How to Integrate Moniepoint POS with PHP

Integrating a Moniepoint POS terminal with a PHP application can help businesses connect payment workflows with their websites, management systems, or custom applications.

With an authorized API integration, a PHP application may be able to request a payment, communicate with the payment service, and check the status of a transaction. The exact capabilities depend on the API access and documentation provided for your Moniepoint account and terminal.

This tutorial introduces the main components of a PHP-based Moniepoint POS integration.

Requirements

Before you begin, you need:

• PHP 8.0 or a version supported by your API integration.

• Composer for managing PHP dependencies.

• An authorized Moniepoint API account and credentials.

• The relevant API documentation for your POS terminal.

• A development environment such as XAMPP, Laragon, or a PHP server.

Step 1: Create the project

Create a project folder and initialize Composer:

mkdir moniepoint-php
cd moniepoint-php
composer init

Install the packages used by this example:

composer require vlucas/phpdotenv guzzlehttp/guzzle

Configure PSR-4 autoloading in composer.json:

{
    "autoload": {
        "psr-4": {
            "MarshallJosiah\\Moniepoint\\": "src/"
        }
    }
}

Regenerate Composer's autoloader whenever you change the autoload configuration:

Download from marshallunduemi/moniepoint-pos-php-integration

Create the following structure:

moniepoint-php/
├── src/
│   └── MoniepointClient.php
├── examples/
│   └── payment.php
├── .env.example
├── .gitignore
├── composer.json
└── README.md

Step 2: Configure your credentials

Store your API credentials securely using environment variables rather than hard-coding them into your PHP files.

For local development, create a .env file in the project root:

MONIEPOINT_CLIENT_ID=replace-with-your-local-client-id
MONIEPOINT_CLIENT_SECRET=replace-with-your-local-client-secret
MONIEPOINT_BASE_URL=https://api.example.com

Use placeholder values in .env.example so other developers know which variables are required without receiving real credentials:

MONIEPOINT_CLIENT_ID=
MONIEPOINT_CLIENT_SECRET=
MONIEPOINT_BASE_URL=https://api.example.com

Add .env to .gitignore before creating or committing local credentials:

/vendor/
/.env
.env
.env.*
!.env.example

The .env file is for local development only. Do not commit it, paste its contents into issues or chat, or expose it through a public web directory. In production, configure environment variables through your hosting platform or a managed secret store instead of uploading .env.

Load the variables at the application entry point:

<?php

require dirname(__DIR__) . '/vendor/autoload.php';

use Dotenv\Dotenv;

$dotenv = Dotenv::createImmutable(dirname(__DIR__));
$dotenv->safeLoad();

$clientId = $_ENV['MONIEPOINT_CLIENT_ID'] ?? '';
$clientSecret = $_ENV['MONIEPOINT_CLIENT_SECRET'] ?? '';
$baseUrl = $_ENV['MONIEPOINT_BASE_URL'] ?? '';

if ($clientId === '' || $clientSecret === '' || $baseUrl === '') {
    throw new RuntimeException(
        'Moniepoint environment variables are not configured.'
    );
}

Never publish your client secret in a public GitHub repository or expose it in browser-side JavaScript. If a secret is accidentally committed, remove it from the repository history where appropriate and rotate it immediately.

Step 3: Build the PHP API client

Your client should handle authentication, send authorized requests, and process API responses.

A basic structure could look like this:

<?php

namespace MarshallJosiah\Moniepoint;

class MoniepointClient
{
    public function __construct(
        private string $clientId,
        private string $clientSecret,
        private string $baseUrl
    ) {}

    // Implement authentication using the
    // endpoint and payload in your official API docs.

    // Implement payment requests using the
    // documented terminal and transaction fields.

    // Implement transaction-status checks using
    // the documented status endpoint.
}

The authentication and transaction methods must match the current authorized Moniepoint API specification. Do not assume that endpoint paths, payload fields, or terminal permissions are the same for every integration.

Step 4: Request a POS payment

A typical payment workflow is:

1. Your application creates a unique transaction reference.

2. The PHP backend authenticates with the authorized API.

3. The backend sends a payment request for the intended terminal, if supported.

4. The terminal or payment service processes the request.

5. Your application checks the transaction status and records the result.

The actual request fields and response format must come from the API documentation for your account.

Step 5: Handle payment status safely

Do not mark a transaction as successful merely because the API accepted a payment request.

Your application should verify the final status using the documented response or status-check endpoint. Handle failed, pending, timed-out, and duplicate requests appropriately.

For production systems, also use unique transaction references, server-side validation, secure logging, and the API's documented retry and idempotency rules.

Step 6: Test before deployment

Test the integration in an authorized test environment where available. Verify authentication, successful payments, failed payments, pending transactions, invalid credentials, and network timeouts.

For local testing:

1. Copy .env.example to .env.

2. Add credentials issued for your authorized development account.

3. Run the application only through a local server or a protected development environment.

4. Confirm that .env is ignored by Git with git status --ignored.

5. Remove or rotate temporary credentials when testing is complete.

Do not use production credentials in a shared laptop, sample project, public demo, or unprotected local server. Only deploy after confirming that your API endpoints, payloads, terminal permissions, and payment-status handling work with your authorized Moniepoint setup.

Production security checklist

Before going live:

• Use HTTPS for every application, API, and webhook connection.

• Store secrets in environment variables or a managed secret store; never commit them to source control.

• Verify webhook signatures using the provider’s documented method, and reject invalid or replayed events.

• Sign outbound requests when required, and protect signing keys from exposure.

• Use separate, least-privilege credentials for production, testing, services, and staff; rotate them regularly.

• Do not log passwords, API keys, tokens, full card or account details, webhook secrets, or other sensitive payment data. Redact sensitive fields and restrict access to logs.

Conclusion

A PHP integration can help connect Moniepoint POS payment workflows to a custom application. The most important part is using the correct API documentation and securely handling credentials, payment requests, and final transaction statuses.

Disclaimer: This is an unofficial developer tutorial. It is not developed, endorsed, or supported by Moniepoint or TeamApt. API access and terminal compatibility depend on the permissions and documentation provided by the relevant service.