Build payments in minutes, not days.

const express = require('express');
const crypto  = require('crypto');
const app     = express();

app.post('/webhooks/ronin', express.json(), (req, res) => {
  // Step 1: Respond 200 immediately — do NOT wait for processing
  res.status(200).json({ received: true });

  const event = req.body;

  // Step 2: Verify the webhook signature
  const keyHash  = crypto.createHash('sha256').update(process.env.RONIN_API_KEY).digest('hex');
  const strToVerify = process.env.RONIN_MERCHANT_ID + event.timestamp + JSON.stringify(event);
  const expected = crypto.createHmac('sha256', keyHash).update(strToVerify).digest('hex');

  if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(event.signature))) {
    console.error('Invalid webhook signature — ignoring');
    return;
  }

  // Step 3: Handle the event
  switch (event.type) {
    case 'payment.success':
      // Mark order paid, send confirmation email, release goods
      markOrderPaid(event.reference, event.paymentId);
      break;

    case 'payment.failed':
      // Release held inventory, notify customer
      handlePaymentFailed(event.reference);
      break;

    case 'payment.refunded':
      handleRefund(event.reference);
      break;
  }
});

from flask import Flask, request, jsonify
import hashlib, hmac, json, os

app = Flask(__name__)

@app.route('/webhooks/ronin', methods=['POST'])
def webhook_handler():
    event = request.get_json()

    # Verify signature
    key_hash = hashlib.sha256(os.environ['RONIN_API_KEY'].encode()).hexdigest()
    str_to_verify = os.environ['RONIN_MERCHANT_ID'] + str(event['timestamp']) + json.dumps(event, separators=(',',':'))
    expected = hmac.new(key_hash.encode(), str_to_verify.encode(), 'sha256').hexdigest()

    if not hmac.compare_digest(expected, event.get('signature', '')):
        return jsonify({'error': 'invalid signature'}), 401

    # Respond 200 first, then process
    event_type = event.get('type')
    if event_type == 'payment.success':
        mark_order_paid(event['reference'], event['paymentId'])
    elif event_type == 'payment.failed':
        handle_payment_failed(event['reference'])
    elif event_type == 'payment.refunded':
        handle_refund(event['reference'])

    return jsonify({'received': True})

<?php

$body  = file_get_contents('php://input');
$event = json_decode($body, true);

// Verify signature
$keyHash      = hash('sha256', getenv('RONIN_API_KEY'));
$strToVerify  = getenv('RONIN_MERCHANT_ID') . $event['timestamp'] . json_encode($event);
$expected     = hash_hmac('sha256', $strToVerify, $keyHash);

if (!hash_equals($expected, $event['signature'] ?? '')) {
    http_response_code(401);
    exit('Invalid signature');
}

// Respond 200 then process
http_response_code(200);
echo json_encode(['received' => true]);
fastcgi_finish_request(); // flush response before processing

switch ($event['type']) {
    case 'payment.success':
        markOrderPaid($event['reference'], $event['paymentId']);
        break;
    case 'payment.failed':
        handlePaymentFailed($event['reference']);
        break;
    case 'payment.refunded':
        handleRefund($event['reference']);
        break;
}

// roninpay.js — drop this in your project
// .env: RONIN_MERCHANT_ID=... RONIN_API_KEY=sk_live_...

const crypto = require('crypto');

const MERCHANT_ID = process.env.RONIN_MERCHANT_ID;
const API_KEY     = process.env.RONIN_API_KEY;
const BASE_URL    = 'http://api.rpy.life/api/v1';

const _keyHash = () =>
  crypto.createHash('sha256').update(API_KEY).digest('hex');

const _sign = (timestamp, body) =>
  crypto.createHmac('sha256', _keyHash())
    .update(MERCHANT_ID + timestamp + body)
    .digest('hex');

async function createPayment({ amount, reference, redirectUrl, description = '' }) {
  const ts   = Math.floor(Date.now() / 1000);
  const body = JSON.stringify({ amount, currency: 'INR', reference, redirectUrl, description });
  const res  = await fetch(`${BASE_URL}/payments`, {
    method: 'POST',
    headers: {
      'Content-Type':       'application/json',
      'X-Timestamp':        String(ts),
      'X-Idempotency-Key':  crypto.randomUUID(),
      'X-Signature':        _sign(ts, body),
    },
    body,
  });
  return res.json();
}

async function getPayment(paymentId) {
  const ts  = Math.floor(Date.now() / 1000);
  const res = await fetch(`${BASE_URL}/payments/${paymentId}`, {
    headers: {
      'X-Timestamp':       String(ts),
      'X-Idempotency-Key': crypto.randomUUID(),
      'X-Signature':       _sign(ts, ''),
    }
  });
  return res.json();
}

module.exports = { createPayment, getPayment };

# roninpay.py — drop this in your project
# .env: RONIN_MERCHANT_ID=... RONIN_API_KEY=sk_live_...

import os, time, hashlib, hmac, json, uuid
import requests as http

MERCHANT_ID = os.environ['RONIN_MERCHANT_ID']
API_KEY     = os.environ['RONIN_API_KEY']
BASE_URL    = 'http://api.rpy.life/api/v1'

def _key_hash():
    return hashlib.sha256(API_KEY.encode()).hexdigest()

def _sign(timestamp, body_str):
    return hmac.new(
        _key_hash().encode(),
        (MERCHANT_ID + str(timestamp) + body_str).encode(),
        'sha256'
    ).hexdigest()

def create_payment(amount, reference, redirect_url, description=''):
    ts   = int(time.time())
    body = json.dumps({
        'amount': amount, 'currency': 'INR',
        'reference': reference, 'redirectUrl': redirect_url,
        'description': description
    }, separators=(',',':'))
    return http.post(
        f'{BASE_URL}/payments',
        headers={
            'Content-Type':      'application/json',
            'X-Timestamp':       str(ts),
            'X-Idempotency-Key': str(uuid.uuid4()),
            'X-Signature':       _sign(ts, body),
        },
        data=body
    ).json()

def get_payment(payment_id):
    ts = int(time.time())
    return http.get(
        f'{BASE_URL}/payments/{payment_id}',
        headers={
            'X-Timestamp':       str(ts),
            'X-Idempotency-Key': str(uuid.uuid4()),
            'X-Signature':       _sign(ts, ''),
        }
    ).json()

<?php
// RoninPay.php — drop this in your project
// .env: RONIN_MERCHANT_ID=... RONIN_API_KEY=sk_live_...

class RoninPay {
    private static function keyHash() {
        return hash('sha256', getenv('RONIN_API_KEY'));
    }
    private static function sign($ts, $body) {
        return hash_hmac('sha256',
            getenv('RONIN_MERCHANT_ID') . $ts . $body,
            self::keyHash()
        );
    }
    private static function request($method, $path, $body='') {
        $ts  = time();
        $url = 'http://api.rpy.life/api/v1' . $path;
        $ch  = curl_init($url);
        curl_setopt_array($ch, [
            CURLOPT_CUSTOMREQUEST  => $method,
            CURLOPT_POSTFIELDS     => $body,
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_HTTPHEADER     => [
                'Content-Type: application/json',
                'X-Timestamp: '       . $ts,
                'X-Idempotency-Key: ' . sprintf('%04x%04x-%04x-%04x-%04x-%04x%04x%04x',
                    mt_rand(0,65535),mt_rand(0,65535),mt_rand(0,65535),
                    mt_rand(0,0x0fff)|0x4000,mt_rand(0,0x3fff)|0x8000,
                    mt_rand(0,65535),mt_rand(0,65535),mt_rand(0,65535)),
                'X-Signature: '       . self::sign($ts, $body),
            ],
        ]);
        $result = json_decode(curl_exec($ch), true);
        curl_close($ch);
        return $result;
    }
    public static function createPayment($amount, $ref, $url, $desc='') {
        $body = json_encode([
            'amount'=>$amount,'currency'=>'INR','reference'=>$ref,
            'redirectUrl'=>$url,'description'=>$desc
        ]);
        return self::request('POST', '/payments', $body);
    }
    public static function getPayment($paymentId) {
        return self::request('GET', '/payments/'.$paymentId);
    }
}

// Usage
$result = RoninPay::createPayment(499, 'ORDER_001', 'https://yoursite.com/done', 'Premium Plan');
if ($result['success']) {
    header('Location: ' . $result['paymentUrl']);
}