Payment Gateway API

curl -X POST https://api.see-billing.com/api/v1/oauth/token \
  -H "Content-Type: application/json" \
  -d '{"grant_type":"client_credentials","client_id":"sb_xxx","client_secret":"xxxx"}'

curl -X POST https://api.see-billing.com/api/v1/api/payments \
  -H "Authorization: Bearer <ACCESS_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "orderId": "KID-2026-0001",
    "title": "คอร์สเรียน ป.4",
    "subtitle": "รายเดือน ก.ค.",
    "email": "parent@example.com",
    "amount": 1500,
    "method": "qr",
    "currency": "THB",
    "customerName": "บริษัท เอบีซี จำกัด",
    "customerAddress": "123 ถนนสุขุมวิท กรุงเทพฯ 10110",
    "customerTaxId": "0105558000000",
    "customerPhone": "021234567",
    "metadata": { "value1": "branch-01", "value2": "staff-A", "value3": "promo-x" }
  }'

{
  "paymentId": "665f...",
  "orderId": "KID-2026-0001",
  "status": "pending",
  "method": "qr",
  "currency": "THB",
  "amount": 1500,
  "qrCode": "data:image/png;base64,iVBORw0...",
  "expiresIn": 900,
  "metadata": { "value1": "branch-01", "value2": "staff-A", "value3": "promo-x" }
}

const token = await fetch("https://api.see-billing.com/api/v1/oauth/token", {
  method: "POST", headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ grant_type: "client_credentials",
    client_id: process.env.SB_CLIENT_ID, client_secret: process.env.SB_CLIENT_SECRET }),
}).then(r => r.json());

const payment = await fetch("https://api.see-billing.com/api/v1/api/payments", {
  method: "POST",
  headers: { "Authorization": `Bearer ${token.access_token}`, "Content-Type": "application/json" },
  body: JSON.stringify({ orderId: "KID-2026-0001", title: "คอร์สเรียน ป.4",
    email: "parent@example.com", amount: 1500, method: "qr",
    metadata: { value1: "branch-01", value2: "staff-A" } }),
}).then(r => r.json());
// payment.qrCode -> แสดงให้ลูกค้าสแกน · metadata จะถูกส่งกลับใน webhook

{
  "event": "payment.paid",
  "orderId": "KID-2026-0001",
  "paymentId": "665f...",
  "status": "paid",
  "amount": 1500,
  "amountBeforeVat": 1401.87,
  "currency": "THB",
  "paidAt": "2026-07-03T09:20:00.000Z",
  "receiptNo": "AH-RE2607-0007",
  "metadata": { "value1": "branch-01", "value2": "staff-A", "value3": "promo-x" }
}

import crypto from "node:crypto";

// express: ต้องใช้ raw body (express.raw({ type: "*/*" }))
app.post("/webhooks/see-billing", (req, res) => {
  const raw = req.body.toString("utf8");
  const header = req.get("X-SeeBilling-Signature") || "";
  const parts = Object.fromEntries(header.split(",").map(p => p.split("=")));
  const expected = crypto.createHmac("sha256", process.env.SB_WEBHOOK_SECRET)
    .update(`${parts.t}.${raw}`).digest("hex");
  const ok = crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1 || ""));
  const fresh = Math.abs(Date.now()/1000 - Number(parts.t)) < 300; // 5 นาที
  if (!ok || !fresh) return res.status(401).end();

  const data = JSON.parse(raw);
  // TODO: mark order data.orderId as paid (idempotent)
  res.status(200).end();
});