Подключение AstraPay

Authorization: Bearer <ключ проекта>
Content-Type: application/json
Idempotency-Key: <ключ операции>

POST https://astrapay.cc/api/v4/checkouts
Authorization: Bearer <ключ проекта>
Idempotency-Key: order-123-checkout
Content-Type: application/json

{"external_user_id":"customer-42","rub_amount":"1200.00"}

curl https://astrapay.cc/api/v4/checkouts \
  -H "Authorization: Bearer $ASTRAPAY_KEY" \
  -H "Idempotency-Key: order-123-checkout" \
  -H "Content-Type: application/json" \
  -d '{"external_user_id":"customer-42","rub_amount":"1200.00"}'

import os
import requests

r = requests.post(
    "https://astrapay.cc/api/v4/checkouts",
    headers={
        "Authorization": f"Bearer {os.environ['ASTRAPAY_KEY']}",
        "Idempotency-Key": "order-123-checkout",
    },
    json={"external_user_id": "customer-42", "rub_amount": "1200.00"},
    timeout=15,
)
r.raise_for_status()
checkout_url = r.json()["checkout_url"]

const res = await fetch("https://astrapay.cc/api/v4/checkouts", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.ASTRAPAY_KEY}`,
    "Idempotency-Key": "order-123-checkout",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ external_user_id: "customer-42", rub_amount: "1200.00" }),
});
const { checkout_url } = await res.json();

POST https://astrapay.cc/api/v3/customer/quotes
Authorization: Bearer <API_KEY>
Content-Type: application/json
Idempotency-Key: topup-customer1042-0001

{
  "external_user_id": "1042",
  "asset_key": "ton_usdt",
  "rub_amount": "1200.00"
}

POST /api/v3/customer/wallets/rotate
Authorization: Bearer <API_KEY>
Idempotency-Key: rotate-customer1042-0001
Content-Type: application/json

{
  "external_user_id": "1042",
  "network": "ton",
  "previous_wallet_id": "<текущий wallet_id>",
  "confirm_retire_previous": true
}

timestamp + "\n" + delivery_id + "\n" + sha256(raw_body).hexdigest()

X-AstraPay-Signature: <HMAC-SHA256, hex>
X-AstraPay-Timestamp: <Unix timestamp>
X-AstraPay-Delivery-Id: <UUID>

import hashlib, hmac, time, uuid

def _sign(secret: str, ts: str, delivery_id: str, body: bytes) -> str:
    message = ts + "\n" + delivery_id + "\n" + hashlib.sha256(body).hexdigest()
    return hmac.new(secret.encode(), message.encode(), hashlib.sha256).hexdigest()

def verify(raw_body: bytes, headers, secret: str) -> bool:
    ts = headers["X-AstraPay-Timestamp"]
    delivery_id = headers["X-AstraPay-Delivery-Id"]
    if abs(time.time() - int(ts)) > 300:
        return False
    uuid.UUID(delivery_id)  # ValueError, если это не UUID
    expected = _sign(secret, ts, delivery_id, raw_body)
    return hmac.compare_digest(expected, headers["X-AstraPay-Signature"])

def receipt_headers(body: bytes, delivery_id: str, secret: str) -> dict:
    ts = str(int(time.time()))
    return {
        "X-AstraPay-Signature": _sign(secret, ts, delivery_id, body),
        "X-AstraPay-Timestamp": ts,
        "X-AstraPay-Delivery-Id": delivery_id,
    }

import crypto from "node:crypto";

const sign = (secret, ts, deliveryId, body) => {
  const bodyHash = crypto.createHash("sha256").update(body).digest("hex");
  return crypto.createHmac("sha256", secret)
    .update(`${ts}\n${deliveryId}\n${bodyHash}`)
    .digest("hex");
};

export function verify(rawBody, headers, secret) {
  const ts = headers["x-astrapay-timestamp"];
  const deliveryId = headers["x-astrapay-delivery-id"];
  const got = Buffer.from(headers["x-astrapay-signature"] ?? "");
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;
  const expected = Buffer.from(sign(secret, ts, deliveryId, rawBody));
  return got.length === expected.length && crypto.timingSafeEqual(got, expected);
}

export function receiptHeaders(body, deliveryId, secret) {
  const ts = String(Math.floor(Date.now() / 1000));
  return {
    "X-AstraPay-Signature": sign(secret, ts, deliveryId, body),
    "X-AstraPay-Timestamp": ts,
    "X-AstraPay-Delivery-Id": deliveryId,
  };
}

function astrapay_sign(string $secret, string $ts, string $deliveryId, string $body): string {
    $message = $ts . "\n" . $deliveryId . "\n" . hash('sha256', $body);
    return hash_hmac('sha256', $message, $secret);
}

function astrapay_verify(string $rawBody, array $h, string $secret): bool {
    $ts = $h['X-AstraPay-Timestamp'] ?? '';
    $deliveryId = $h['X-AstraPay-Delivery-Id'] ?? '';
    if (abs(time() - (int) $ts) > 300) return false;
    $expected = astrapay_sign($secret, $ts, $deliveryId, $rawBody);
    return hash_equals($expected, $h['X-AstraPay-Signature'] ?? '');
}

{
  "protocol_version": 3,
  "status": "credited",
  "receipt_id": "<постоянный ID вашей квитанции>",
  "credit_id": "<из события>",
  "quote_id": "<из события>",
  "customer_id": "<из события>",
  "merchant_id": "<из события>",
  "wallet_id": "<из события>",
  "rub_kopecks": "<точная строка из события>",
  "payload_hash": "<из события>"
}