Your First Integration

type CheckoutRecord = {
  id: string;
  userId: string;
  amount: string;
  currency: string;
  status: 'draft' | 'session_created' | 'pending' | 'completed' | 'failed' | 'cancelled';
  obitProduct: '0gate' | '0pools' | '0base' | '0link' | 'scan';
  obitObjectId?: string;
  obitEventIds: string[];
  idempotencyKey: string;
};

import { GateClient } from '@0bit/gate';

const gate = new GateClient({
  apiKey: process.env.OBIT_SECRET_KEY!,
  baseUrl: 'https://gate-api-sandbox.0bit.app',
});

export async function createCheckoutSession(record: CheckoutRecord) {
  const session = await gate.sessions.create(
    {
      amount: record.amount,
      currency: record.currency,
      return_url: 'https://app.partner.example/checkout/done',
      metadata: {
        checkout_id: record.id,
        user_id: record.userId,
      },
    },
    {
      idempotencyKey: record.idempotencyKey,
    },
  );

  await saveCheckout({
    ...record,
    status: 'session_created',
    obitObjectId: session.id,
  });

  return {
    checkoutId: record.id,
    clientSecret: session.client_secret,
  };
}

import { RampCheckout } from '@0bit/gate/react';

export function CheckoutPage({ clientSecret }: { clientSecret: string }) {
  return (
    <RampCheckout
      publishableKey={process.env.NEXT_PUBLIC_OBIT_PUBLISHABLE_KEY!}
      clientSecret={clientSecret}
      onSuccess={({ sessionId }) => {
        console.log('Show confirmation UI while backend verifies', sessionId);
      }}
      onError={({ code, message }) => {
        console.warn(code, message);
      }}
    />
  );
}

import crypto from 'node:crypto';
import express from 'express';

const app = express();

app.post('/webhooks/0bit', express.raw({ type: 'application/json' }), async (req, res) => {
  const rawBody = req.body.toString('utf8');
  const signature = req.header('Gate-Signature') ?? '';

  if (!verifyGateSignature(rawBody, signature, process.env.OBIT_WEBHOOK_SECRET!)) {
    return res.sendStatus(401);
  }

  const event = JSON.parse(rawBody);

  if (await eventAlreadyProcessed(event.id)) {
    return res.sendStatus(200);
  }

  await storeEvent(event.id, event);
  await applyCheckoutEvent(event);

  return res.sendStatus(200);
});

function verifyGateSignature(rawBody: string, header: string, secret: string) {
  const parts = Object.fromEntries(header.split(',').map((part) => part.split('=')));
  const timestamp = Number(parts.t);
  const expected = crypto.createHmac('sha256', secret).update(`${timestamp}.${rawBody}`).digest('hex');
  return crypto.timingSafeEqual(Buffer.from(expected, 'hex'), Buffer.from(parts.v1, 'hex'));
}