HUP is a platform that connects payment methods to Payment Service Providers (PSPs) and enables offering proprietary payment methods within the Buy Now Pay Later (BNPL) ecosystem.

• Client: Payment Service Provider (PSP)
• Customer: The user of the Shop that wants to purchase a service/good
• Merchant: Customer of the Client which owns shops or points of sale. The entity that is billed for HUP's services
• Shop: Point of sale that belongs to a Merchant

If you have any questions regarding the integration with our Api, please contact one of the following:

Development:

• Email: contact@scenius.nl
• Telephone: 040 - 369 0149

Merchant/Shop/Customer:

• Email: support@huppayments.com
• Telephone: 088 - 39 93 333

Before starting integration with HUP, check if all legal documents (KYC checks) and merchant contracting are covered in your onboarding!

sequenceDiagram participant Customer participant Merchant participant PSP participant Hup participant BNPL

Customer->>Merchant: Start checkout
Merchant->>PSP: Create order with details
PSP->>Hup: Forward transaction request
Hup->>BNPL: [POST] Start transaction
BNPL-->>Hup: Payment screen URL
Hup-->>PSP: Pass back payment screen URL
PSP-->>Merchant: Redirect customer
Merchant-->>Customer: Show BNPL payment screen

Customer->>BNPL: Authenticate & pay first installment
BNPL-->>Hup: Payment status update
Hup-->>PSP: Payment status
PSP-->>Merchant: Success / Failure
Merchant-->>Customer: Show order result

Start a new transaction

Total captured amount across all capture requests must not exceed the originally authorized transaction amount.
Multiple partial captures are allowed.
Transactions without capture after a defined window (e.g., 30 days) may expire automatically.

Get informed when something relevant changes. Here you can setup which URL we should inform. All webhooks only inform you of the changed ID's so that you can fetch the latest status yourself completing the triangle.

Confirming HMAC on the receiving side of the webhook is as following:

• Combine the full response body with the unix timestamp from the response header: "hmac_date", and seperate them with a semicolon. {"key":"value"};1646147678
• Encrypt the following value fully with SHA512, using the signing key from the creation request.
• If the result hash equals the hmac from the response header, you have a valid HMAC.

/// <summary>
/// Verifies HMAC from webhook
/// </summary>
/// <param name="hmac">Hmac header</param>
/// <param name="hmacDate">Hmac_date header</param>
/// <param name="jsonBody">The full response body</param>
/// <param name="signingKey">The signing key that was transmitted on the creation of the webhook.</param>
/// <returns></returns>
public bool VerifyHmac(string hmac, long hmacDate, string jsonBody, string signingKey)
{
    if (DateTimeOffset.FromUnixTimeSeconds(hmacDate) > DateTimeOffset.Now.AddMinutes(15))
    {
        // Timestamp in HMAC is too old, or modified.
        return false;
    };

    var payload = $"{jsonBody};{hmacDate}";
    
    var signingKeyDecoded = Convert.FromBase64String(signingKey);

    var signature = string.Empty;
    using (var hmacsha512 = new HMACSHA512(signingKeyDecoded))
    {
        var stream = new MemoryStream(Encoding.UTF8.GetBytes(payload));
        foreach (var b in hmacsha512.ComputeHash(stream))
        {
            signature = signature + $"{b:x2}";
        }
    }

    return hmac == signature;
}