اربط متجرك، وأكّد الدفع من السيرفر.

const response = await fetch(`${process.env.SHAMPAY_BASE_URL}/v1/payments`, {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${process.env.SHAMPAY_API_KEY}`,
    'Idempotency-Key': 'checkout-order-104-attempt-1',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    reference: 'order-104',
    title: 'اشتراك شهر',
    amount: '15.00',
    currency: 'USD',
    returnUrl: 'https://store.example/orders/104' // optional
  })
});
const { data, error } = await response.json();
if (!response.ok) throw new Error(error.code);
// Store data.id against your own order BEFORE redirecting.
// Redirect the customer to data.checkoutUrl.

curl -X POST "$SHAMPAY_BASE_URL/v1/payments" \
  -H "Authorization: Bearer $SHAMPAY_API_KEY" \
  -H "Idempotency-Key: checkout-order-104-attempt-1" \
  -H "Content-Type: application/json" \
  -d '{"reference":"order-104","title":"اشتراك شهر","amount":"15.00","currency":"USD","returnUrl":"https://store.example/orders/104"}'

$ch = curl_init(getenv('SHAMPAY_BASE_URL') . '/v1/payments');
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => [
    'Authorization: Bearer ' . getenv('SHAMPAY_API_KEY'),
    'Idempotency-Key: checkout-order-104-attempt-1',
    'Content-Type: application/json',
  ],
  CURLOPT_POSTFIELDS => json_encode([
    'reference' => 'order-104', 'title' => 'اشتراك شهر',
    'amount' => '15.00', 'currency' => 'USD',
    'returnUrl' => 'https://store.example/orders/104',
  ], JSON_UNESCAPED_UNICODE),
]);
$res = json_decode(curl_exec($ch), true);
// Store $res['data']['id'], then redirect to $res['data']['checkoutUrl'].

{
  "data": {
    "id": "...",
    "reference": "order-104",
    "amount": "15.00",
    "currency": "USD",
    "paymentNote": "482913",
    "status": "pending",
    "received": "0.00",
    "remaining": "15.00",
    "overpaid": "0.00",
    "payerName": null,
    "expiresAt": 1790000000000,
    "checkoutUrl": "https://YOUR-HOST/pay/..."
  }
}

import crypto from 'node:crypto';

function verifyShamPay(rawBody, headers, secret) {
  const ts = headers['x-shampay-timestamp'];
  const received = headers['x-shampay-signature'] || '';
  if (!/^\d+$/.test(ts || '')) throw new Error('Missing timestamp');
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300)
    throw new Error('Expired signature');
  const expected = 'v1=' + crypto.createHmac('sha256', secret)
    .update(`${ts}.${rawBody}`).digest('hex');
  const a = Buffer.from(received), b = Buffer.from(expected);
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b))
    throw new Error('Invalid signature');
  const event = JSON.parse(rawBody);
  if (event.id !== headers['x-shampay-event'])
    throw new Error('Event ID mismatch');
  return event;
}

// In one database transaction in YOUR store:
// 1. Find your order by event.data.id / reference.
// 2. Compare expected amount and currency with your stored order.
// 3. Insert event.id into a table with UNIQUE(event_id).
// 4. Mark the order paid and grant access exactly once.
// Duplicate event: return HTTP 200 without granting access again.
// Commit durable work before returning HTTP 200.

{ "error": { "code": "...", "message": "...", "requestId": "..." } }