Bramka płatnicza dla sklepów
i rozliczenia dla platform.

curl -X POST https://api.fiberpay.pl/1.0/orders/collect/item \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -H "X-API-Route: POST /1.0/orders/collect/item" \
  -H "X-API-Nonce: 1781234567" \
  -H "X-API-Key: PUBLIC_KEY" \
  -H "X-API-Signature: HMAC_SHA512(...)" \
  -d '{
    "amount": "149.00",
    "currency": "PLN",
    "parentCode": "w3taegy6fzuj",
    "description": "Zamówienie #1024",
    "callbackUrl": "https://twoja.app/api/fiberpay/callback",
    "redirectUrl": "https://twoja.app/dziekujemy"
  }'

// podpis tworzysz na serwerze; secretKey nigdy nie trafia do frontendu
$route = 'POST /1.0/orders/collect/item';
$nonce = (string) time();
$body = json_encode([
  'amount' => '149.00',
  'currency' => 'PLN',
  'parentCode' => 'w3taegy6fzuj',
  'description' => 'Zamówienie #1024',
  'callbackUrl' => 'https://twoja.app/api/fiberpay/callback',
]);

$signature = hash_hmac('sha512', $route . $nonce . $apiKey . $body, $secretKey);
// wyślij request z nagłówkami X-API-Route, X-API-Nonce, X-API-Key i X-API-Signature

import crypto from 'node:crypto';

const route = 'POST /1.0/orders/collect/item';
const nonce = String(Math.floor(Date.now() / 1000));
const body = JSON.stringify({
  amount: '149.00',
  currency: 'PLN',
  parentCode: 'w3taegy6fzuj',
  description: 'Zamówienie #1024',
  callbackUrl: 'https://twoja.app/api/fiberpay/callback',
});

const signature = crypto
  .createHmac('sha512', process.env.FIBERPAY_SECRET_KEY)
  .update(route + nonce + process.env.FIBERPAY_PUBLIC_KEY + body)
  .digest('hex');