Take payments from any app

curl -X POST https://aptcloud.com/wp-json/aptcloud-pay/v1/oauth/token \
  -u "$APTPAY_CLIENT_ID:$APTPAY_CLIENT_SECRET" \
  -d grant_type=client_credentials

$ch = curl_init('https://aptcloud.com/wp-json/aptcloud-pay/v1/oauth/token');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_USERPWD        => getenv('APTPAY_CLIENT_ID') . ':' . getenv('APTPAY_CLIENT_SECRET'),
    CURLOPT_POSTFIELDS     => http_build_query(['grant_type' => 'client_credentials']),
    CURLOPT_RETURNTRANSFER => true,
]);
$token = json_decode(curl_exec($ch), true)['access_token'];

const basic = Buffer.from(`${process.env.APTPAY_CLIENT_ID}:${process.env.APTPAY_CLIENT_SECRET}`).toString('base64');
const res = await fetch('https://aptcloud.com/wp-json/aptcloud-pay/v1/oauth/token', {
  method: 'POST',
  headers: { Authorization: `Basic ${basic}`, 'Content-Type': 'application/x-www-form-urlencoded' },
  body: new URLSearchParams({ grant_type: 'client_credentials' }),
});
const { access_token, expires_in } = await res.json();

import os, requests

res = requests.post(
    "https://aptcloud.com/wp-json/aptcloud-pay/v1/oauth/token",
    auth=(os.environ["APTPAY_CLIENT_ID"], os.environ["APTPAY_CLIENT_SECRET"]),
    data={"grant_type": "client_credentials"},
)
token = res.json()["access_token"]

{
  "access_token": "eyJhbGciOiJFZERTQSIsInR5cCI6ImF0K2p3dCIs…",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "invoices:read invoices:write refunds:write"
}

curl -X POST https://aptcloud.com/wp-json/aptcloud-pay/v1/invoices \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: order-1042" \
  -d '{
    "reference": "order-1042",
    "currency": "usd",
    "items": [
      { "description": "Pro plan (12 months)", "quantity": 1, "unit_amount": 9900 },
      { "description": "Extra seat", "quantity": 2, "unit_amount": 1500 }
    ],
    "customer": { "email": "jane@example.com", "name": "Jane Doe" },
    "success_url": "https://app.example.com/billing/done",
    "cancel_url": "https://app.example.com/billing"
  }'

$ch = curl_init('https://aptcloud.com/wp-json/aptcloud-pay/v1/invoices');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_HTTPHEADER     => [
        "Authorization: Bearer $token",
        'Content-Type: application/json',
        'Idempotency-Key: order-1042',
    ],
    CURLOPT_POSTFIELDS     => json_encode([
        'reference'   => 'order-1042',
        'currency'    => 'usd',
        'items'       => [['description' => 'Pro plan (12 months)', 'quantity' => 1, 'unit_amount' => 9900]],
        'customer'    => ['email' => 'jane@example.com', 'name' => 'Jane Doe'],
        'success_url' => 'https://app.example.com/billing/done',
        'cancel_url'  => 'https://app.example.com/billing',
    ]),
    CURLOPT_RETURNTRANSFER => true,
]);
$invoice = json_decode(curl_exec($ch), true);
header('Location: ' . $invoice['pay_url']);   // send the customer to pay

const res = await fetch('https://aptcloud.com/wp-json/aptcloud-pay/v1/invoices', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${token}`,
    'Content-Type': 'application/json',
    'Idempotency-Key': 'order-1042',
  },
  body: JSON.stringify({
    reference: 'order-1042',
    currency: 'usd',
    items: [{ description: 'Pro plan (12 months)', quantity: 1, unit_amount: 9900 }],
    customer: { email: 'jane@example.com', name: 'Jane Doe' },
    success_url: 'https://app.example.com/billing/done',
    cancel_url: 'https://app.example.com/billing',
  }),
});
const invoice = await res.json();
// res.redirect(invoice.pay_url);

res = requests.post(
    "https://aptcloud.com/wp-json/aptcloud-pay/v1/invoices",
    headers={"Authorization": f"Bearer {token}", "Idempotency-Key": "order-1042"},
    json={
        "reference": "order-1042",
        "currency": "usd",
        "items": [{"description": "Pro plan (12 months)", "quantity": 1, "unit_amount": 9900}],
        "customer": {"email": "jane@example.com", "name": "Jane Doe"},
        "success_url": "https://app.example.com/billing/done",
        "cancel_url": "https://app.example.com/billing",
    },
)
invoice = res.json()
# redirect the customer to invoice["pay_url"]

Authorization: Bearer eyJhbGciOiJFZERTQSIsInR5cCI6ImF0K2p3dCIs…

{
  "id": "inv_5c1f0e9a2b7d4e6f8a9b0c1d",
  "object": "invoice",
  "number": "INV-000042",
  "status": "paid",
  "reference": "order-1042",
  "currency": "usd",
  "amount_total": 12900,
  "amount_refunded": 0,
  "description": "",
  "items": [
    { "description": "Pro plan (12 months)", "quantity": 1, "unit_amount": 9900, "amount": 9900 },
    { "description": "Extra seat", "quantity": 2, "unit_amount": 1500, "amount": 3000 }
  ],
  "customer": { "email": "jane@example.com", "name": "Jane Doe" },
  "metadata": {},
  "pay_url": "https://aptcloud.com/pay/inv_5c1f0e9a2b7d4e6f8a9b0c1d/",
  "success_url": "https://app.example.com/billing/done",
  "cancel_url": "https://app.example.com/billing",
  "payment": { "payment_intent": "pi_3Q…", "method": "Visa •••• 4242", "receipt_url": "https://pay.stripe.com/receipts/…" },
  "livemode": false,
  "created_at": "2026-10-14T15:02:11+00:00",
  "expires_at": "2026-10-21T15:02:11+00:00",
  "paid_at": "2026-10-14T15:04:52+00:00"
}

curl -X POST https://aptcloud.com/wp-json/aptcloud-pay/v1/invoices/inv_5c1f0e9a2b7d4e6f8a9b0c1d/refund \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: refund-order-1042-1" \
  -d '{ "amount": 1500 }'

"branding": {
  "logo_url": "https://app.example.com/img/logo.png",
  "header_html": "<p><strong>Thanks for your order!</strong></p><p>Questions? <a href=\"mailto:billing@example.com\">billing@example.com</a></p>"
}

curl -X POST https://aptcloud.com/wp-json/aptcloud-pay/v1/invoices/inv_5c1f0e9a2b7d4e6f8a9b0c1d/payment-sheet \
  -H "Authorization: Bearer $TOKEN"

{
  "object": "payment_sheet",
  "invoice": "inv_5c1f0e9a2b7d4e6f8a9b0c1d",
  "payment_intent": "pi_3Q…",
  "client_secret": "pi_3Q…_secret_…",
  "publishable_key": "pk_test_…",
  "merchant_display_name": "Your app",
  "merchant_country": "US",
  "amount": 12900,
  "currency": "usd",
  "livemode": false,
  "expires_at": "2026-10-21T15:02:11+00:00"
}

// Swift Package: https://github.com/stripe/stripe-ios  →  StripePaymentSheet
import StripePaymentSheet

func pay(_ sheet: PaymentSheetParams, from viewController: UIViewController) {
    STPAPIClient.shared.publishableKey = sheet.publishableKey

    var config = PaymentSheet.Configuration()
    config.merchantDisplayName = sheet.merchantDisplayName
    config.applePay = .init(merchantId: "merchant.com.example.yourapp",   // your Apple Merchant ID
                            merchantCountryCode: sheet.merchantCountry)
    config.allowsDelayedPaymentMethods = true          // e.g. bank debits that settle later
    config.returnURL = "yourapp://stripe-redirect"      // for methods that bounce through a browser

    let paymentSheet = PaymentSheet(paymentIntentClientSecret: sheet.clientSecret, configuration: config)
    paymentSheet.present(from: viewController) { result in
        switch result {
        case .completed:
            // Show "Thanks — payment received". Your backend fulfils on the invoice.paid webhook.
            break
        case .canceled:
            break
        case .failed(let error):
            print("Payment failed: \(error.localizedDescription)")
        }
    }
}

// build.gradle: implementation("com.stripe:stripe-android:<latest>")
class CheckoutActivity : AppCompatActivity() {
    private lateinit var paymentSheet: PaymentSheet

    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)
        paymentSheet = PaymentSheet(this, ::onPaymentSheetResult)
    }

    fun pay(sheet: PaymentSheetParams) {
        PaymentConfiguration.init(applicationContext, sheet.publishableKey)
        paymentSheet.presentWithPaymentIntent(
            sheet.clientSecret,
            PaymentSheet.Configuration(
                merchantDisplayName = sheet.merchantDisplayName,
                googlePay = PaymentSheet.GooglePayConfiguration(
                    environment = if (sheet.livemode) PaymentSheet.GooglePayConfiguration.Environment.Production
                                  else PaymentSheet.GooglePayConfiguration.Environment.Test,
                    countryCode = sheet.merchantCountry,
                    currencyCode = sheet.currency.uppercase(),
                ),
                allowsDelayedPaymentMethods = true,
            ),
        )
    }

    private fun onPaymentSheetResult(result: PaymentSheetResult) {
        when (result) {
            is PaymentSheetResult.Completed -> { /* show success; backend fulfils on invoice.paid */ }
            is PaymentSheetResult.Canceled -> {}
            is PaymentSheetResult.Failed -> Log.e("Pay", "Payment failed", result.error)
        }
    }
}

// npm install @stripe/stripe-react-native
import { StripeProvider, useStripe } from '@stripe/stripe-react-native';

// Wrap your app: <StripeProvider publishableKey={sheet.publishable_key} merchantIdentifier="merchant.com.example.yourapp">

function PayButton({ invoiceId }) {
  const { initPaymentSheet, presentPaymentSheet } = useStripe();

  async function pay() {
    // Your own backend calls POST /invoices/{id}/payment-sheet and returns the JSON.
    const sheet = await fetch(`https://api.yourapp.com/checkout/${invoiceId}/sheet`).then((r) => r.json());

    const { error: initError } = await initPaymentSheet({
      paymentIntentClientSecret: sheet.client_secret,
      merchantDisplayName: sheet.merchant_display_name,
      applePay: { merchantCountryCode: sheet.merchant_country },
      googlePay: { merchantCountryCode: sheet.merchant_country, currencyCode: sheet.currency.toUpperCase(), testEnv: !sheet.livemode },
      allowsDelayedPaymentMethods: true,
      returnURL: 'yourapp://stripe-redirect',
    });
    if (initError) return console.warn(initError.message);

    const { error } = await presentPaymentSheet();
    if (!error) { /* show success; backend fulfils on invoice.paid */ }
  }
  // …
}

POST /webhooks/aptcloud-pay HTTP/1.1
Content-Type: application/json
webhook-id: evt_9f3c2a7d1b6e4f08a2c5d9e1
webhook-timestamp: 1760454292
webhook-signature: v1,K5oZfzN95Z9UVu1EsfQmfVNQhnkZ2pj9o9NDN/H/pI4=

{"id":"evt_9f3c2a7d1b6e4f08a2c5d9e1","type":"invoice.paid","created":1760454292,"livemode":false,"data":{"object":{"id":"inv_5c1f0e9a2b7d4e6f8a9b0c1d","status":"paid","reference":"order-1042", …}}}

function aptpay_verify(string $body, array $headers, string $secret): bool {
    $id  = $headers['webhook-id'] ?? '';
    $ts  = $headers['webhook-timestamp'] ?? '';
    $sig = $headers['webhook-signature'] ?? '';
    if (!ctype_digit($ts) || abs(time() - (int) $ts) > 300) return false;
    $key      = base64_decode(substr($secret, strlen('whsec_')));
    $expected = base64_encode(hash_hmac('sha256', "$id.$ts.$body", $key, true));
    foreach (explode(' ', $sig) as $part) {            // the header may carry several signatures
        [$version, $value] = array_pad(explode(',', $part, 2), 2, '');
        if ($version === 'v1' && hash_equals($expected, $value)) return true;
    }
    return false;
}

$body    = file_get_contents('php://input');
$headers = array_change_key_case(getallheaders(), CASE_LOWER);
if (!aptpay_verify($body, $headers, getenv('APTPAY_WEBHOOK_SECRET'))) {
    http_response_code(400);
    exit;
}
$event = json_decode($body, true);
if ($event['type'] === 'invoice.paid') {
    $invoice = $event['data']['object'];   // mark order $invoice['reference'] as paid (once per $event['id'])
}
http_response_code(204);

import crypto from 'node:crypto';
import express from 'express';

const app = express();

app.post('/webhooks/aptcloud-pay', express.raw({ type: 'application/json' }), (req, res) => {
  const id = req.get('webhook-id'), ts = req.get('webhook-timestamp'), sig = req.get('webhook-signature') || '';
  if (!id || !/^\d+$/.test(ts || '') || Math.abs(Date.now() / 1000 - Number(ts)) > 300) return res.sendStatus(400);

  const key = Buffer.from(process.env.APTPAY_WEBHOOK_SECRET.replace(/^whsec_/, ''), 'base64');
  const expected = crypto.createHmac('sha256', key).update(`${id}.${ts}.${req.body}`).digest();
  const ok = sig.split(' ').some((part) => {
    const [version, value] = part.split(',');
    const given = Buffer.from(value || '', 'base64');
    return version === 'v1' && given.length === expected.length && crypto.timingSafeEqual(given, expected);
  });
  if (!ok) return res.sendStatus(400);

  const event = JSON.parse(req.body);
  if (event.type === 'invoice.paid') { /* fulfil event.data.object.reference (once per event.id) */ }
  res.sendStatus(204);
});

import base64, hashlib, hmac, os, time
from flask import Flask, request, abort

app = Flask(__name__)

@app.post("/webhooks/aptcloud-pay")
def aptcloud_pay():
    body = request.get_data()  # raw bytes
    msg_id = request.headers.get("webhook-id", "")
    ts = request.headers.get("webhook-timestamp", "")
    sigs = request.headers.get("webhook-signature", "")
    if not ts.isdigit() or abs(time.time() - int(ts)) > 300:
        abort(400)
    key = base64.b64decode(os.environ["APTPAY_WEBHOOK_SECRET"].removeprefix("whsec_"))
    expected = base64.b64encode(hmac.new(key, f"{msg_id}.{ts}.".encode() + body, hashlib.sha256).digest()).decode()
    if not any(p.startswith("v1,") and hmac.compare_digest(p[3:], expected) for p in sigs.split()):
        abort(400)
    event = request.get_json()
    if event["type"] == "invoice.paid":
        pass  # fulfil event["data"]["object"]["reference"] (once per event["id"])
    return "", 204

// Any official Standard Webhooks library works, e.g. Node:  npm install standardwebhooks
import { Webhook } from 'standardwebhooks';

const wh = new Webhook(process.env.APTPAY_WEBHOOK_SECRET);   // the full "whsec_…" value
const event = wh.verify(rawBody, {
  'webhook-id': req.get('webhook-id'),
  'webhook-timestamp': req.get('webhook-timestamp'),
  'webhook-signature': req.get('webhook-signature'),
});   // throws if the signature or timestamp is invalid

{
  "type": "https://aptcloud.com/developers/#error-invalid_request",
  "title": "Invalid request",
  "status": 400,
  "detail": "unit_amount must be a whole number of minor units (cents), e.g. 1999 for 19.99.",
  "code": "invalid_request",
  "field": "items[0].unit_amount"
}