API Integral Pay — Paiement Mobile

const axios = require('axios');
const client = axios.create({
  baseURL: 'https://integralpay.com/api',
  headers: { 'X-Api-Key': process.env.INTEGRALPAY_API_KEY },
});

$client = new GuzzleHttp\Client([
    'base_uri' => 'https://integralpay.com/api',
    'headers'  => ['X-Api-Key' => getenv('INTEGRALPAY_API_KEY')],
]);

curl https://integralpay.com/api/merchants/ \
  -H "X-Api-Key: sk_live_..."

curl -X POST .../api/api-keys/generate/UUID/ \
  -H "X-Api-Key: sk_live_..." \
  -d '{"name":"Clé production"}'

async function api(method, endpoint, body) {
  const r = await fetch(`${API_BASE}${endpoint}`, {
    method, body: body ? JSON.stringify(body) : undefined,
    headers: { 'X-Api-Key': API_KEY },
  });
  const d = await r.json();
  if (!r.ok) throw Object.assign(new Error(d.message || d.error), { status: r.status });
  return d;
}

const { data } = await client.post('/payment-links/', {
  title:          'Abonnement mensuel',
  is_amount_fixed: true,
  fixed_amount:   '5000',
  currency:       'XOF',
  provider:       'uuid-provider-orange',
  metadata:       { order_id: '1234' },
});
console.log('Partagez ce lien :', data.payment_url);

$resp = $client->post('/payment-links/', ['json' => [
    'title'           => 'Abonnement mensuel',
    'is_amount_fixed' => true,
    'fixed_amount'    => '5000',
    'currency'        => 'XOF',
    'provider'        => 'uuid-provider-orange',
]]);
$data = json_decode($resp->getBody(), true);
echo 'Lien : ' . $data['payment_url'];

curl -X POST .../api/payment-links/ \
  -H "X-Api-Key: sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{"title":"Abonnement","is_amount_fixed":true,
     "fixed_amount":"5000","currency":"XOF","provider":"uuid"}'

app.post('/checkout', async (req, res) => {
  const { data } = await client.post('/payment-links/init/', {
    title: 'Commande #1234', is_amount_fixed: true,
    fixed_amount: String(req.session.montant),
    currency: 'XOF', provider: 'uuid',
    redirect_url: 'https://ma-boutique.com/retour/',
  });
  req.session.payment_token = data.token;
  res.redirect(data.payment_url);
});

app.get('/retour', async (req, res) => {
  const { data } = await client.get(`/pay/${req.query.payment_token}/result/`);
  if (data.status === 'completed') {
    validerCommande(data.reference);
    return res.render('success', data);
  }
  res.render('echec', { msg: data.message });
});

// 1. Création + redirection
$r = $client->post('/payment-links/init/', ['json' => [
    'title'           => 'Commande #1234',
    'is_amount_fixed' => true,
    'fixed_amount'    => '5000',
    'currency'        => 'XOF',
    'provider'        => 'uuid',
    'redirect_url'    => 'https://ma-boutique.com/retour/',
]]);
$d = json_decode($r->getBody(), true);
$_SESSION['payment_token'] = $d['token'];
header('Location: ' . $d['payment_url']); exit();

// 2. Au retour (retour.php)
$token = $_GET['payment_token'];
$res = json_decode($client->get("/pay/$token/result/")->getBody(), true);
if ($res['status'] === 'completed') { /* valider commande */ }

# 1. Créer le lien avec redirect_url
curl -X POST .../api/payment-links/init/ \
  -H "X-Api-Key: sk_live_..." \
  -d '{"title":"Commande","is_amount_fixed":true,
     "fixed_amount":"5000","currency":"XOF","provider":"uuid",
     "redirect_url":"https://ma-boutique.com/retour/"}'

# 2. Vérifier le statut au retour
curl .../api/pay/TOKEN/result/ -H "X-Api-Key: sk_live_..."

curl -X POST .../api/webhook-endpoints/ \
  -H "X-Api-Key: sk_live_..." \
  -d '{"url":"https://...","event_types":["payment.updated"]}'

const crypto = require('crypto');
app.post('/webhooks', express.json(), (req, res) => {
  const sig  = req.headers['x-signature-sha256'];
  const body = JSON.stringify(Object.fromEntries(Object.entries(req.body).sort()));
  const exp  = crypto.createHmac('sha256', process.env.WEBHOOK_SECRET).update(body).digest('hex');
  if (!crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(exp)))
    return res.status(401).json({error: 'Signature invalide'});
  if (req.body.status === 'succeeded') validerCommande(req.body.reference);
  res.json({message: 'OK'});
});

$p    = json_decode(file_get_contents('php://input'), true);
$recv = $_SERVER['HTTP_X_SIGNATURE_SHA256'] ?? '';
ksort($p);
$exp = hash_hmac('sha256', json_encode($p), getenv('WEBHOOK_SECRET'));
if (!hash_equals($exp, $recv)) { http_response_code(401); die(); }
if ($p['status'] === 'succeeded') { /* valider commande */ }
echo json_encode(['message' => 'OK']);

# Consultation (lecture seule)
curl "https://api.integralpay.com/pay/verify/?token=TOKEN"

# Consommation (anti-double-validation)
curl "https://api.integralpay.com/pay/verify/?token=TOKEN&claim=1"

function verify(secret, payload, received) {
  const body = JSON.stringify(Object.fromEntries(Object.entries(payload).sort()));
  const exp  = crypto.createHmac('sha256', secret).update(body).digest('hex');
  return crypto.timingSafeEqual(Buffer.from(received), Buffer.from(exp));
}

function verify(string $s, array $p, string $r): bool {
    ksort($p);
    $exp = hash_hmac('sha256', json_encode($p), $s);
    return hash_equals($exp, $r);
}

const processed = new Set(); // En production : Redis
app.post('/webhooks', (req, res) => {
  const id = req.headers['x-webhook-id'];
  if (processed.has(id)) return res.json({message: 'Deja traite'});
  processed.add(id);
  res.json({message: 'OK'});
});