PayVault API

Node.js Copy
const crypto = require('crypto');

// ─── Your credentials (store in env vars!) ───────────────────────
const SERVICE_ID = 'your-service-uuid';
const API_KEY    = 'your-64-char-hex-api-key';
const BASE_URL   = 'https://payvault.trialvo.com/api/v1';

async function payvaultRequest(method, path, bodyObj = null) {
  const body      = bodyObj ? JSON.stringify(bodyObj) : '';
  const timestamp = Math.floor(Date.now() / 1000).toString();
  const nonce     = crypto.randomUUID();
  const bodyHash  = crypto.createHash('sha256').update(body).digest('hex');
  const message   = `${SERVICE_ID}:${timestamp}:${nonce}:${bodyHash}`;
  const signature = crypto.createHmac('sha256', API_KEY)
                          .update(message).digest('hex');

  const res = await fetch(`${BASE_URL}${path}`, {
    method,
    headers: {
      'Content-Type':  'application/json',
      'X-Service-Id':  SERVICE_ID,
      'X-Api-Key':     API_KEY,
      'X-Timestamp':   timestamp,
      'X-Nonce':       nonce,
      'X-Body-Hash':   bodyHash,
      'X-Signature':   signature,
    },
    body: body || undefined,
  });

  if (!res.ok) {
    const text = await res.text();
    throw new Error(`PayVault ${res.status}: ${text}`);
  }
  return res.json();
}

// ─── Create a bill ───────────────────────────────────────────────
const bill = await payvaultRequest('POST', '/bills', {
  customer_name:     'Rahim Ahmed',
  customer_email:    'rahim@example.com',
  customer_phone:    '+8801712345678',
  customer_address:  '123 Gulshan Ave',
  customer_city:     'Dhaka',
  customer_state:    'Dhaka',
  customer_postcode: '1212',
  subtotal:          '1500.00',
  final_amount:      '1500.00',
  external_order_id: 'ORD-001',
  success_url:       'https://yoursite.com/payment/success',
  fail_url:          'https://yoursite.com/payment/failed',
  cancel_url:        'https://yoursite.com/payment/cancelled',
  items: [{
    product_name:       'Premium Plan',
    quantity:           1,
    unit_selling_price: '1500.00',
    unit_final_price:   '1500.00',
  }]
});

console.log('Redirect customer to:', bill.pay_url);

// ─── Check bill status ──────────────────────────────────────────
const status = await payvaultRequest('GET', `/bills/${bill.bill_token}`);
console.log('Bill status:', status.status);

PHP Copy
<?php
// ─── Your credentials (store in env vars!) ───────────────────────
$SERVICE_ID = 'your-service-uuid';
$API_KEY    = 'your-64-char-hex-api-key';
$BASE_URL   = 'https://payvault.trialvo.com/api/v1';

function payvaultRequest($method, $path, $bodyObj = null) {
    global $SERVICE_ID, $API_KEY, $BASE_URL;

    $body      = $bodyObj ? json_encode($bodyObj) : '';
    $timestamp = (string) time();
    $nonce     = bin2hex(random_bytes(16));
    $bodyHash  = hash('sha256', $body);
    $message   = "$SERVICE_ID:$timestamp:$nonce:$bodyHash";
    $signature = hash_hmac('sha256', $message, $API_KEY);

    $ch = curl_init("$BASE_URL$path");
    curl_setopt_array($ch, [
        CURLOPT_CUSTOMREQUEST  => $method,
        CURLOPT_POSTFIELDS     => $body ?: null,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT        => 30,
        CURLOPT_HTTPHEADER     => [
            'Content-Type: application/json',
            "X-Service-Id: $SERVICE_ID",
            "X-Api-Key: $API_KEY",
            "X-Timestamp: $timestamp",
            "X-Nonce: $nonce",
            "X-Body-Hash: $bodyHash",
            "X-Signature: $signature",
        ],
    ]);

    $response = curl_exec($ch);
    $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);

    if ($httpCode >= 400) {
        throw new Exception("PayVault error ($httpCode): $response");
    }
    return json_decode($response, true);
}

// ─── Create a bill ───────────────────────────────────────────────
$bill = payvaultRequest('POST', '/bills', [
    'customer_name'     => 'Rahim Ahmed',
    'customer_email'    => 'rahim@example.com',
    'customer_phone'    => '+8801712345678',
    'customer_address'  => '123 Gulshan Ave',
    'customer_city'     => 'Dhaka',
    'customer_state'    => 'Dhaka',
    'customer_postcode' => '1212',
    'subtotal'          => '1500.00',
    'final_amount'      => '1500.00',
    'external_order_id' => 'ORD-001',
    'success_url'       => 'https://yoursite.com/payment/success',
    'fail_url'          => 'https://yoursite.com/payment/failed',
    'cancel_url'        => 'https://yoursite.com/payment/cancelled',
    'items' => [[
        'product_name'       => 'Premium Plan',
        'quantity'           => 1,
        'unit_selling_price' => '1500.00',
        'unit_final_price'   => '1500.00',
    ]]
]);

echo "Redirect customer to: " . $bill['pay_url'] . "\n";
?>

Bash / cURL Copy
# ─── Step 1: Set your credentials ────────────────────────────────
SERVICE_ID="your-service-uuid"
API_KEY="your-64-char-hex-api-key"
BASE_URL="https://payvault.trialvo.com/api/v1"

# ─── Step 2: Prepare the request body ────────────────────────────
BODY='{"customer_name":"Rahim Ahmed","customer_email":"rahim@example.com","customer_phone":"+8801712345678","customer_address":"123 Gulshan Ave","customer_city":"Dhaka","customer_state":"Dhaka","customer_postcode":"1212","subtotal":"1500.00","final_amount":"1500.00","external_order_id":"ORD-001","success_url":"https://yoursite.com/payment/success","fail_url":"https://yoursite.com/payment/failed","cancel_url":"https://yoursite.com/payment/cancelled","items":[{"product_name":"Premium Plan","quantity":1,"unit_selling_price":"1500.00","unit_final_price":"1500.00"}]}'

# ─── Step 3: Compute authentication values ───────────────────────
TIMESTAMP=$(date +%s)
NONCE=$(uuidgen || python3 -c "import uuid; print(uuid.uuid4())")
BODY_HASH=$(echo -n "$BODY" | sha256sum | awk '{print $1}')
MESSAGE="${SERVICE_ID}:${TIMESTAMP}:${NONCE}:${BODY_HASH}"
SIGNATURE=$(echo -n "$MESSAGE" | openssl dgst -sha256 -hmac "$API_KEY" | awk '{print $2}')

# ─── Step 4: Make the request ────────────────────────────────────
curl -X POST "${BASE_URL}/bills" \
  -H "Content-Type: application/json" \
  -H "X-Service-Id: ${SERVICE_ID}" \
  -H "X-Api-Key: ${API_KEY}" \
  -H "X-Timestamp: ${TIMESTAMP}" \
  -H "X-Nonce: ${NONCE}" \
  -H "X-Body-Hash: ${BODY_HASH}" \
  -H "X-Signature: ${SIGNATURE}" \
  -d "$BODY"

Node.js (Express) Copy
const crypto = require('crypto');
const express = require('express');
const app = express();

const IPN_SECRET = 'your-ipn-secret';

// IMPORTANT: Use raw body for signature verification
app.post('/webhook/payvault',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const rawBody  = req.body.toString('utf8');
    const signature = req.headers['x-payvault-signature'] || '';

    // Compute expected signature
    const expected = crypto.createHmac('sha256', IPN_SECRET)
                           .update(rawBody).digest('hex');

    // Constant-time comparison
    if (!crypto.timingSafeEqual(
      Buffer.from(expected, 'hex'),
      Buffer.from(signature, 'hex')
    )) {
      return res.status(403).json({ error: 'Invalid signature' });
    }

    // Process the event
    const data = JSON.parse(rawBody);
    if (data.event === 'payment.success') {
      console.log(`Payment success for ${data.bill_token}`);
      // TODO: fulfill order
    }

    res.json({ received: true });
  }
);

PHP Copy
<?php
$IPN_SECRET = 'your-ipn-secret';

// 1. Read raw body
$rawBody = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_PAYVAULT_SIGNATURE'] ?? '';

// 2. Compute expected signature
$expected = hash_hmac('sha256', $rawBody, $IPN_SECRET);

// 3. Verify (constant-time comparison)
if (!hash_equals($expected, $signature)) {
    http_response_code(403);
    echo json_encode(['error' => 'Invalid signature']);
    exit;
}

// 4. Process the event
$data = json_decode($rawBody, true);
if ($data['event'] === 'payment.success') {
    // Fulfill the order
    error_log("Payment success for bill " . $data['bill_token']);
    // TODO: update order status
}

http_response_code(200);
echo json_encode(['received' => true]);
?>