Quickstart

AGENTAOS_API_KEY=sk_test_your_key
AGENTAOS_WEBHOOK_SECRET=whsec_your_webhook_secret
APP_URL=https://your-tunnel-address

import express from 'express';
import { AgentaOS, WebhookVerificationError } from '@agentaos/pay';

const app = express();
const agentaos = new AgentaOS(process.env.AGENTAOS_API_KEY!);

// 1. Create a checkout and hand back its URL.
app.post('/checkout', express.json(), async (_req, res) => {
  const checkout = await agentaos.checkouts.create({
    amount: 49.00,
    currency: 'EUR',
    description: 'Pro plan',
    successUrl: `${process.env.APP_URL}/success`,
  });
  res.json({ checkoutUrl: checkout.checkoutUrl });
});

// 2. Receive payment events. Use the RAW body so the signature verifies.
app.post('/webhooks', express.raw({ type: 'application/json' }), (req, res) => {
  let event;
  try {
    event = agentaos.webhooks.verify(
      req.body,                                 // raw Buffer
      req.header('X-AgentaOS-Signature')!,      // format: t=<ts>,v1=<hmac>
      process.env.AGENTAOS_WEBHOOK_SECRET!,
    );
  } catch (err) {
    if (err instanceof WebhookVerificationError) {
      res.status(400).json({ error: 'Invalid signature' });
      return;
    }
    throw err;
  }

  if (event.type === 'checkout.session.completed') {
    const { amount, currency } = event.data; // amount is a string
    console.log(`Paid ${amount} ${currency}`);
    // Fulfill the order: grant access, send an email, update your database.
    // `payer` and `txHash` are also on event.data, but only set on
    // stablecoin checkouts; they are null for card payments.
  }

  res.json({ received: true });
});

app.listen(3000, () => console.log('Listening on :3000'));