ডেভেলপার ডকুমেন্টেশন

curl https://telegramdownloadmanager.com/v1/invoices \
  -H "Authorization: Bearer $PAYGATE_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 50000,
    "reference": "order_77",
    "description": "HSC Physics কোর্স",
    "success_url": "https://shop.example/thanks"
  }'

$ch = curl_init("https://telegramdownloadmanager.com/v1/invoices");
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer " . getenv("PAYGATE_KEY"),
    "Content-Type: application/json",
  ],
  CURLOPT_POSTFIELDS => json_encode([
    "amount"      => 50000,
    "reference"   => "order_77",
    "description" => "HSC Physics কোর্স",
    "success_url" => "https://shop.example/thanks",
  ]),
]);
$invoice = json_decode(curl_exec($ch), true);
header("Location: " . $invoice["checkout_url"]);

const r = await fetch("https://telegramdownloadmanager.com/v1/invoices", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.PAYGATE_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    amount: 50000,
    reference: "order_77",
    description: "HSC Physics কোর্স",
    success_url: "https://shop.example/thanks",
  }),
});
const invoice = await r.json();
res.redirect(invoice.checkout_url);

import os, requests

r = requests.post("https://telegramdownloadmanager.com/v1/invoices",
    headers={"Authorization": f"Bearer {os.environ['PAYGATE_KEY']}"},
    json={
        "amount": 50000,
        "reference": "order_77",
        "description": "HSC Physics কোর্স",
        "success_url": "https://shop.example/thanks",
    }, timeout=10)
invoice = r.json()
return redirect(invoice["checkout_url"])

$raw = file_get_contents("php://input");
parse_str(str_replace(",", "&", $_SERVER["HTTP_PAYGATE_SIGNATURE"] ?? ""), $sig);
$expected = hash_hmac("sha256", ($sig["t"] ?? "") . "." . $raw, getenv("PAYGATE_WEBHOOK_SECRET"));

if (!hash_equals($expected, $sig["v1"] ?? "") || abs(time() - (int)$sig["t"]) > 300) {
  http_response_code(401); exit;
}
$event = json_decode($raw, true);
if ($event["type"] === "payment.succeeded") {
  // $event["data"]["reference"] → অর্ডার চালু করুন (একবারই)
}
http_response_code(200);

import crypto from "node:crypto";

// express.raw({ type: "application/json" }) দিয়ে raw body নিন
app.post("/hooks/paygate", express.raw({ type: "application/json" }), (req, res) => {
  const sig = Object.fromEntries(
    (req.get("PayGate-Signature") || "").split(",").map(p => p.split("=")));
  const expected = crypto.createHmac("sha256", process.env.PAYGATE_WEBHOOK_SECRET)
    .update(`${sig.t}.`).update(req.body).digest("hex");
  const ok = sig.v1 && sig.v1.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(sig.v1), Buffer.from(expected)) &&
    Math.abs(Date.now() / 1000 - Number(sig.t)) <= 300;
  if (!ok) return res.sendStatus(401);

  const event = JSON.parse(req.body);
  if (event.type === "payment.succeeded") {
    // event.data.reference → অর্ডার চালু করুন (একবারই)
  }
  res.sendStatus(200);
});

import hashlib, hmac, os, time

def verify(raw: bytes, header: str) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(",") if "=" in p)
    t = parts.get("t", "0")
    expected = hmac.new(os.environ["PAYGATE_WEBHOOK_SECRET"].encode(),
                        f"{t}.".encode() + raw, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, parts.get("v1", "")) and abs(time.time() - int(t)) <= 300

# Flask
@app.post("/hooks/paygate")
def hook():
    if not verify(request.get_data(), request.headers.get("PayGate-Signature", "")):
        return "", 401
    event = request.get_json()
    if event["type"] == "payment.succeeded":
        ...  # event["data"]["reference"] → অর্ডার চালু করুন (একবারই)
    return "", 200