Quick Start Guide

const crypto = require("crypto");
const axios = require("axios");

// Your API key (store in environment variable)
const API_KEY = process.env.CEYPAY_API_KEY; // e.g., ak_live_xxx.sk_live_yyy
const [keyId, secret] = API_KEY.split(".");

// Derive signing key from secret (do this once)
const signingKey = crypto.createHash("sha256").update(secret).digest("hex");

// Create payment
async function createPayment() {
  const timestamp = Date.now().toString();
  const method = "POST";
  const path = "/v1/payment";

  const body = JSON.stringify({
    amount: 100,
    currency: "USDT",
    goods: [
      {
        name: "Premium Plan",
        description: "Monthly subscription to premium features",
      },
    ],
    customerBilling: {
      email: "customer@example.com",
      firstName: "John",
      lastName: "Doe",
    },
  });

  // Generate signature using derived key (NOT raw secret)
  const message = timestamp + method + path + body;
  const signature = crypto
    .createHmac("sha256", signingKey)
    .update(message)
    .digest("hex");

  // Make request - send ONLY key ID, not full API key
  const response = await axios.post(
    `https://api.ceypay.io${path}`,
    JSON.parse(body),
    {
      headers: {
        "Content-Type": "application/json",
        "x-api-key": keyId, // Only the key ID!
        "x-timestamp": timestamp,
        "x-signature": signature,
      },
    },
  );

  console.log("Payment created:", response.data);
  console.log("Checkout link:", response.data.checkoutLink);
  console.log("QR code:", response.data.qrContent);

  return response.data;
}

createPayment().catch(console.error);

import os
import hmac
import hashlib
import time
import json
import requests

# Your API key (store in environment variable)
API_KEY = os.getenv('CEYPAY_API_KEY')  # e.g., ak_live_xxx.sk_live_yyy
key_id, secret = API_KEY.split('.')

# Derive signing key from secret (do this once)
signing_key = hashlib.sha256(secret.encode()).hexdigest()

def create_payment():
    timestamp = str(int(time.time() * 1000))
    method = 'POST'
    path = '/v1/payment'

    body_dict = {
        'amount': 100,
        'currency': 'USDT',
        'goods': [
            {
                'name': 'Premium Plan',
                'description': 'Monthly subscription to premium features'
            }
        ],
        'customerBilling': {
            'email': 'customer@example.com',
            'firstName': 'John',
            'lastName': 'Doe'
        }
    }
    body = json.dumps(body_dict)

    # Generate signature using derived key (NOT raw secret)
    message = f"{timestamp}{method}{path}{body}"
    signature = hmac.new(
        signing_key.encode(),
        message.encode(),
        hashlib.sha256
    ).hexdigest()

    # Make request - send ONLY key ID, not full API key
    response = requests.post(
        f'https://api.ceypay.io{path}',
        json=body_dict,
        headers={
            'x-api-key': key_id,  # Only the key ID!
            'x-timestamp': timestamp,
            'x-signature': signature
        }
    )

    data = response.json()
    print('Payment created:', data)
    print('Checkout link:', data['checkoutLink'])
    print('QR code:', data['qrContent'])

    return data

if __name__ == '__main__':
    create_payment()

#!/bin/bash
export PATH="/usr/bin:/bin:$PATH"
# Your API key
API_KEY="ak_live_d86855bbd8651fcb5f469203621c88e3.sk_live_6985fca378cd894dee359813bd6bb12f4a2922bc81f023f0d062631e3190ff3e"

# Split into key ID and secret
KEY_ID="${API_KEY%%.*}"
SECRET="${API_KEY#*.}"

# Derive signing key from secret (matches PHP: hash('sha256', $secret))
SIGNING_KEY=$(echo -n "$SECRET" | sha256sum | cut -d' ' -f1)

TIMESTAMP=$(date +%s)000
METHOD="POST"
API_PATH="/v1/payment"

BODY='{"amount":12,"currency":"USDT","provider":"BYBIT","goods":[{"name":"Wireless Headphones","description":"Noise-cancelling Bluetooth headphones","mccCode":"5732"}],"webhookUrl":"https://mystore.com/api/payment-webhook","customerBilling":{"email":"customer@example.com","firstName":"John","lastName":"Doe","phone":"+94771234567","address":"123 Main Street"}}'

MESSAGE="${TIMESTAMP}${METHOD}${API_PATH}${BODY}"
SIGNATURE=$(echo -n "$MESSAGE" | openssl dgst -sha256 -hmac "$SIGNING_KEY" | cut -d' ' -f2)

# Send ONLY key ID in header, not full API key
curl -X POST "https://sandbox-api.ceypay.io${API_PATH}" \
  -H "Content-Type: application/json" \
  -H "x-api-key: $KEY_ID" \
  -H "x-timestamp: $TIMESTAMP" \
  -H "x-signature: $SIGNATURE" \
  -d "$BODY"