Build payments into your product.

curl -X POST https://api.chainpal.org/api/v1/payments \
  -H "Authorization: Bearer cp_pk_test_..." \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 125000,
    "customerEmail": "chidi.okafor@mail.example",
    "reference": "ORDER10482",
    "callbackURL": "https://harbourview.example/paid",
    "failureURL": "https://harbourview.example/retry",
    "metadata": { "branch": "lekki" }
  }'

POST /api/v1/payments HTTP/1.1
Host: api.chainpal.org
Authorization: Bearer cp_pk_test_...
Content-Type: application/json

{
  "amount": 125000,
  "customerEmail": "chidi.okafor@mail.example",
  "reference": "ORDER10482",
  "callbackURL": "https://harbourview.example/paid",
  "failureURL": "https://harbourview.example/retry",
  "metadata": { "branch": "lekki" }
}

const crypto = require("node:crypto");

// rawBody: the request body exactly as it arrived, before JSON.parse
function isFromChainPal(rawBody, headers, secret) {
  const timestamp = headers["x-chainpal-timestamp"];
  const signature = String(headers["x-chainpal-signature"] || "");

  // optional: refuse deliveries more than five minutes old
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");

  const a = Buffer.from(expected);
  const b = Buffer.from(signature.replace(/^v1=/, ""));
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}