X-API-Key: sk_live_YOUR_OBPAY_SECRET_KEY

curl "https://k5nkqygnd0i42zb1n5c3.helloreaddy.com/functions/v1/obpay-api-no-jwt" \
  -X POST \
  -H "Content-Type: application/json" \
  -H "X-API-Key: sk_live_YOUR_KEY" \
  -d '{
    "_action": "collect",
    "phoneNumber": "0777123456",
    "amount": 50000,
    "currency": "UGX",
    "reference": "INVOICE123456789",
    "description": "Payment for invoice"
  }'

{
  "success": true,
  "data": {
    "reference": "INVOICE123456789",
    "transaction_id": "uuid-here",
    "status": "pending",
    "amount": 50000,
    "currency": "UGX",
    "message": "Collection request sent. Awaiting customer confirmation."
  }
}

curl "https://k5nkqygnd0i42zb1n5c3.helloreaddy.com/functions/v1/obpay-api-no-jwt" \
  -X POST \
  -H "Content-Type: application/json" \
  -H "X-API-Key: sk_live_YOUR_KEY" \
  -d '{
    "_action": "payout",
    "phoneNumber": "0777123456",
    "amount": 50000,
    "currency": "UGX",
    "reference": "WITHDRAW123",
    "description": "Salary payment"
  }'

{
  "success": true,
  "data": {
    "reference": "WITHDRAW123",
    "transaction_id": "uuid-here",
    "status": "pending",
    "amount": 50000,
    "currency": "UGX",
    "message": "Payout request submitted. Awaiting processing."
  }
}

curl "https://k5nkqygnd0i42zb1n5c3.helloreaddy.com/functions/v1/obpay-api-no-jwt" \
  -X POST \
  -H "Content-Type: application/json" \
  -H "X-API-Key: sk_live_YOUR_KEY" \
  -d '{
    "_action": "balance"
  }'

{
  "success": true,
  "data": {
    "available_balance": 1500000,
    "pending_balance": 200000,
    "currency": "UGX"
  }
}

curl "https://k5nkqygnd0i42zb1n5c3.helloreaddy.com/functions/v1/obpay-api-no-jwt" \
  -X POST \
  -H "Content-Type: application/json" \
  -H "X-API-Key: sk_live_YOUR_KEY" \
  -d '{
    "_action": "transaction-status",
    "reference": "INVOICE123"
  }'

{
  "success": true,
  "data": {
    "id": "uuid",
    "reference": "INVOICE123456789",
    "status": "success",
    "amount": 50000,
    "currency": "UGX",
    "fee_amount": 2500,
    "net_amount": 47500,
    "customer_phone": "+256777123456",
    "payment_method": "MTN",
    "created_at": "2024-01-15 10:30:00",
    "completed_at": "2024-01-15 10:32:15"
  }
}

{
  "event": "payment.success",
  "data": {
    "reference": "INV-123456789",
    "transaction_id": "uuid",
    "status": "success",
    "gross_amount": 50000,
    "fee_amount": 2500,
    "net_amount": 47500,
    "currency": "UGX",
    "customer_phone": "+256777123456",
    "payment_method": "MTN",
    "completed_at": "2024-01-15 10:35:00"
  },
  "timestamp": "2024-01-15T10:35:00Z"
}

const crypto = require('crypto');

function verifyWebhookSignature(payload, signatureHeader, webhookUrl, secret) {
  const [tPart, vPart] = signatureHeader.split(',');
  const timestamp = tPart.split('=')[1];
  const received = vPart.split('=')[1];

  const params = {
    status: payload.status,
    customer_reference: payload.customer_reference,
    internal_reference: payload.internal_reference
  };

  const sorted = Object.keys(params).sort();
  let str = webhookUrl + timestamp;
  sorted.forEach(k => str += k + params[k]);

  const expected = crypto
    .createHmac('sha256', secret)
    .update(str)
    .digest('hex');

  return received === expected;
}

curl "https://k5nkqygnd0i42zb1n5c3.helloreaddy.com/functions/v1/obpay-api-no-jwt" \
  -X POST \
  -H "Content-Type: application/json" \
  -H "X-API-Key: sk_live_YOUR_KEY" \
  -d '{
    "_action": "transaction-status",
    "reference": "INVOICE123"
  }'

{
  "success": true,
  "data": {
    "id": "uuid",
    "reference": "INVOICE123",
    "status": "success",
    "amount": 50000,
    "currency": "UGX",
    "fee_amount": 2500,
    "net_amount": 47500,
    "customer_phone": "+256777123456",
    "created_at": "2024-01-15T10:30:00Z",
    "completed_at": "2024-01-15T10:32:15Z",
    "auto_synced": true,
    "previous_status": "pending"
  }
}

const { createClient } = require('@supabase/supabase-js');

const obpay = createClient(
  'https://k5nkqygnd0i42zb1n5c3.helloreaddy.com',
  'sb_publishable_dFKnLJZfWkXfRVr9l97rEm5s8RweReFt'
);

const OBPAY_KEY = process.env.OBPAY_SECRET_KEY || 'sk_live_YOUR_KEY';

// Check a single transaction — auto-syncs with provider if pending > 30s
async function checkStatus(reference) {
  const { data, error } = await obpay.functions.invoke('obpay-api-no-jwt', {
    body: {
      _api_key: OBPAY_KEY,
      _action: 'transaction-status',
      reference
    }
  });

  if (error) throw new Error(error.message);
  if (!data.success) throw new Error(data.error || 'Status check failed');

  const txn = data.data;
  return {
    reference: txn.reference,
    status: txn.status,              // 'pending' | 'success' | 'failed'
    amount: txn.amount,
    fee: txn.fee_amount || 0,
    netAmount: txn.net_amount || txn.amount,
    wasAutoSynced: txn.auto_synced || false,  // true = provider checked live
    completedAt: txn.completed_at || null
  };
}

const { createClient } = require('@supabase/supabase-js');

const obpay = createClient(
  'https://k5nkqygnd0i42zb1n5c3.helloreaddy.com',
  'sb_publishable_dFKnLJZfWkXfRVr9l97rEm5s8RweReFt'
);

const OBPAY_KEY = process.env.OBPAY_SECRET_KEY;

// Step 1: Initiate collection
async function startPayment(phone, amount) {
  const { data, error } = await obpay.functions.invoke('obpay-api-no-jwt', {
    body: {
      _api_key: OBPAY_KEY,
      _action: 'collect',
      phoneNumber: phone,
      amount: Number(amount),
      currency: 'UGX',
      reference: 'INV-' + Date.now().toString(36).toUpperCase(),
      description: 'Payment for order'
    }
  });
  if (error || !data.success) throw new Error(data.error || error.message);
  return data.data.reference;  // Save this reference
}

// Step 2: Poll until resolved
async function waitForPayment(reference, maxSeconds = 120) {
  const start = Date.now();
  const pollInterval = 4000;  // 4 seconds

  while (Date.now() - start < maxSeconds * 1000) {
    await new Promise(r => setTimeout(r, pollInterval));

    const { data, error } = await obpay.functions.invoke('obpay-api-no-jwt', {
      body: { _api_key: OBPAY_KEY, _action: 'transaction-status', reference }
    });

    if (error || !data?.success) continue;  // transient error, keep polling

    const txn = data.data;

    if (txn.status === 'success') {
      return {
        confirmed: true,
        reference: txn.reference,
        amount: txn.amount,
        fee: txn.fee_amount || 0,
        netAmount: txn.net_amount || txn.amount,
        autoSynced: txn.auto_synced || false
      };
    }

    if (txn.status === 'failed') {
      return { confirmed: false, error: 'Payment was declined or cancelled' };
    }

    // Still pending — continue polling (auto-sync runs on each check)
  }

  return { confirmed: false, error: 'Payment timed out' };
}

// Step 3: Full flow
async function processPayment(phone, amount) {
  console.log('Initiating payment...');
  const ref = await startPayment(phone, amount);
  console.log('Transaction reference:', ref);

  console.log('Waiting for customer to enter PIN...');
  const result = await waitForPayment(ref, 120);

  if (result.confirmed) {
    console.log('Payment confirmed!');
    console.log('Received:', result.netAmount, 'UGX (fee:', result.fee, 'UGX)');
    // Deliver goods, update order status, send confirmation email, etc.
    return { success: true, ...result };
  } else {
    console.log('Payment failed:', result.error);
    // Prompt customer to retry
    return { success: false, error: result.error };
  }
}

from supabase import create_client
import time

obpay = create_client(
    "https://k5nkqygnd0i42zb1n5c3.helloreaddy.com",
    "sb_publishable_dFKnLJZfWkXfRVr9l97rEm5s8RweReFt"
)

OBPAY_KEY = "sk_live_YOUR_KEY"

def check_status(reference: str):
    """Check transaction status — auto-syncs with provider for pending txns."""
    resp = obpay.functions.invoke("obpay-api-no-jwt", {
        "body": {
            "_api_key": OBPAY_KEY,
            "_action": "transaction-status",
            "reference": reference
        }
    })
    if not resp.get("success"):
        raise Exception(resp.get("error", "Status check failed"))
    return resp["data"]

def wait_for_payment(reference: str, max_seconds: int = 120):
    """Poll until payment succeeds or fails."""
    deadline = time.time() + max_seconds
    while time.time() < deadline:
        time.sleep(4)
        try:
            txn = check_status(reference)
            if txn["status"] == "success":
                return {"confirmed": True, **txn}
            if txn["status"] == "failed":
                return {"confirmed": False, "error": "Payment declined"}
        except Exception:
            continue  # transient error, keep polling
    return {"confirmed": False, "error": "Timeout"}

const { data } = await obpay.functions.invoke('obpay-api-no-jwt', {
  body: { _api_key: OBPAY_KEY, _action: 'sync-all-pending' }
});
// Response: { synced: 10, updated: [{ id, reference, status }, ...], logs: [] }

const { createClient } = require('@supabase/supabase-js');

// Create Supabase client (URL + ObPay Public Key — both safe to commit)
const obpay = createClient(
  'https://k5nkqygnd0i42zb1n5c3.helloreaddy.com',
  'sb_publishable_dFKnLJZfWkXfRVr9l97rEm5s8RweReFt'
);

const OBPAY_SECRET_KEY = process.env.OBPAY_SECRET_KEY || 'sk_live_YOUR_KEY';

async function collect({ phone, amount, currency = 'UGX', reference, description = '' }) {
  const ref = reference || 'INV' + Date.now().toString(36).toUpperCase();
  const { data, error } = await obpay.functions.invoke('obpay-api-no-jwt', {
    body: {
      _api_key: OBPAY_SECRET_KEY,
      _action: 'collect',
      phoneNumber: phone,
      amount: Number(amount),
      currency,
      reference: ref.slice(0, 30),
      description
    }
  });
  if (error) throw new Error(error.message);
  if (!data.success) throw new Error(data.error || 'Collection failed');
  return data.data;
}

async function payout({ phone, amount, currency = 'UGX', reference, description = '' }) {
  const ref = reference || 'PAY' + Date.now().toString(36).toUpperCase();
  const { data, error } = await obpay.functions.invoke('obpay-api-no-jwt', {
    body: {
      _api_key: OBPAY_SECRET_KEY,
      _action: 'payout',
      phoneNumber: phone,
      amount: Number(amount),
      currency,
      reference: ref.slice(0, 30),
      description
    }
  });
  if (error) throw new Error(error.message);
  if (!data.success) throw new Error(data.error || 'Payout failed');
  return data.data;
}

async function getBalance() {
  const { data, error } = await obpay.functions.invoke('obpay-api-no-jwt', {
    body: { _api_key: OBPAY_SECRET_KEY, _action: 'balance' }
  });
  if (error) throw new Error(error.message);
  return data.data;
}

async function getTransactionStatus(reference) {
  const { data, error } = await obpay.functions.invoke('obpay-api-no-jwt', {
    body: { _api_key: OBPAY_SECRET_KEY, _action: 'transaction-status', reference }
  });
  if (error) throw new Error(error.message);
  return data.data;
}

async function waitForPayment(reference, maxWaitSeconds = 120) {
  const start = Date.now();
  while (Date.now() - start < maxWaitSeconds * 1000) {
    await new Promise(r => setTimeout(r, 4000));
    try {
      const txn = await getTransactionStatus(reference);
      if (txn.status === 'success') return { confirmed: true, ...txn };
      if (txn.status === 'failed') return { confirmed: false, error: 'Payment declined' };
    } catch (e) {}
  }
  return { confirmed: false, error: 'Timeout' };
}

module.exports = { collect, payout, getBalance, getTransactionStatus, waitForPayment };

https://k5nkqygnd0i42zb1n5c3.helloreaddy.com/functions/v1/obpay-api-no-jwt

X-API-Key: sk_live_xxxxxxxxxxxxxxxx

Authorization: Bearer sk_live_xxxxxxxxxxxxxxxx

<a href="https://obpay.online/pay/YOUR_MERCHANT_SLUG"
   target="_blank"
   style="display:inline-flex;align-items:center;gap:8px;
          padding:12px 24px;background:#10B981;color:white;
          border-radius:8px;text-decoration:none;font-weight:600;
          font-family:system-ui,sans-serif;font-size:14px;">
  Pay with ObPay
</a>

const crypto = require('crypto');

function verifyObPayWebhook(req) {
  const signature = req.headers['x-obpay-signature'];
  if (!signature) return false;
  const [tPart, vPart] = signature.split(',');
  const timestamp = tPart.split('=')[1];
  const receivedHash = vPart.split('=')[1];
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - parseInt(timestamp)) > 300) return false; // Replay attack prevention
  const payload = JSON.stringify(req.body);
  const expectedHash = crypto.createHmac('sha256', process.env.OBPAY_WEBHOOK_SECRET)
    .update(timestamp + '.' + payload).digest('hex');
  return crypto.timingSafeEqual(Buffer.from(receivedHash), Buffer.from(expectedHash));
}