Quickstart

curl -X POST https://api.inzilink.com/api/v1/checkouts \
  -H "Authorization: Bearer sk_test_xxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": "25.00",
    "currency": "USD",
    "description": "Order #12345",
    "metadata": { "order_id": "ORD-123" },
    "redirect_url": "https://yoursite.com/success",
    "webhook_url": "https://yoursite.com/webhooks/inzi"
  }'

const response = await fetch('https://api.inzilink.com/api/v1/checkouts', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer sk_test_xxxxx',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    amount: '25.00',
    currency: 'USD',
    description: 'Order #12345',
    metadata: { order_id: 'ORD-123' },
    redirect_url: 'https://yoursite.com/success',
    webhook_url: 'https://yoursite.com/webhooks/inzi',
  }),
})
 
const { checkout_url } = await response.json()
// Redirect user to checkout_url

import httpx
 
resp = httpx.post(
    "https://api.inzilink.com/api/v1/checkouts",
    headers={
        "Authorization": "Bearer sk_test_xxxxx",
        "Content-Type": "application/json",
    },
    json={
        "amount": "25.00",
        "currency": "USD",
        "description": "Order #12345",
        "metadata": {"order_id": "ORD-123"},
        "redirect_url": "https://yoursite.com/success",
        "webhook_url": "https://yoursite.com/webhooks/inzi",
    },
)
 
checkout_url = resp.json()["checkout_url"]
# Redirect user to checkout_url

import crypto from 'crypto'
 
function verifyWebhook(body, headers, secret) {
  const timestamp = headers['x-inzi-timestamp']
  const signature = headers['x-inzi-signature'].replace('sha256=', '')
 
  const signedPayload = `${timestamp}.${body}`
  const expected = crypto
    .createHmac('sha256', secret)
    .update(signedPayload)
    .digest('hex')
 
  // Timing-safe comparison
  if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature))) {
    throw new Error('Invalid webhook signature')
  }
 
  // Reject stale webhooks (> 5 min)
  if (Math.abs(Date.now() / 1000 - parseInt(timestamp)) > 300) {
    throw new Error('Webhook too old')
  }
 
  return JSON.parse(body)
}

import hmac, hashlib, time, json
 
def verify_webhook(body: str, headers: dict, secret: str) -> dict:
    timestamp = headers["X-Inzi-Timestamp"]
    signature = headers["X-Inzi-Signature"].removeprefix("sha256=")
 
    signed_payload = f"{timestamp}.{body}"
    expected = hmac.new(
        secret.encode(), signed_payload.encode(), hashlib.sha256
    ).hexdigest()
 
    if not hmac.compare_digest(expected, signature):
        raise ValueError("Invalid webhook signature")
 
    if abs(time.time() - int(timestamp)) > 300:
        raise ValueError("Webhook too old")
 
    return json.loads(body)