// Requete
{
    "amount": 5000,           // En plus petite unite (5000 = 5000 XAF)
    "currency": "XAF",
    "provider": "mtn_momo",
    "customer_phone": "+242064000000",
    "description": "Commande #1234",
    "metadata": { "order_id": "1234" }
}

// Reponse 201
{
    "id": "01912345-6789-7abc-def0-123456789abc",
    "status": "pending",
    "amount": 5000,
    "currency": "XAF",
    "provider": "mtn_momo",
    "reference": "PAY-XXXXXX",
    "created_at": "2026-03-09T10:00:00+00:00"
}

// Reponse 200
{
    "id": "01912345-6789-7abc-def0-123456789abc",
    "status": "processing",
    "provider_transaction_id": "ext_ref_123",
    "message": "Payment is being processed"
}

// Verifier la signature d'un webhook
$header = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'];
preg_match('/t=(\d+),v1=(.+)/', $header, $m);
$timestamp = $m[1];
$receivedSig = $m[2];

$payload = file_get_contents('php://input');
$expected = hash_hmac('sha256', $timestamp . '.' . $payload, $endpointSecret);

if (!hash_equals($expected, $receivedSig)) {
    http_response_code(401);
    exit('Signature invalide');
}

// Verifier la fraicheur (< 5 min)
if (abs(time() - (int)$timestamp) > 300) {
    http_response_code(401);
    exit('Timestamp expire');
}

$event = json_decode($payload, true);

<?php
$apiKey = 'YOUR_API_KEY';
$apiSecret = 'YOUR_API_SECRET';
$baseUrl = 'https://pay.example.com';

function payhubRequest(string $method, string $path, ?array $body = null): array {
    global $apiKey, $apiSecret, $baseUrl;
    $timestamp = time();
    $nonce = bin2hex(random_bytes(16));
    $bodyJson = $body ? json_encode($body) : '';

    $message = "$timestamp.$method.$path.$bodyJson";
    $signature = hash_hmac('sha256', $message, $apiSecret);

    $ch = curl_init($baseUrl . $path);
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_CUSTOMREQUEST => $method,
        CURLOPT_HTTPHEADER => [
            "X-API-KEY: $apiKey",
            "X-SIGNATURE: $signature",
            "X-TIMESTAMP: $timestamp",
            "X-NONCE: $nonce",
            'Content-Type: application/json',
        ],
        CURLOPT_POSTFIELDS => $bodyJson ?: null,
    ]);
    $response = curl_exec($ch);
    curl_close($ch);
    return json_decode($response, true);
}

// Creer un paiement MTN MoMo
$payment = payhubRequest('POST', '/api/v1/payment-intents', [
    'amount' => 5000,
    'currency' => 'XAF',
    'provider' => 'mtn_momo',
    'customer_phone' => '+242064000000',
    'description' => 'Commande #1234',
]);
echo "ID: " . $payment['id'] . "\n";

// Confirmer
$result = payhubRequest('POST', "/api/v1/payment-intents/{$payment['id']}/confirm");
echo "Status: " . $result['status'] . "\n";

import crypto from 'crypto';

const API_KEY = 'YOUR_API_KEY';
const API_SECRET = 'YOUR_API_SECRET';
const BASE_URL = 'https://pay.example.com';

async function payhubRequest(method, path, body = null) {
    const timestamp = Math.floor(Date.now() / 1000);
    const nonce = crypto.randomBytes(16).toString('hex');
    const bodyStr = body ? JSON.stringify(body) : '';
    const message = `${timestamp}.${method}.${path}.${bodyStr}`;
    const signature = crypto.createHmac('sha256', API_SECRET)
        .update(message).digest('hex');

    const res = await fetch(BASE_URL + path, {
        method,
        headers: {
            'X-API-KEY': API_KEY,
            'X-SIGNATURE': signature,
            'X-TIMESTAMP': String(timestamp),
            'X-NONCE': nonce,
            'Content-Type': 'application/json',
        },
        body: bodyStr || undefined,
    });
    return res.json();
}

// Creer un paiement
const payment = await payhubRequest('POST', '/api/v1/payment-intents', {
    amount: 5000,
    currency: 'XAF',
    provider: 'mtn_momo',
    customer_phone: '+242064000000',
});
console.log('Payment ID:', payment.id);

// Confirmer
const result = await payhubRequest('POST',
    `/api/v1/payment-intents/${payment.id}/confirm`);
console.log('Status:', result.status);