İş Bankası

İş Bankası uses NestPay/CC5 with HMAC-SHA512 (v3 hash) authentication. 3D Secure is delivered as an auto-submitting form to the est3Dgate endpoint in 3d_pay_hosting mode.

Getting your credentials

NestPay credentials come from your İş Bankası member-merchant agreement (issued via the bank's VPOS management portal) — they are not self-service. Obtain from the bank or your integrator:

• clientId — your NestPay client/merchant id
• username, password — the API user
• storeKey — key used for the v3 hash

Request a test set for integration and a separate production set for go-live.

Configuration

isbank: {
  enabled: true,
  config: {
    clientId: process.env.ISBANK_CLIENT_ID!,
    username: process.env.ISBANK_USERNAME!,
    password: process.env.ISBANK_PASSWORD!,
    storeKey: process.env.ISBANK_STORE_KEY!,
  },
}

baseUrl defaults to https://entegrasyon.asseco-see.com.tr in sandbox and https://spos.isbank.com.tr in production.

3D Secure

const init = await payment.isbank.initThreeDSPayment({
  price: '150.00',
  currency: 'TRY',
  callbackUrl: 'https://yoursite.com/isbank/callback',
  paymentCard: { cardHolderName, cardNumber, expireMonth, expireYear, cvc },
  buyer: { /* … */ },
  basketId: 'order-1',
  /* … */
});

const final = await payment.isbank.completeThreeDSPayment(req.body);

Refund / Cancel / Get

await payment.isbank.refund({ paymentId, price: '150.00', currency: 'TRY', ip: '…' });
await payment.isbank.cancel({ paymentId, ip: '…' });
await payment.isbank.getPayment(paymentId);

Testing

Set mode: 'sandbox' and use the bank's test credentials; baseUrl switches to https://entegrasyon.asseco-see.com.tr automatically. Run a 3D Secure flow with a NestPay test card from the bank's integration guide and confirm completeThreeDSPayment returns success only after the response hash verifies.