manifest.xml
<?xml version="1.0" encoding="UTF-8"?>
<manifest xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="https://raw.githubusercontent.com/shopware/platform/master/src/Core/Framework/App/Manifest/Schema/manifest-1.0.xsd">
    <meta>
        <!-- The name of the app should not change. Otherwise all payment methods are created as duplicates. -->
        <name>PaymentApp</name>
        <!-- ... -->
    </meta>
​
    <payments>
        <payment-method>
            <!-- The identifier of the payment method should not change. Otherwise a separate method is created. -->
            <identifier>asynchronousPayment</identifier>
            <name>Asynchronous payment</name>
            <name lang="de-DE">Asynchrone Zahlung</name>
            <description>This payment method requires forwarding to payment provider.</description>
            <description lang="de-DE">Diese Zahlungsmethode erfordert eine Weiterleitung zu einem Zahlungsanbieter.</description>
            <pay-url>https://payment.app/async/pay</pay-url>
            <finalize-url>https://payment.app/async/finalize</finalize-url>
            <!-- This optional path to this icon must be relative to the manifest.xml -->
            <icon>Resources/paymentLogo.png</icon>
        </payment-method>
​
        <payment-method>
            <!-- The identifier of the payment method should not change. Otherwise a separate method is created. -->
            <identifier>synchronousPayment</identifier>
            <name>Synchronous payment</name>
            <name lang="de-DE">Synchrone Zahlung</name>
            <description>This payment method does everything in one request.</description>
            <description lang="de-DE">Diese Zahlungsmethode arbeitet in einem Request.</description>
            <!-- This URL is optional for synchronous payments (see below). -->
            <pay-url>https://payment.app/sync/process</pay-url>
        </payment-method>
​
        <payment-method>
            <!-- The identifier of the payment method should not change. Otherwise a separate method is created. -->
            <identifier>simpleSynchronousPayment</identifier>
            <name>Simple Synchronous payment</name>
            <name lang="de-DE">Einfache synchrone Zahlung</name>
            <description>This payment will not do anything and stay on 'open' after order.</description>
            <description lang="de-DE">Diese Zahlungsmethode wird die Transaktion auf 'offen' belassen.</description>
            <!-- No URL is provided. -->
        </payment-method>
    </payments>
</manifest>

use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\JsonResponse;
use Symfony\Component\Routing\Annotation\Route;
​
/**
 * @Route("/sync/process", name="sync.process", methods={"POST"})
 */
public function processSynchronousPayment(Request $request): JsonResponse
{
      // more on this in section "Validation"
      $this->checkSignature($request);
​
      $content = \json_decode($request->getContent(), true);
​
      // implement your logic here based on the information provided in $content
      $response = [ 'status' => 'authorize' ];
​
      // this returns a json encoded response with the `shopware-app-signature` in the header
      return $this->sign($response, $content['source']['shopId']);
}

$response = [
    'status' => 'fail',
    'message' => 'The customer failed to pass the credit check.',
];

use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\JsonResponse;
use Symfony\Component\Routing\Annotation\Route;
​
/**
 * @Route("/async/pay", name="async.pay", methods={"POST"})
 */
public function startAsyncPayment(Request $request): JsonResponse
{
    // more on this in section "Validation"
    $this->checkSignature($request);
​
    $content = json_decode($request->getContent(), true);
​
    // you can identify the transaction later on with the orderTransactionId
    $transactionId = $content['orderTransaction']['id'];
​
    // implement your logic here based on the information provided in $content
    // you should save the transactionId for later identification in the second request and in the user redirection
    $response = [ 'redirectUrl' => sprintf('https://payment.app/user/go/here/%s/', $transactionId) ];
​
    // this returns a json encoded response with the `shopware-app-signature` in the header
    return $this->sign($response, $content['source']['shopId']);
}

use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\JsonResponse;
use Symfony\Component\Routing\Annotation\Route;
​
/**
 * @Route("/async/finalize", name="async.finalize", methods={"POST"})
 */
public function finalizeAsyncPayment(Request $request): JsonResponse
{
    // more on this in section "Validation"
    $this->checkSignature($request);
​
    $content = json_decode($request->getContent(), true);
​
    // you can identify the transaction again with the orderTransactionId
    $transactionId = $content['orderTransaction']['id'];
    $status = $this->getStatusFromPaymentProvider($transactionId);
​
    // implement your logic here based on the information provided in $content
    // you should save the transactionId for later identification in the second request and in the user redirection
    $response = [ 'status' => $status ];
​
    // this returns a json encoded response with the `shopware-app-signature` in the header
    return $this->sign($response, $content['source']['shopId']);
}
​
private function getStatusFromPaymentProvider(string $transactionId): string
{
    // check with the payment provider here to receive the final status
    return 'paid';
}

$response = [
    'status' => 'fail',
    'message' => 'The customer failed to pass the credit check.',
];

use Symfony\Component\HttpFoundation\Request;
​
private function checkSignature(Request $request): void
{
    $requestContent = json_decode($request->getContent(), true);
    $shopId = $requestContent['source']['shopId'];
​
    // get the secret you have saved on registration for this shopId
    $shopSecret = $this->getSecretByShopId($shopId);
​
    $signature = $request->headers->get('shopware-shop-signature'):
    if ($signature === null) {
        throw new Exception('No signature provided signature');
    }
​
    $hmac = hash_hmac('sha256', $request->getContent(), $shopSecret);
    if (!hash_equals($hmac, $signature)) {
        throw new Exception('Invalid signature');
    }
}

use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\JsonResponse;
​
private function sign(array $content, string $shopId): JsonResponse
{
    // this encodes the json automatically
    $response = new JsonResponse($content);
​
    // get the secret you have saved on registration for this shopId
    $shopSecret = $this->getSecretByShopId($shopId);
​
    $hmac = \hash_hmac('sha256', $response->getContent(), $secret);
    $response->headers->set('shopware-app-signature', $hmac);
​
    return $response;
}