swichpay_flutter 2.1.2

Flutter SDK for integrating Swich payment services.

Changelog

2.1.2

Fixed

• A successful Bank Transfer (bank account) payment no longer shows an error. The gateway answers the OTP verify step with data: false, and the SDK's strict data cast threw (type 'bool' is not a subtype of type 'Map<String, dynamic>?') even though the payment had gone through. Every gateway/direct response field documented as an object is now read defensively, so an unexpected type is ignored instead of throwing.

2.1.1

Fixed

• A 401 on a cached OAuth token now drops the token, fetches a fresh one and retries the call once, instead of failing every call (checkout start, bank lists, payments) with HTTP 401 until the cached token's local expiry.
• "Unable to start checkout" now shows the short user-facing message instead of the raw exception text (e.g. SwichPayApiException: ... (HTTP 401)).

2.1.0

Fixed

• Card payments that still need 3-D Secure are no longer reported as successful. ProcessPayment/PaymentEnrollment answer a pending DDC/OTP step with success: true; the result is now pending until that step finishes. Previously some cards (e.g. Meezan-acquired 3DS2) showed the success screen and closed the sheet without the customer ever authenticating.

• 3-D Secure pages returned straight from ProcessPayment (no device-data collection, no JWT) now open in the payment sheet and presentCardCheckout. They're POSTed with their own query parameters as the form body - the acquirer rejects GET, and parameters sent in both places.

• A direct card response with nextAction.type == "complete" is treated as final: a successful payment closes presentCardCheckout instead of opening the merchant redirect URL in the 3-D Secure view.

• A direct card payment the vendor reports as pending (HTTP 400 with status: "pending") shows the pending screen and polls its status instead of "Payment declined", so customers aren't prompted to pay twice.

• Session card status checks after 3-D Secure use InquireV3 with the payment's orderId where the environment has a payment-api host; CheckCardPaymentStatus remains the fallback.

• Environment.production now uses the production gateway (api.swichnow.com) and checkout (checkout.swichnow.com) hosts instead of sandbox ones. Direct card payments and discount lookups have no production host yet, so they now fail with a SwichPayValidationException in production instead of sending live data to sandbox (discount lookups are best-effort, so checkout is unaffected).

• Direct card status checks no longer report a declined payment as successful: transactionStatus decides the outcome, completed alone never means success, and Initiated is treated as still pending.

• A direct card response with no next step and no 0000 code is verified via a status check instead of being treated as success; a payment still pending after polling is returned as pending rather than shown as declined.

• The card Pay button can no longer start a second payment while 3-D Secure device verification is in progress (payment sheet and presentCardCheckout); switching payment-method tiles is blocked for that window too.

• The 3-D Secure redirect request now times out instead of hanging the spinner forever.

• Bank Transfer "Resend OTP" no longer crashes.

• Direct card payments send isApi as a boolean again - PaymentV3 was rejecting every request with a 400 for the string form.

• A card declined with HTTP 4xx (e.g. "Transaction Failed") now shows the "Payment declined" screen in presentCardCheckout instead of "Something went wrong".

• IBAN fields (RTP Now / RTP E-Wallet, payment sheet and direct checkouts) now require the Pakistani IBAN format (PK + 22 characters) and send it without spaces, upper-cased; previously any 16+ characters were accepted and sent to the gateway.

• Errors shown to users are now short, non-technical messages (SwichPayException.userMessage); technical details stay in debug logs.

• README: install snippet now references ^2.0.0; documents the iOS NSPhotoLibraryAddUsageDescription needed for saving QR codes.

Added

• SwichPayApiException.serverStatus, .orderId and .isPending.
• SwichPayClient.checkCardPaymentStatus takes an optional orderId.

Security

• The Authorization header and Bank Transfer's accountNo are now redacted from debug logs, and error response bodies are logged with the same redaction as requests.

2.0.0

Changed

• Breaking: SwichPay.initialize() no longer takes getAccessToken or getPaymentSessionDetails callbacks - merchants now only provide clientId, clientSecret, referrer, merchantId, appId, and environment. Given clientSecret, the SDK exchanges it for an OAuth2 bearer token itself (client_credentials grant, refreshed automatically) instead of requiring a merchant backend to do it; the SDK also creates payment sessions and fetches their details internally. clientSecret is technically optional - without one, every call falls back to sending clientId as a plain x-public-key header, which only a subset of endpoints accept, so pass it whenever you have it.
• Breaking: Renamed SwichPayConfig/SwichPay.initialize()'s publicKey to clientId. secretHashKey keeps its name - it's a separate, different secret than the new clientSecret (native's PaymentConfig has always had both: secretKey for OAuth, secretHashKey for the card-payment checksum). Passing the same value for both gets an invalid_client 401 from the token endpoint.
• Breaking: Removed SwichPayAuthException - no longer thrown, since there's no host-app callback left to fail.
• Breaking: Removed package:swichpay_flutter/sandbox.dart - SwichPaySandbox existed only to fake what the SDK now does internally by default.
• Added direct (session-less) card payment (SwichPay.presentCardCheckout), mirroring native's CardBottomSheet: 3-D Secure device-data-collection, optional OTP step-up, and status polling. Requires secretHashKey on SwichPay.initialize().
• Added a "Scan card" shortcut to both the built-in payment sheet's and presentCardCheckout's card forms - camera-based, via package:card_scanner, fills in the card number and expiry automatically. Android/iOS only; not shown on other platforms. Needs a camera permission - see the README's Platform notes for the one-line iOS setup step.

1.0.0

Initial public release.

Added

• Built-in payment sheet (SwichPay.presentPaymentSheet) supporting:
  • Card payments (Visa/Mastercard), including saved cards and 3-D Secure (device-data-collection and OTP step-up).
  • E-Wallet payments (EasyPaisa/JazzCash), including saved wallets.
  • Bank Account payments, including an OTP confirmation step.
  • Biller (1Bill) payments.
  • QR (RAAST dynamic) payments.
  • RTP Now payments (Raast mobile/IBAN or bank account).
  • RTP E-Wallet payments.
  • Automatic discount lookup and display for E-Wallet and Card payments.
• Standalone, session-less "direct" checkouts for E-Wallet, Bank Transfer, 1Bill, QR, RTP Now, and RTP E-Wallet (SwichPay.present*Checkout), for integrations that don't need the full payment-method picker.
• Hosted checkout (SwichPay.presentHostedCheckout / presentHostedCheckoutSheet) for a WebView-based flow.
• Direct card payment (SwichPay.pay) for fully custom card UI.
• Payment session inquiry (SwichPay.inquirePaymentSession) and cancellation.
• App-wide payment result stream (SwichPay.onResult).
• Sandbox and production environment configuration (Environment.sandbox / Environment.production), with base URL overrides for local backend testing.
• Typed exception hierarchy (SwichPayNotInitializedException, SwichPayValidationException, SwichPayNetworkException, SwichPayApiException, SwichPayAuthException) so callers can handle SDK errors without parsing raw HTTP responses.

Security

• Card number, CVC, CNIC, MSISDN, account number/alias, IBAN, OTP, and discount-lookup reference values are redacted from debug logs.
• Debug logging (swichpayLog) is a no-op outside debug builds.