Developer

Authorization: Bearer sk_live_your_secret_key

// 1) Create a checkout session (server-side)
const res = await fetch("https://api.pay.ccbd.dev/v1/checkout-sessions", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.SECUREPAY_SECRET_KEY}`,
    "Content-Type": "application/json",
    "Idempotency-Key": `order-${orderId}`, // safe retries
  },
  body: JSON.stringify({
    amountMinor: 600000,          // ৳6,000.00
    currency: "BDT",
    description: `Order #${orderId}`,
    metadata: { orderId },        // echoed back in the webhook
    successUrl: "https://yourapp.com/pay/return?order=" + orderId,
    cancelUrl:  "https://yourapp.com/pay/cancel?order=" + orderId,
  }),
});
const { data } = await res.json();

// 2) Redirect the customer to the hosted checkout
redirect(data.url);

// 3) Fulfil the order when the signed webhook arrives (see Webhooks).

curl -X POST https://api.pay.ccbd.dev/v1/checkout-sessions \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: order-1001" \
  -d '{
    "amountMinor": 600000,
    "currency": "BDT",
    "description": "Order #1001",
    "customer": { "name": "Rahim", "email": "rahim@example.com", "phone": "01700000000" },
    "successUrl": "https://yourapp.com/pay/return?order=1001",
    "cancelUrl": "https://yourapp.com/pay/cancel?order=1001",
    "metadata": { "orderId": "1001" }
  }'

{
  "data": {
    "id": "a01dc849-9d27-4faa-a590-daa0bb96efad",
    "status": "OPEN",
    "amountMinor": 600000,
    "currency": "BDT",
    "url": "https://pay.ccbd.dev/checkout/a01dc849-9d27-4faa-a590-daa0bb96efad",
    "eligibleMethods": [
      {
        "acceptanceMethodId": "a2dc7499-5c07-4914-87ab-22023039d559",
        "mode": "GATEWAY",
        "gatewayCode": "sslcommerz",
        "displayLabel": "SSLCommerz",
        "sortOrder": 1
      }
    ],
    "livemode": true,
    "expiresAt": "2026-08-11T20:44:34.243Z"
  }
}

curl https://api.pay.ccbd.dev/v1/public/checkout-sessions/a01dc849.../status
# { "data": { "status": "COMPLETED", "paymentStatus": "SUCCEEDED" } }

{
  "event": "payment.succeeded",
  "merchantId": "888e49fd-aa4f-4f9a-9c39-a413ddbb7cb9",
  "data": {
    "paymentId": "cfdfb57f-388d-4a18-8f73-d61c88f9f843",
    "checkoutSessionId": "a01dc849-9d27-4faa-a590-daa0bb96efad",
    "amountMinor": 600000,
    "currency": "BDT",
    "metadata": { "orderId": "1001" }
  }
}

import express from "express";
import crypto from "crypto";

const app = express();

// IMPORTANT: verify against the RAW body bytes, not a re-serialized object.
app.post(
  "/webhooks/securepay",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const signature = req.header("X-SecurePay-Signature") || "";
    const expected =
      "sha256=" +
      crypto
        .createHmac("sha256", process.env.SECUREPAY_WEBHOOK_SECRET)
        .update(req.body) // Buffer of the raw body
        .digest("hex");

    // Constant-time comparison
    const valid =
      signature.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
    if (!valid) return res.status(400).send("invalid signature");

    const { event, data } = JSON.parse(req.body.toString());
    if (event === "payment.succeeded") {
      // Fulfil using your own reference from data.metadata (e.g. orderId).
      fulfilOrder(data.metadata.orderId, data.paymentId);
    }

    // Respond 2xx to acknowledge. Non-2xx (or a timeout) triggers retries.
    res.status(200).send("ok");
  }
);