ডেভেলপার ডকুমেন্টেশন

curl -X POST https://oxypay.lovable.app/api/public/v1/payments \
  -H "Authorization: Bearer oxp_test_sk_..." \
  -H "Idempotency-Key: order-1042-try1" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 2450,
    "order_id": "1042",
    "description": "Order #1042",
    "return_url": "https://shop.example.bd/orders/1042"
  }'

# 201 Created
{
  "payment_id": "6f1c…",
  "order_id": "1042",
  "amount": 2450,
  "currency": "BDT",
  "status": "pending",
  "verified": false,
  "livemode": false,
  "checkout_url": "https://oxypay.lovable.app/pay/ab12cd34ef",
  "expires_at": "…"
}

// Node.js — sign a request (optional, or required if you turn on "Signed only")
import crypto from "node:crypto";

const ts = Math.floor(Date.now() / 1000);
const body = JSON.stringify({ amount: 2450, order_id: "1042" });
const toSign = `${ts}.POST./api/public/v1/payments.${body}`;   // GET: `${ts}.GET./api/public/v1/payments/1042.`
const sig = crypto.createHmac("sha256", process.env.OXYPAY_SIGNING_SECRET).update(toSign).digest("hex");

await fetch("https://oxypay.lovable.app/api/public/v1/payments", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.OXYPAY_SECRET_KEY}`,
    "Content-Type": "application/json",
    "OxyPay-Timestamp": String(ts),
    "OxyPay-Signature": "v1=" + sig,
  },
  body,   // send exactly the bytes you signed
});

// Node.js (Express) — verify an OxyPay webhook
import crypto from "node:crypto";

app.post("/oxypay/webhook", express.raw({ type: "application/json" }), (req, res) => {
  const ts = req.get("OxyPay-Timestamp");
  const expected = "v1=" + crypto
    .createHmac("sha256", process.env.OXYPAY_WEBHOOK_SECRET)
    .update(`${ts}.${req.body.toString()}`)
    .digest("hex");
  const given = req.get("OxyPay-Signature") ?? "";
  const ok = given.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(given), Buffer.from(expected)) &&
    Math.abs(Date.now() / 1000 - Number(ts)) < 300;
  if (!ok) return res.sendStatus(400);

  const event = JSON.parse(req.body);          // { id, type, livemode, data: { order_id, status, verified, ... } }
  if (alreadyProcessed(event.id)) return res.sendStatus(200);
  if (event.type === "payment.succeeded" && event.data.verified) confirmOrder(event.data.order_id);
  res.sendStatus(200);
});