Payment Integration Guide

WOMPI_PUBLIC_KEY=pub_prod_xxx           # Frontend public key
WOMPI_INTEGRITY_SECRET=prod_integrity_xxx  # Webhook signature secret
BASE_URL=https://api.kaiu.com.co        # Your backend URL

fetch('/api/wompi/sign', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    reference: 'KAIU-12345',      // Order ID
    amount: 4500000,               // Amount in cents (45000.00 COP)
    currency: 'COP'
  })
})

{
  "signature": "a1b2c3d4e5f6...",
  "reference": "KAIU-12345"
}

const { reference, amount, currency } = req.body;
const integritySecret = process.env.WOMPI_INTEGRITY_SECRET;

if (!reference || !amount || !currency) {
  return res.status(400).json({ error: 'Missing parameters' });
}

// Formula: SHA256(Reference + AmountInCents + Currency + Secret)
const rawString = `${reference}${amount}${currency}${integritySecret}`;
const signature = crypto.createHash('sha256').update(rawString).digest('hex');

return res.status(200).json({ signature, reference });

import { useEffect } from 'react';

function Checkout({ order }) {
  useEffect(() => {
    // 1. Get signature from backend
    const getSignature = async () => {
      const res = await fetch('/api/wompi/sign', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({
          reference: `KAIU-${order.readableId}`,
          amount: Math.round(order.total * 100), // Convert to cents
          currency: 'COP'
        })
      });
      const data = await res.json();
      return data.signature;
    };
    
    // 2. Load Wompi widget
    const loadWompi = async () => {
      const signature = await getSignature();
      
      const script = document.createElement('script');
      script.src = 'https://checkout.wompi.co/widget.js';
      script.setAttribute('data-render', 'payment-form');
      script.setAttribute('data-public-key', import.meta.env.VITE_WOMPI_PUBLIC_KEY);
      script.setAttribute('data-currency', 'COP');
      script.setAttribute('data-amount-in-cents', Math.round(order.total * 100));
      script.setAttribute('data-reference', `KAIU-${order.readableId}`);
      script.setAttribute('data-signature:integrity', signature);
      script.setAttribute('data-redirect-url', `${window.location.origin}/order-confirmation`);
      
      document.body.appendChild(script);
    };
    
    loadWompi();
  }, [order]);
  
  return <div id="payment-form"></div>;
}

{
  "data": {
    "transaction": {
      "id": "1234-5678-9012",
      "reference": "KAIU-12345",
      "amount_in_cents": 4500000,
      "status": "APPROVED",
      "payment_method_type": "CARD",
      "payment_method": {
        "type": "CARD",
        "extra": {
          "bin": "424242",
          "last_four": "4242"
        }
      }
    }
  },
  "signature": {
    "checksum": "abc123..."
  },
  "timestamp": 1709553600
}

export default async function wompiWebhookHandler(req, res) {
  const { data, signature, timestamp } = req.body;
  const { id, reference, amount_in_cents, status } = data.transaction;
  
  // 1. Verify Integrity
  const secret = process.env.WOMPI_INTEGRITY_SECRET;
  const integrityString = `${id}${status}${amount_in_cents}${timestamp}${secret}`;
  const generatedSignature = crypto.createHash('sha256')
    .update(integrityString)
    .digest('hex');
  
  if (generatedSignature !== signature.checksum) {
    return res.status(400).json({ error: "Integrity failed" });
  }
  
  // 2. Respond immediately (Wompi expects fast 200 OK)
  res.status(200).json({ success: true });
  
  // 3. Process asynchronously
  processOrderAsync(req.body).catch(err => {
    console.error("Critical: Error processing order", err);
  });
}

async function processOrderAsync(body) {
  const { reference, status } = body.data.transaction;
  const pinStr = reference.split('-')[1]; // "KAIU-12345" → "12345"
  const pin = parseInt(pinStr, 10);
  
  // Find order in database
  let dbOrder = await prisma.order.findFirst({
    where: { readableId: pin },
    include: { items: true }
  });
  
  if (!dbOrder) {
    console.warn(`Order not found: ${reference}`);
    return;
  }
  
  const venndeloId = dbOrder.externalId || pinStr;
  
  if (status === 'APPROVED') {
    console.log("Payment APPROVED → Confirming order");
    
    // 1. Update Venndelo status
    await fetch(`https://api.venndelo.com/v1/admin/orders/${venndeloId}/modify-order-confirmation-status`, {
      method: 'POST',
      headers: { 
        'Content-Type': 'application/json',
        'X-Venndelo-Api-Key': process.env.VENNDELO_API_KEY 
      },
      body: JSON.stringify({ confirmation_status: 'CONFIRMED' })
    });
    
    // 2. Update local database
    await prisma.order.update({
      where: { id: dbOrder.id },
      data: { status: 'CONFIRMED' }
    });
    
    // 3. Confirm inventory sale
    await InventoryService.confirmSale(dbOrder.items);
    
  } else if (['DECLINED', 'VOIDED', 'ERROR'].includes(status)) {
    console.log(`Payment ${status} → Cancelling order`);
    
    // 1. Update Venndelo
    await fetch(`https://api.venndelo.com/v1/admin/orders/${venndeloId}/modify-order-confirmation-status`, {
      method: 'POST',
      body: JSON.stringify({ confirmation_status: 'REJECTED' })
    });
    
    // 2. Cancel in database
    await prisma.order.update({
      where: { id: dbOrder.id },
      data: { status: 'CANCELLED' }
    });
    
    // 3. Release inventory
    await InventoryService.releaseReserve(dbOrder.items);
  }
}

await InventoryService.confirmSale(dbOrder.items);

await InventoryService.releaseReserve(dbOrder.items);

if (paymentMethod === 'COD') {
  // Skip Wompi widget
  // Create order with paymentMethod: 'COD'
  const order = await createOrder({ ...orderData, paymentMethod: 'COD' });
  
  // Order starts as PENDING
  // Admin manually confirms after delivery
}