Additional notifications for BLIK One Click
BLIK One Click uses the standard notification service protocol and parameters, the same as regular payments (Notification Service). Notifications are sent as HTTP GET requests to the notification URL configured in the CashBill Control Panel.
Transaction status changes
Standard transaction status notifications use cmd=transactionStatusChanged, with the transaction ID in args. Successfully initiating a BLIK One Click transaction does not confirm that the payment has completed. Wait for the notification and retrieve the current transaction status before treating the payment as completed.
Declined transactions
If a BLIK One Click transaction is declined, an additional notification containing the reason for the rejection is sent using cmd=blikDeclinedEvent. Other transaction notifications are sent as standard.
The args parameter is a comma-separated list:
| Position | Description | Example |
|---|---|---|
| First | Transaction ID. | hc000pc |
| Second | Decline status code. | USER_DECLINED |
For a complete list of decline status codes, see Status Codes.
Example notification
https://shop_url.com/?cmd=blikDeclinedEvent&args=hc000pc,USER_DECLINED&sign={sign}
Replace {sign} with the signature calculated from the notification parameters and the payment point secret key.
BLIK alias events
BLIK alias notifications use cmd=blikAliasEvent. The args parameter contains the transaction ID followed by a comma and a JSON object with the alias event details.
Name of request (cmd) | Example value (args) | Description |
|---|---|---|
blikAliasEvent | asd34sf,{"aliasUid":"alias-uuid","type":"BLIK_ALIAS_STATUS"} | BLIK alias event. Attributes: transaction ID and alias event details in JSON format ( aliasUid alias UUID, type event type). |
Split args at the first comma only, then parse the remaining text as JSON. The JSON object itself contains commas. Use aliasUid to identify the alias stored for the user and type to identify the event.
Available BLIK Alias Statuses
| Status | Description |
|---|---|
ALIAS_REGISTER | Alias registration. |
ALIAS_EXPIRED | Alias expiration. |
ALIAS_UNREGISTER | Alias unregistration. |
ALIAS_UPDATE | Alias update. This event is used to notify about a change of the Alias expiration date or the Mobile Account label. |
Example alias unregistration notification
The decoded notification parameters are:
cmd=blikAliasEvent
args=asd34sf,{"aliasUid":"alias-uuid","type":"ALIAS_UNREGISTER"}
The JSON part of args is URL-encoded in the GET request:
https://shop_url.com/?cmd=blikAliasEvent&args=asd34sf,%7B%22aliasUid%22%3A%22alias-uuid%22%2C%22type%22%3A%22ALIAS_UNREGISTER%22%7D&sign={sign}
Replace {sign} with the signature calculated from cmd, the decoded args value and the payment point secret key.
When you receive ALIAS_UNREGISTER or ALIAS_EXPIRED, update the user stored alias state and stop using this alias for subsequent BLIK One Click transactions. The user can pay with a BLIK code and remember the shop again in their banking application.
Signature
Validate the signature of each notification using the received cmd and args values:
sign = md5(cmd + args + secretKey)
Concatenate the values without additional separators. Use the URL-decoded args value exactly as received, including the comma and the original JSON text. Do not reserialize the JSON before validating the signature. The result is a lowercase hexadecimal MD5 hash.
Response to a notification
Confirm receipt with HTTP 200 OK and a response body consisting of exactly two bytes:
OK
Any other response is treated as an error and the notification is repeated.