API de paiement

https://bluepay.myfad.org

Authorization: Bearer bluepay_live_xxxxxxxxxxxxxxxxxx
Content-Type: application/json

const res = await fetch('https://bluepay.myfad.org/api/v1/payments', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer bluepay_live_votre_cle',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    amount: 125000,                      // 1 250 XOF
    channel: 'WAVE',
    idempotencyKey: crypto.randomUUID(),
    customerPhone: '+221771234567',
    description: 'Frais de scolarité S1 2026',
    returnUrl: 'https://votre-site.sn/merci',
    metadata: { studentId: 'UCK-2026-1042' },
  }),
});

const { checkoutUrl } = await res.json();
// → "https://bluepay.myfad.org/pay/cpay_8f26b1f3..."
window.location.href = checkoutUrl;

{
  "id": "clxyz1234abcd",
  "reference": "TXN-a1b2c3d4-e5f6-...",
  "status": "PENDING",
  "amount": 125000,
  "currency": "XOF",
  "channel": "WAVE",
  "checkoutUrl": "https://bluepay.myfad.org/pay/cpay_8f26b1f3b9161d76...",
  "createdAt": "2026-06-30T10:30:00.000Z"
}

const res = await fetch('https://bluepay.myfad.org/api/v1/payments/clxyz1234abcd', {
  headers: { 'Authorization': 'Bearer bluepay_live_votre_cle' },
});
const { id, status, amount } = await res.json();
console.log(status); // "SUCCESS"

// Remboursement total
await fetch('https://bluepay.myfad.org/api/v1/payments/clxyz1234abcd/refund', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer bluepay_live_votre_cle',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({ reason: 'Cours annulé — remboursement automatique' }),
});

// Remboursement partiel — 500 XOF sur 1 250 XOF
await fetch('https://bluepay.myfad.org/api/v1/payments/clxyz1234abcd/refund', {
  method: 'POST',
  headers: { 'Authorization': 'Bearer bluepay_live_votre_cle', 'Content-Type': 'application/json' },
  body: JSON.stringify({ amount: 50000, reason: 'Remboursement partiel' }),
});

{
  "event": "payment.success",
  "data": {
    "id": "clxyz1234abcd",
    "reference": "TXN-a1b2c3d4-...",
    "status": "SUCCESS",
    "amount": 125000,
    "currency": "XOF",
    "channel": "WAVE",
    "customerPhone": "+221771234567",
    "metadata": { "studentId": "UCK-2026-1042" },
    "createdAt": "2026-06-30T10:30:00.000Z",
    "paidAt": "2026-06-30T10:30:42.000Z"
  }
}

const crypto = require('crypto');

app.post('/webhook/bluepay', express.raw({ type: 'application/json' }), (req, res) => {
  const sig      = req.headers['x-bluepay-signature'];
  const secret   = process.env.BLUEPAY_WEBHOOK_SECRET;
  const expected = crypto
    .createHmac('sha256', secret)
    .update(req.body)           // req.body = buffer brut (express.raw obligatoire)
    .digest('hex');

  if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(sig ?? ''))) {
    return res.status(401).json({ error: 'Signature invalide' });
  }

  const { event, data } = JSON.parse(req.body.toString());

  if (event === 'payment.success') {
    // ✅ Valider l'inscription, débloquer la commande
    console.log('Paiement reçu :', data.amount, 'XOF — étudiant :', data.metadata?.studentId);
  }

  res.json({ received: true });
});