript, API, route, database table, authentication logic, permissions, settings or business logic unless a change is strictly necessary for the payment integration itself.

Keep the existing project 100% intact except for the MINIMUM files/lines required to connect the EXISTING Deposit / Add Money / Pay button and its existing amount field to FamGateway. NEVER remove a login page or any other page because it appears unrelated. NEVER replace the whole project with a new template or sample project. NEVER create a simplified replacement project.

Before editing, make a complete inventory of existing files/features. After editing, verify that every pre-existing feature and page still exists and that no unrelated file was deleted or overwritten. If something is not required for FamGateway payment integration, DO NOT TOUCH IT. Preserve existing UI, design, URLs, routes, sessions, database structure and user experience. If integration can be done by adding a small new payment service/callback/webhook file, prefer that over rewriting existing files. If an existing file must change, make the smallest possible surgical change and preserve all unrelated code exactly.

If you cannot safely integrate without changing unrelated functionality, STOP and clearly explain what exact dependency is blocking the integration. Do not invent a replacement.

DO NOT guess or replace the project architecture.

=== TASK ===
Fully integrate FamGateway (https://famgateway.shop) ONLY into the EXISTING Deposit / Add Money flow. The existing Deposit/Add Money/Pay button and amount input must remain the same UI and behavior except for the payment-provider handoff. Do not alter any unrelated feature. The user enters an amount, clicks the existing button, gets the real FamGateway payment page, and after successful payment the EXACT paid amount is credited to the correct user's existing wallet/account exactly once.

=== OFFICIAL GATEWAY ===
Base API: https://famgateway.shop/api
Create Order: POST https://famgateway.shop/api/create-order
Check Status: POST https://famgateway.shop/api/check-status
Auth header: X-API-Key: YOUR_FAMGATEWAY_API_KEY
Content-Type: application/json

Create Order JSON:
{
  "amount": 100.00,
  "order_id": "ORD_UNIQUE_ID",
  "customer_name": "User Name",
  "customer_mobile": "9876543210",
  "callback_url": "https://YOUR-PROJECT-DOMAIN.com/payment-callback.php",
  "description": "Wallet Deposit",
  "expiry_minutes": 5
}

Successful create-order response contains data.payment_url, data.order_id, data.token, data.amount and data.expires_at.

=== REQUIRED END-TO-END FLOW ===
1. Find the EXISTING Deposit/Add Money/Pay button and amount field. Preserve its UI.
2. Authenticate the current user on the server and validate the amount against the project's rules.
3. Create a unique local pending deposit/order BEFORE calling the gateway.
4. Call FamGateway create-order with the EXACT amount entered by the user.
5. Save gateway order_id/token/payment_url and the local user_id/order mapping.
6. Use expiry_minutes=5.
7. Generate callback_url automatically from the REAL deployed project domain.
8. Redirect the user to the returned payment_url.
9. On callback, call FamGateway check-status using the stored order_id.
10. Credit only when gateway status is successful/paid, gateway amount EXACTLY equals the local order amount, and the order belongs to the correct user.
11. Use a database transaction, unique order ID and/or row locking so repeated requests can NEVER double-credit.
12. Add a server-side webhook POST endpoint. Verify X-FamUpiGateway-Signature with the configured webhook secret when used, then verify the payment with check-status before crediting.
13. Callback and webhook must both be idempotent. Webhook is not the only source of truth.
14. Never trust amount, status, order_id or user_id supplied by browser JavaScript.
15. Handle pending, failed, expired, duplicate and already-paid cases safely.

=== DATABASE/WALLET ===
Reuse the project's EXISTING user/wallet/balance/deposit/transaction tables whenever possible. Do NOT create a second wallet system if one already exists. Add only the necessary columns/tables/indexes. Store gateway order_id as unique, local user/order mapping, amount, status, token/reference/UTR when available, timestamps and failure/pending information.

=== ONE CONFIG FILE ===
Create exactly ONE obvious server-side place for the real credentials, such as config/famgateway.php or .env:
FAMGATEWAY_BASE_URL=https://famgateway.shop/api
FAMGATEWAY_API_KEY=YOUR_FAMGATEWAY_API_KEY
FAMGATEWAY_WEBHOOK_SECRET=YOUR_WEBHOOK_SECRET_IF_USED
FAMGATEWAY_EXPIRY_MINUTES=5

The REAL API key must never be included in the prompt, frontend, HTML, JavaScript, public API response, logs, Git repository or screenshots. Tell me exactly which ONE file I must edit after upload.

=== SECURITY ===
Use server-side authentication, CSRF where applicable, prepared statements/ORM safety, HTTPS, output escaping, signature verification, idempotency and atomic wallet credit. Never log secrets. Never credit from a client-side success message alone.

=== HOSTING ===
Make the implementation suitable for the project's actual hosting. Avoid unnecessary Composer/dependencies where possible. For PHP/shared hosting, prefer plain PHP + cURL with a safe HTTPS-stream fallback when practical.

=== FINAL NO-REGRESSION CHECK — MANDATORY ===
Before returning the result, compare the original project with the modified project. Confirm that NO unrelated file, page, feature or functionality was removed or redesigned. Specifically verify that existing login, registration, OTP/authentication behavior, admin panel, user dashboard, CSS/theme, navigation, APIs, database tables and all non-payment features remain present and functional. Only payment-integration changes are allowed.

=== DELIVERABLE ===
Do the implementation against my attached source; do not merely explain it.
Return COMPLETE modified/new files, database migration/SQL, changed-file list, exact API-key location, exact callback URL, exact webhook URL, merchant-dashboard webhook setup, hosting/upload steps, ₹1/₹5 test procedure, expected success/pending/failed behaviour and final security checklist. If file creation is available, package everything as a ready-to-upload ZIP.

IMPORTANT: Preserve existing UI and working features. No pseudo-code, no incomplete snippets, no “you can implement this later”. Analyse first, implement second, test the integration logic third.

You are a senior Ruby/Rails payment-integration engineer and security reviewer.

Use existing controllers/models/services/routes/migrations and Rails credentials/environment configuration.

I am attaching the COMPLETE source code of an EXISTING project. FIRST inspect the entire project and understand its current architecture, authentication, users, existing Deposit/Add Money/Wallet flow, database/schema, transaction tables, routes/controllers, callback handling, webhook handling and hosting constraints.

=== ABSOLUTE PROJECT PRESERVATION RULE — HIGHEST PRIORITY ===
THIS IS AN INTEGRATION-ONLY TASK. DO NOT REDESIGN, REBUILD, CLEAN UP, MODERNIZE OR REWRITE THE PROJECT. DO NOT REMOVE, DISABLE, RENAME, REPLACE OR CHANGE ANY EXISTING FEATURE, PAGE, LOGIN, REGISTER, OTP, ADMIN PANEL, USER PANEL, DASHBOARD, CSS, HTML, JavaScript, API, route, database table, authentication logic, permissions, settings or business logic unless a change is strictly necessary for the payment integration itself.

Keep the existing project 100% intact except for the MINIMUM files/lines required to connect the EXISTING Deposit / Add Money / Pay button and its existing amount field to FamGateway. NEVER remove a login page or any other page because it appears unrelated. NEVER replace the whole project with a new template or sample project. NEVER create a simplified replacement project.

Before editing, make a complete inventory of existing files/features. After editing, verify that every pre-existing feature and page still exists and that no unrelated file was deleted or overwritten. If something is not required for FamGateway payment integration, DO NOT TOUCH IT. Preserve existing UI, design, URLs, routes, sessions, database structure and user experience. If integration can be done by adding a small new payment service/callback/webhook file, prefer that over rewriting existing files. If an existing file must change, make the smallest possible surgical change and preserve all unrelated code exactly.

If you cannot safely integrate without changing unrelated functionality, STOP and clearly explain what exact dependency is blocking the integration. Do not invent a replacement.

DO NOT guess or replace the project architecture.

=== TASK ===
Fully integrate FamGateway (https://famgateway.shop) ONLY into the EXISTING Deposit / Add Money flow. The existing Deposit/Add Money/Pay button and amount input must remain the same UI and behavior except for the payment-provider handoff. Do not alter any unrelated feature. The user enters an amount, clicks the existing button, gets the real FamGateway payment page, and after successful payment the EXACT paid amount is credited to the correct user's existing wallet/account exactly once.

=== OFFICIAL GATEWAY ===
Base API: https://famgateway.shop/api
Create Order: POST https://famgateway.shop/api/create-order
Check Status: POST https://famgateway.shop/api/check-status
Auth header: X-API-Key: YOUR_FAMGATEWAY_API_KEY
Content-Type: application/json

Create Order JSON:
{
  "amount": 100.00,
  "order_id": "ORD_UNIQUE_ID",
  "customer_name": "User Name",
  "customer_mobile": "9876543210",
  "callback_url": "https://YOUR-PROJECT-DOMAIN.com/payment-callback.php",
  "description": "Wallet Deposit",
  "expiry_minutes": 5
}

Successful create-order response contains data.payment_url, data.order_id, data.token, data.amount and data.expires_at.

=== REQUIRED END-TO-END FLOW ===
1. Find the EXISTING Deposit/Add Money/Pay button and amount field. Preserve its UI.
2. Authenticate the current user on the server and validate the amount against the project's rules.
3. Create a unique local pending deposit/order BEFORE calling the gateway.
4. Call FamGateway create-order with the EXACT amount entered by the user.
5. Save gateway order_id/token/payment_url and the local user_id/order mapping.
6. Use expiry_minutes=5.
7. Generate callback_url automatically from the REAL deployed project domain.
8. Redirect the user to the returned payment_url.
9. On callback, call FamGateway check-status using the stored order_id.
10. Credit only when gateway status is successful/paid, gateway amount EXACTLY equals the local order amount, and the order belongs to the correct user.
11. Use a database transaction, unique order ID and/or row locking so repeated requests can NEVER double-credit.
12. Add a server-side webhook POST endpoint. Verify X-FamUpiGateway-Signature with the configured webhook secret when used, then verify the payment with check-status before crediting.
13. Callback and webhook must both be idempotent. Webhook is not the only source of truth.
14. Never trust amount, status, order_id or user_id supplied by browser JavaScript.
15. Handle pending, failed, expired, duplicate and already-paid cases safely.

=== DATABASE/WALLET ===
Reuse the project's EXISTING user/wallet/balance/deposit/transaction tables whenever possible. Do NOT create a second wallet system if one already exists. Add only the necessary columns/tables/indexes. Store gateway order_id as unique, local user/order mapping, amount, status, token/reference/UTR when available, timestamps and failure/pending information.

=== ONE CONFIG FILE ===
Create exactly ONE obvious server-side place for the real credentials, such as config/famgateway.php or .env:
FAMGATEWAY_BASE_URL=https://famgateway.shop/api
FAMGATEWAY_API_KEY=YOUR_FAMGATEWAY_API_KEY
FAMGATEWAY_WEBHOOK_SECRET=YOUR_WEBHOOK_SECRET_IF_USED
FAMGATEWAY_EXPIRY_MINUTES=5

The REAL API key must never be included in the prompt, frontend, HTML, JavaScript, public API response, logs, Git repository or screenshots. Tell me exactly which ONE file I must edit after upload.

=== SECURITY ===
Use server-side authentication, CSRF where applicable, prepared statements/ORM safety, HTTPS, output escaping, signature verification, idempotency and atomic wallet credit. Never log secrets. Never credit from a client-side success message alone.

=== HOSTING ===
Make the implementation suitable for the project's actual hosting. Avoid unnecessary Composer/dependencies where possible. For PHP/shared hosting, prefer plain PHP + cURL with a safe HTTPS-stream fallback when practical.

=== FINAL NO-REGRESSION CHECK — MANDATORY ===
Before returning the result, compare the original project with the modified project. Confirm that NO unrelated file, page, feature or functionality was removed or redesigned. Specifically verify that existing login, registration, OTP/authentication behavior, admin panel, user dashboard, CSS/theme, navigation, APIs, database tables and all non-payment features remain present and functional. Only payment-integration changes are allowed.

=== DELIVERABLE ===
Do the implementation against my attached source; do not merely explain it.
Return COMPLETE modified/new files, database migration/SQL, changed-file list, exact API-key location, exact callback URL, exact webhook URL, merchant-dashboard webhook setup, hosting/upload steps, ₹1/₹5 test procedure, expected success/pending/failed behaviour and final security checklist. If file creation is available, package everything as a ready-to-upload ZIP.

IMPORTANT: Preserve existing UI and working features. No pseudo-code, no incomplete snippets, no “you can implement this later”. Analyse first, implement second, test the integration logic third.

You are a senior software engineer, payment-integration specialist and security reviewer.

Detect the actual language/framework from my attached source and implement using its native best practices.

I am attaching the COMPLETE source code of an EXISTING project. FIRST inspect the entire project and understand its current architecture, authentication, users, existing Deposit/Add Money/Wallet flow, database/schema, transaction tables, routes/controllers, callback handling, webhook handling and hosting constraints.

=== ABSOLUTE PROJECT PRESERVATION RULE — HIGHEST PRIORITY ===
THIS IS AN INTEGRATION-ONLY TASK. DO NOT REDESIGN, REBUILD, CLEAN UP, MODERNIZE OR REWRITE THE PROJECT. DO NOT REMOVE, DISABLE, RENAME, REPLACE OR CHANGE ANY EXISTING FEATURE, PAGE, LOGIN, REGISTER, OTP, ADMIN PANEL, USER PANEL, DASHBOARD, CSS, HTML, JavaScript, API, route, database table, authentication logic, permissions, settings or business logic unless a change is strictly necessary for the payment integration itself.

Keep the existing project 100% intact except for the MINIMUM files/lines required to connect the EXISTING Deposit / Add Money / Pay button and its existing amount field to FamGateway. NEVER remove a login page or any other page because it appears unrelated. NEVER replace the whole project with a new template or sample project. NEVER create a simplified replacement project.

Before editing, make a complete inventory of existing files/features. After editing, verify that every pre-existing feature and page still exists and that no unrelated file was deleted or overwritten. If something is not required for FamGateway payment integration, DO NOT TOUCH IT. Preserve existing UI, design, URLs, routes, sessions, database structure and user experience. If integration can be done by adding a small new payment service/callback/webhook file, prefer that over rewriting existing files. If an existing file must change, make the smallest possible surgical change and preserve all unrelated code exactly.

If you cannot safely integrate without changing unrelated functionality, STOP and clearly explain what exact dependency is blocking the integration. Do not invent a replacement.

DO NOT guess or replace the project architecture.

=== TASK ===
Fully integrate FamGateway (https://famgateway.shop) ONLY into the EXISTING Deposit / Add Money flow. The existing Deposit/Add Money/Pay button and amount input must remain the same UI and behavior except for the payment-provider handoff. Do not alter any unrelated feature. The user enters an amount, clicks the existing button, gets the real FamGateway payment page, and after successful payment the EXACT paid amount is credited to the correct user's existing wallet/account exactly once.

=== OFFICIAL GATEWAY ===
Base API: https://famgateway.shop/api
Create Order: POST https://famgateway.shop/api/create-order
Check Status: POST https://famgateway.shop/api/check-status
Auth header: X-API-Key: YOUR_FAMGATEWAY_API_KEY
Content-Type: application/json

Create Order JSON:
{
  "amount": 100.00,
  "order_id": "ORD_UNIQUE_ID",
  "customer_name": "User Name",
  "customer_mobile": "9876543210",
  "callback_url": "https://YOUR-PROJECT-DOMAIN.com/payment-callback.php",
  "description": "Wallet Deposit",
  "expiry_minutes": 5
}

Successful create-order response contains data.payment_url, data.order_id, data.token, data.amount and data.expires_at.

=== REQUIRED END-TO-END FLOW ===
1. Find the EXISTING Deposit/Add Money/Pay button and amount field. Preserve its UI.
2. Authenticate the current user on the server and validate the amount against the project's rules.
3. Create a unique local pending deposit/order BEFORE calling the gateway.
4. Call FamGateway create-order with the EXACT amount entered by the user.
5. Save gateway order_id/token/payment_url and the local user_id/order mapping.
6. Use expiry_minutes=5.
7. Generate callback_url automatically from the REAL deployed project domain.
8. Redirect the user to the returned payment_url.
9. On callback, call FamGateway check-status using the stored order_id.
10. Credit only when gateway status is successful/paid, gateway amount EXACTLY equals the local order amount, and the order belongs to the correct user.
11. Use a database transaction, unique order ID and/or row locking so repeated requests can NEVER double-credit.
12. Add a server-side webhook POST endpoint. Verify X-FamUpiGateway-Signature with the configured webhook secret when used, then verify the payment with check-status before crediting.
13. Callback and webhook must both be idempotent. Webhook is not the only source of truth.
14. Never trust amount, status, order_id or user_id supplied by browser JavaScript.
15. Handle pending, failed, expired, duplicate and already-paid cases safely.

=== DATABASE/WALLET ===
Reuse the project's EXISTING user/wallet/balance/deposit/transaction tables whenever possible. Do NOT create a second wallet system if one already exists. Add only the necessary columns/tables/indexes. Store gateway order_id as unique, local user/order mapping, amount, status, token/reference/UTR when available, timestamps and failure/pending information.

=== ONE CONFIG FILE ===
Create exactly ONE obvious server-side place for the real credentials, such as config/famgateway.php or .env:
FAMGATEWAY_BASE_URL=https://famgateway.shop/api
FAMGATEWAY_API_KEY=YOUR_FAMGATEWAY_API_KEY
FAMGATEWAY_WEBHOOK_SECRET=YOUR_WEBHOOK_SECRET_IF_USED
FAMGATEWAY_EXPIRY_MINUTES=5

The REAL API key must never be included in the prompt, frontend, HTML, JavaScript, public API response, logs, Git repository or screenshots. Tell me exactly which ONE file I must edit after upload.

=== SECURITY ===
Use server-side authentication, CSRF where applicable, prepared statements/ORM safety, HTTPS, output escaping, signature verification, idempotency and atomic wallet credit. Never log secrets. Never credit from a client-side success message alone.

=== HOSTING ===
Make the implementation suitable for the project's actual hosting. Avoid unnecessary Composer/dependencies where possible. For PHP/shared hosting, prefer plain PHP + cURL with a safe HTTPS-stream fallback when practical.

=== FINAL NO-REGRESSION CHECK — MANDATORY ===
Before returning the result, compare the original project with the modified project. Confirm that NO unrelated file, page, feature or functionality was removed or redesigned. Specifically verify that existing login, registration, OTP/authentication behavior, admin panel, user dashboard, CSS/theme, navigation, APIs, database tables and all non-payment features remain present and functional. Only payment-integration changes are allowed.

=== DELIVERABLE ===
Do the implementation against my attached source; do not merely explain it.
Return COMPLETE modified/new files, database migration/SQL, changed-file list, exact API-key location, exact callback URL, exact webhook URL, merchant-dashboard webhook setup, hosting/upload steps, ₹1/₹5 test procedure, expected success/pending/failed behaviour and final security checklist. If file creation is available, package everything as a ready-to-upload ZIP.

IMPORTANT: Preserve existing UI and working features. No pseudo-code, no incomplete snippets, no “you can implement this later”. Analyse first, implement second, test the integration logic third.

<?php
$payload = [
    'amount' => '100.00',
    'order_id' => 'ORD_20260920_9008',
    'customer_name' => 'Raushan Kumar',
    'callback_url' => 'https://yourwebsite.com/callback.php',
    'expiry_minutes' => 5
];

$ch = curl_init('https://mail.famupigateway.site/api/create-order');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => json_encode($payload),
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Content-Type: application/json',
        'X-API-Key: YOUR_FAMGATEWAY_API_KEY'
    ]
]);

$response = curl_exec($ch);
$data = json_decode($response, true);
curl_close($ch);

if (isset($data['status']) && $data['status'] === 'success') {
    header("Location: " . $data['data']['payment_url']);
    exit;
}
?>

const fetch = require('node-fetch');

fetch('https://mail.famupigateway.site/api/create-order', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'X-API-Key': 'YOUR_FAMGATEWAY_API_KEY'
  },
  body: JSON.stringify({
    amount: '100.00',
    order_id: 'ORD_20260920_9008',
    customer_name: 'Raushan Kumar',
    callback_url: 'https://yourwebsite.com/callback.php',
    expiry_minutes: 5
  })
})
.then(res => res.json())
.then(json => console.log(json));

<?php
$ch = curl_init('https://mail.famupigateway.site/api/check-status');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => json_encode(['order_id' => 'ORD_20260920_9008']),
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Content-Type: application/json',
        'X-API-Key: YOUR_FAMGATEWAY_API_KEY'
    ]
]);

$data = json_decode(curl_exec($ch), true);
curl_close($ch);

print_r($data);
?>