Audience: Developers, Finance Admins
Outcomes: Bank rails enabled; settlement confirmed by webhook
Create a bank link
curl -X POST $API_BASE/api/payments/bank/link -b cookies.txt \ -H 'Content-Type: application/json' \ -d '{"orderId":"ord_123","amount":150000,"currency":"EUR","returnUrl":"https://app.example.com/return"}'
Verify webhooks (HMAC)
app.post('/api/webhooks/bank', express.raw({ type: '*/*' }), (req, res) => { try { const sig = String(req.header('X-Hmac-Signature') || ''); WebhookSecurityService.verifyHmac(req.body, sig, process.env.BANK_WEBHOOK_SECRET!); const event = JSON.parse(req.body.toString()); paymentService.handleBankEvent(event); // e.g., payment_settled res.json({ received: true }); } catch { res.status(400).send('Bad signature'); } });
Notes
Settlement may take hours or days; order status advances when the webhook arrives.
Always store the bank reference for reconciliation.