# Todos os requests autenticados necessitam deste header:X-API-Key: spk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx # Exemplo cURL:curl "https://backend-phi-seven-54.vercel.app/api/payments" \  -H "X-API-Key: spk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

const createPayment = async () => {  const response = await fetch("https://backend-phi-seven-54.vercel.app/api/payments", {    method: "POST",    headers: {      "Content-Type": "application/json",      "X-API-Key": "spk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"    },    body: JSON.stringify({      amount: 3000,      expires_in_minutes: 15,      description: "Compra #1234 - Produto XYZ"    })  });   const payment = await response.json();  // Redirecionar cliente para o checkout  window.location.href = payment.pay_url;   // Ou guardar o ID para rastrear  console.log("Payment ID:", payment.payment_id);  // payment.email = "pay-pay-x8f92k@mailtm.com"  // payment.expires_at = "2026-06-16T21:15:00Z"};

const checkStatus = async (paymentId) => {  // Não requer autenticação  const response = await fetch(    `https://backend-phi-seven-54.vercel.app/api/payments/${paymentId}`  );  const details = await response.json();   // status: "pending" | "paid" | "expired"  console.log("Estado:", details.status);  if (details.status === "paid") {    console.log("Transação:", details.transaction_id);    console.log("Pago em:", details.paid_at);  }};

const listPayments = async () => {  const params = new URLSearchParams({    status: "paid",    limit: "20",    offset: "0"  });  const response = await fetch(    `https://backend-phi-seven-54.vercel.app/api/payments?${params}`,    { headers: { "X-API-Key": "spk_xxxxxxxxxxxxxxxxxxxxxxxx" } }  );  const payments = await response.json();  console.log(`Total recebidos: ${payments.length}`);};

// Header recebido no seu servidor:// X-SPay-Signature: e3b0c44298fc1c149afbf4c... {  "event": "payment.paid",  "data": {    "payment_id": "pay_x8f92k",    "status": "paid",    "amount": 3000.0,    "currency": "Kz",    "transaction_id": "10963242",    "recipient_phone": "922599463",    "paid_at": "2026-06-07T12:04:05"  }}

const express = require("express");const crypto = require("crypto"); const API_KEY = "spk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx";const BASE_URL = "https://backend-phi-seven-54.vercel.app";const WEBHOOK_SECRET = "whsec_xxxxxxxxxxxxxxxxxxxxxxxx"; const app = express();app.use(express.json()); // 1. Criar cobrança no checkout da lojaapp.post("/checkout", async (req, res) => {  const { amount, description } = req.body;   const spay = await fetch(`${BASE_URL}/api/payments`, {    method: "POST",    headers: { "Content-Type": "application/json", "X-API-Key": API_KEY },    body: JSON.stringify({ amount, expires_in_minutes: 15, description }),  });   if (!spay.ok) return res.status(400).json({ error: "Erro ao criar cobrança" });   const payment = await spay.json();   // Guardar payment_id na base de dados da sua loja  await db.orders.update({ orderId: req.body.orderId }, {    paymentId: payment.payment_id,    paymentStatus: "pending"  });   res.json({ pay_url: payment.pay_url });}); // 2. Receber confirmação via Webhookapp.post("/webhooks/spay", (req, res) => {  const signature = req.headers["x-spay-signature"];  const payloadStr = JSON.stringify(req.body, Object.keys(req.body).sort());  const computed = crypto.createHmac("sha256", WEBHOOK_SECRET)    .update(payloadStr).digest("hex");   if (computed !== signature) return res.status(401).send("Inválido");   const { event, data } = req.body;  if (event === "payment.paid") {    // Activar o produto/serviço para o cliente    console.log(`Pagamento ${data.payment_id} de ${data.amount} Kz confirmado!`);    db.orders.update({ paymentId: data.payment_id }, { status: "paid" });  }   res.sendStatus(200);}); app.listen(3001, () => console.log("Servidor sPay integration a correr na porta 3001"));