PHP SDK

composer require bob-payments/sdk

use BobPayments\BobPaymentsClient;

$bob = new BobPaymentsClient([
    'apiKey' => getenv('BOB_API_KEY'), // sk_live_... or sk_test_...
    // 'timeoutMs' => 35_000,          // timeout per attempt
    // 'maxRetries' => 2,              // automatic retries; 0 disables
]);

$bob->environment; // 'live' | 'sandbox' — detected from the key prefix

$session = $bob->checkoutSessions->create([
    'amountCents' => 25_000,
    'items' => [['name' => 'Assinatura Pro', 'quantity' => 1, 'unitAmountCents' => 25_000]],
    'paymentMethods' => ['pix'],
    'successUrl' => 'https://loja.example.com/pedido/sucesso',
    'webhookUrl' => 'https://loja.example.com/webhooks/bob',
]);

header('Location: ' . $session['checkoutUrl']);

$tx = $bob->transactions->create([
    'customer' => [
        'name' => 'João Silva',
        'document' => '12345678901',
        'documentType' => 'CPF',
        'email' => '[email protected]',
        'address' => [
            'street' => 'Rua das Flores',
            'streetNumber' => '123',
            'neighborhood' => 'Centro',
            'zipCode' => '01310-100',
            'city' => 'São Paulo',
            'state' => 'SP',
        ],
    ],
    'payment' => ['amountCents' => 10_000, 'product' => 'Assinatura Pro'], // always in cents
    'originDomain' => 'loja.example.com',
]);

$tx['pixCode'];        // PIX copy-and-paste (EMV)
$tx['expirationDate']; // when the PIX expires
$tx['persisted'];      // false = HTTP 202 (reconciliation pending; PIX valid)
$tx['replayed'];       // true = response replayed via idempotency

$detail = $bob->transactions->get('clx1abc123');

$page = $bob->transactions->list([
    'status' => 'paid',
    'dateFrom' => new DateTimeImmutable('2026-07-01'),
    'limit' => 50,
]); // ['data' => [...], 'meta' => ['total' => ..., 'totalPages' => ...]]

$customers = $bob->customers->list(['email' => '[email protected]']);
$customer = $bob->customers->get($customers['data'][0]['id']);

$session = $bob->checkoutSessions->create([
    'amountCents' => 25_000,
    'successUrl' => 'https://loja.example.com/obrigado',
    'webhookUrl' => 'https://loja.example.com/webhooks/bob', // SDK requests v2 by default
]);

header('Location: ' . $session['checkoutUrl']); // store $session['webhookSecret']!

$status = $bob->checkoutSessions->getStatus($session['checkoutToken']);

use BobPayments\Webhooks;
use BobPayments\Exception\WebhookVerificationException;

$rawBody = file_get_contents('php://input'); // RAW body — never re-serialize
$signature = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? null;

try {
    $event = Webhooks::constructEvent($rawBody, $signature, getenv('BOB_WEBHOOK_SECRET'));

    if ($event['event'] === 'transaction.paid') {
        // v2: $event['data']['amountCents'] · v1: $event['data']['amount']
        liberarPedido($event['data']['transactionId']);
    }

    http_response_code(200);
    echo 'ok';
} catch (WebhookVerificationException $e) {
    http_response_code(401);
    echo 'invalid signature';
}

use BobPayments\Exception\ApiException;
use BobPayments\Exception\TimeoutException;

try {
    $bob->transactions->create($params);
} catch (ApiException $e) {
    $e->status;            // 400, 401, 422, 429, 503...
    $e->errorCode;         // 'ERR_INTEGRATION_006', ...
    $e->detail;            // descriptive message
    $e->retryAfterSeconds; // on 429/503 when the API sends Retry-After
} catch (TimeoutException $e) {
    // exceeded the client timeout
}

$bob->transactions->create([...['payment' => ['amountCents' => 10_001, ...]]]); // expires in ~5s