مشتری واریز می‌کند، سفارش در چند ثانیه تأیید می‌شود

# ساخت فاکتور (مبلغ به ریال)
curl -X POST "https://api.bolgram.ir/v1/payment/create" \
  -H "x-api-key: $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"amount": 4500000, "cus_name": "Ali", "redirect_url": "https://shop.example/thanks",
       "webhook_url": "https://shop.example/hooks/bolgram", "metadata": {"order_id": "1042"}}'

# پاسخ
{"status": true, "invoice_id": "PF...", "payment_url": "https://..."}

<?php
$ch = curl_init('https://api.bolgram.ir/v1/payment/create');
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => ['x-api-key: ' . getenv('TOKEN'), 'Content-Type: application/json'],
  CURLOPT_POSTFIELDS => json_encode([
    'amount' => 4500000,
    'redirect_url' => 'https://shop.example/thanks',
    'webhook_url' => 'https://shop.example/hooks/bolgram',
    'metadata' => ['order_id' => '1042'],
  ]),
]);
$res = json_decode(curl_exec($ch), true);
header('Location: ' . $res['payment_url']);

const res = await fetch('https://api.bolgram.ir/v1/payment/create', {
  method: 'POST',
  headers: { 'x-api-key': process.env.TOKEN, 'Content-Type': 'application/json' },
  body: JSON.stringify({
    amount: 4500000,
    redirect_url: 'https://shop.example/thanks',
    webhook_url: 'https://shop.example/hooks/bolgram',
    metadata: { order_id: '1042' },
  }),
});
const { invoice_id, payment_url } = await res.json();

import os, requests

r = requests.post(
    "https://api.bolgram.ir/v1/payment/create",
    headers={"x-api-key": os.environ["TOKEN"]},
    json={
        "amount": 4500000,
        "redirect_url": "https://shop.example/thanks",
        "webhook_url": "https://shop.example/hooks/bolgram",
        "metadata": {"order_id": "1042"},
    },
    timeout=15,
)
payment_url = r.json()["payment_url"]

// Express: X-Bolgram-Signature = "t=<unix>,v1=<hex>"
// v1 = HMAC_SHA256(WEBHOOK_SECRET, `${t}.${rawBody}`)
app.post('/hooks/bolgram', express.raw({ type: '*/*' }), async (req, res) => {
  const sig = Object.fromEntries(req.get('x-bolgram-signature').split(',').map(p => p.split('=')));
  const expected = crypto.createHmac('sha256', process.env.WEBHOOK_SECRET)
    .update(`${sig.t}.${req.body}`).digest('hex');
  const fresh = Math.abs(Date.now() / 1000 - Number(sig.t)) < 300;
  if (!fresh || !crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(sig.v1 || ''))) return res.sendStatus(401);
  const event = JSON.parse(req.body);
  // Confirm once more before delivering, then deliver only once per invoice_id
  await verifyInvoice(event.invoice_id);   // POST /v1/payment/verify
  res.sendStatus(200);
});