Your checkout.
A clearer way to pay.

// Server-side only · Node.js 18+
import { createHmac } from 'node:crypto';

const secret = process.env.NEROPAY_SECRET_API_KEY;
if (!secret) throw new Error('Missing API secret');

// Store this payload and key with the order before sending.
// Retry the exact same payload with the same idempotency key.
const payload = {
  "identifier": "ORDER-1001",
  "amount": 15.99,
  "currency": "GBP",
  "details": "Online order",
  "ipn_url": "https://example.com/payments/ipn",
  "success_url": "https://example.com/order/thank-you",
  "cancel_url": "https://example.com/order/cancelled",
  "customer_name": "Customer",
  "customer_email": "customer@example.com"
};
const rawBody = JSON.stringify(payload);
const timestamp = String(Math.floor(Date.now() / 1000));
const signature = createHmac('sha256', secret)
  .update(timestamp + '.' + rawBody)
  .digest('hex');

const response = await fetch(
  'https://eu.neropay.app/v2/hosted-payments',
  {
    method: 'POST',
    headers: {
      'Authorization': 'Bearer ' + secret,
      'Accept': 'application/json',
      'Content-Type': 'application/json',
      'X-NeroPay-Timestamp': timestamp,
      'X-NeroPay-Signature': signature,
      'Idempotency-Key': 'hosted-order-1001-v1'
    },
    body: rawBody
  }
);

const result = await response.json();
if (!response.ok || !result.success) {
  throw new Error('Could not create checkout');
}

// Send this URL to the customer; do not mark the order paid here.
const checkoutUrl = result.data.checkout_url;
// Fulfil only after a verified server-side payment result.