Документация для мерчантов

X-Api-Key: mk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

curl -X POST https://merch-production-f1cb.up.railway.app/api/payments/create \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: mk_ваш_ключ" \
  -d '{
    "amount": 1000,
    "currency": "RUB",
    "method": "card",
    "traffic_type": "classic",
    "order_id": "ORDER-123",
    "callback_url": "https://yoursite.com/webhook",
    "success_url": "https://yoursite.com/success",
    "fail_url": "https://yoursite.com/fail"
  }'

{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "amount": 1000,
  "currency": "RUB",
  "method": "card",
  "traffic_type": "classic",
  "status": "pending",
  "order_id": "ORDER-123",
  "expires_at": "2024-01-15T12:30:00Z",
  "created_at": "2024-01-15T12:00:00Z",
  "requisite": {
    "type": "card",
    "bank": "sberbank",
    "value": "4276 **** **** 1234",
    "owner_name": "Иван И."
  }
}

curl https://merch-production-f1cb.up.railway.app/api/payments/550e8400-e29b-41d4-a716-446655440000/public

POST https://yoursite.com/webhook
Content-Type: application/json
X-Webhook-Event: payment.success
X-Webhook-Signature: sha256=<hmac>

{
  "event": "payment.success",
  "payment_id": "a09f36b0-05a5-4f30-8b3c-6e60450cfb5e",
  "order_id": "ORDER-123",
  "amount": 3065,
  "currency": "RUB",
  "method": "c2c",
  "traffic_type": "classic",
  "status": "success",
  "fee_amount": 459.75,
  "tx_hash": null,
  "created_at": "2026-06-10T19:50:58.586Z",
  "timestamp": 1781121457358
}

const crypto = require('crypto');

const raw = JSON.stringify(req.body); // сырое тело запроса
const expected = 'sha256=' + crypto
  .createHmac('sha256', WEBHOOK_SECRET)
  .update(raw)
  .digest('hex');

if (req.headers['x-webhook-signature'] !== expected) {
  return res.sendStatus(401); // подпись не совпала
}

app.post('/webhook', express.json(), async (req, res) => {
  const { event, order_id, payment_id, amount, status } = req.body;

  if (event === 'payment.success') {
    // order_id — ваш ID заказа, переданный при создании платежа
    await creditsService.add(order_id, amount);
  }

  res.sendStatus(200); // обязательно вернуть 200
});