Next.js

ANDORPAY_API_KEY=ap_test_replace_me
ANDORPAY_API_URL=https://api.andorpay.com
ANDORPAY_WEBHOOK_SECRET=whsec_replace_me

import "server-only"

type CheckoutInput = {
  productId: string
  externalCustomerId: string
  customer: {
    email: string
    name?: string
  }
  successUrl?: string
  failUrl?: string
}

type CheckoutResponse = {
  id: string
  sessionId: string
  hostedUrl: string
  expiresAt: string
  request_id: string
}

const apiUrl = process.env.ANDORPAY_API_URL ?? "https://api.andorpay.com"

export async function createAndorpayCheckout(input: CheckoutInput) {
  const apiKey = process.env.ANDORPAY_API_KEY
  if (!apiKey) throw new Error("ANDORPAY_API_KEY is not configured")

  const response = await fetch(`${apiUrl}/v1/checkouts`, {
    method: "POST",
    headers: {
      Authorization: `Bearer ${apiKey}`,
      "Andorpay-Version": "2026-01-01",
      "Content-Type": "application/json",
    },
    body: JSON.stringify(input),
    cache: "no-store",
  })

  const payload = await response.json()
  if (!response.ok) {
    throw Object.assign(new Error(payload.message ?? "AndorPay request failed"), payload)
  }

  return payload as CheckoutResponse
}

import { NextResponse } from "next/server"
import { createAndorpayCheckout } from "@/lib/andorpay"

export const runtime = "nodejs"

export async function POST(request: Request) {
  const input = await request.json()
  const checkout = await createAndorpayCheckout({
    productId: input.productId,
    externalCustomerId: input.customerId,
    customer: {
      email: input.email,
      name: input.name,
    },
    successUrl: new URL("/payment/success", request.url).toString(),
    failUrl: new URL("/payment/failed", request.url).toString(),
  })

  return NextResponse.json({ hostedUrl: checkout.hostedUrl })
}

const response = await fetch("/api/andorpay/checkout", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ productId, customerId, email, name }),
})

const payload = await response.json()
if (!response.ok) throw new Error(payload.message ?? "Checkout failed")

window.location.assign(payload.hostedUrl)

import { createHmac, timingSafeEqual } from "node:crypto"
import { NextResponse } from "next/server"

export const runtime = "nodejs"

function validSignature(rawBody: string, header: string, secret: string) {
  const values = new Map(header.split(",").map((part) => part.trim().split("=", 2)))
  const timestamp = values.get("t")
  const signature = values.get("v1")

  if (!timestamp || !signature || !/^[a-f0-9]{64}$/i.test(signature)) return false
  const timestampSeconds = Number(timestamp)
  if (!Number.isFinite(timestampSeconds)) return false
  if (Math.abs(Date.now() / 1000 - timestampSeconds) > 300) return false

  const expected = createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex")
  const receivedBuffer = Buffer.from(signature, "hex")
  const expectedBuffer = Buffer.from(expected, "hex")

  return receivedBuffer.length === expectedBuffer.length && timingSafeEqual(receivedBuffer, expectedBuffer)
}

export async function POST(request: Request) {
  const rawBody = await request.text()
  const signature = request.headers.get("Andorpay-Signature")
  const secret = process.env.ANDORPAY_WEBHOOK_SECRET

  if (!signature || !secret || !validSignature(rawBody, signature, secret)) {
    return NextResponse.json({ code: "invalid_signature" }, { status: 400 })
  }

  const event = JSON.parse(rawBody) as { id: string; type: string }
  await acceptVerifiedAndorpayEvent(event)
  return NextResponse.json({ received: true })
}