Quelques lignes. Et vous encaissez.

// 1. Authentifiez-vous avec votre clé de test (sp_test_...)
const SVRNG_PAY_KEY = process.env.SVRNG_PAY_KEY;

// 2. Créez une facture
const response = await fetch('https://api.svrngpay.com/v1/invoices', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${SVRNG_PAY_KEY}`,
    'Content-Type': 'application/json',
    'Idempotency-Key': `order-${orderId}`
  },
  body: JSON.stringify({
    amount: 1500.00,
    currency: 'USD',
    description: 'Mandat — Constitution Delaware C-Corp',
    accepted_chains: ['usdc-eth', 'usdt-eth', 'btc', 'sol'],
    webhook_url: 'https://yoursite.com/webhooks/svrngpay',
    metadata: { order_id: orderId, customer_email: '[email protected]' }
  })
});

const { payment_url, invoice_id, expires_at } = await response.json();

// 3. Redirigez votre client vers le payment_url
// → https://pay.svrngpay.com/inv_a8f3b9c2d1e4f5

{
  "id": "inv_a8f3b9c2d1e4f5",
  "object": "invoice",
  "status": "awaiting_payment",
  "amount": 1500.00,
  "currency": "USD",
  "payment_url": "https://pay.svrngpay.com/inv_a8f3b9c2d1e4f5",
  "created_at": "2026-04-29T14:23:11Z",
  "expires_at": "2026-04-29T15:23:11Z",
  "livemode": false
}

// Express.js — vérification de signature webhook
import crypto from 'crypto';
import express from 'express';

const WEBHOOK_SECRET = process.env.SVRNG_PAY_WEBHOOK_SECRET;

const app = express();

// Important : utilisez le raw body, pas le JSON parsé
app.post('/webhooks/svrngpay',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const signature = req.headers['svrngpay-signature'];
    const timestamp = req.headers['svrngpay-timestamp'];
    const payload   = req.body.toString();

    // 1. Vérifier que le timestamp est récent (≤ 5 min)
    if (Math.abs(Date.now() / 1000 - timestamp) > 300) {
      return res.status(401).send('timestamp expired');
    }

    // 2. Reconstruire la signature attendue
    const expected = crypto
      .createHmac('sha256', WEBHOOK_SECRET)
      .update(`${timestamp}.${payload}`)
      .digest('hex');

    // 3. Comparaison constante (timing-attack-safe)
    if (!crypto.timingSafeEqual(
        Buffer.from(signature), Buffer.from(expected))) {
      return res.status(401).send('invalid signature');
    }

    // 4. Maintenant seulement, traiter l'événement
    const event = JSON.parse(payload);
    switch (event.type) {
      case 'invoice.confirmed':
        // Le paiement est confirmé onchain au seuil configuré
        fulfillOrder(event.data.invoice_id, event.data.metadata);
        break;
      case 'invoice.expired':
        notifyCustomer(event.data.invoice_id);
        break;
    }

    res.status(200).send('ok');
  }
);