Hosted Payment Pages

https://paynow.pmnts.io/v3/[username]/[reference]/[currency]/[amount]/[hash]

const crypto = require('crypto')function buildVerificationHash(sharedSecret, { reference, amount, currency, hideCardHolder, returnPath }) {  let parts = [reference, amount, currency]  if (hideCardHolder) parts.push('true')  if (returnPath) parts.push(returnPath)  return crypto.createHmac('md5', sharedSecret).update(parts.join(':')).digest('hex')}const hash = buildVerificationHash(process.env.FZ_SHARED_SECRET, {  reference: 'INV1121',  amount: '100.25',  currency: 'AUD',})

<iframe id="payment-frame" title="ArtsPay Checkout" style="width:100%; height:600px; border:0;"></iframe><script>  // Must match the environment used to build the checkout URL (sandbox  // shown here; swap to https://paynow.pmnts.io for live).  var PAYMENT_HOST = 'https://paynow.pmnts-sandbox.io';  // 1. Ask your backend for a signed checkout URL (see Step 1), then embed it.  fetch('/api/checkout-url?amount=10.25')    .then(function (res) { return res.json(); })    .then(function (data) { document.getElementById('payment-frame').src = data.url; });  // 2. Adapted from Fat Zebra's documented IFRAME/postMessage listener.  window.addEventListener('message', function (event) {    if (event.origin !== PAYMENT_HOST) return;    var payload = event.data;    if (typeof payload === 'string') {      // Older browsers deliver a query-string style payload instead of an object.      var pairs = payload.split('&');      payload = {};      for (var i = 0; i < pairs.length; i++) {        var kv = pairs[i].split('=');        payload[decodeURIComponent(kv[0])] = decodeURIComponent(kv[1] || '');      }    }    if (!payload || typeof payload !== 'object' || !('message' in payload)) return;    // payload.message can also be 'transaction.cancelled' if the customer backs out.    if (payload.message !== 'transaction.complete') return;    // 3. The response is untrusted until your backend confirms the signature --    // the shared secret needed to check it never reaches this page.    fetch('/api/verify', {      method: 'POST',      headers: { 'Content-Type': 'application/json' },      body: JSON.stringify(payload.data),    })      .then(function (res) { return res.json(); })      .then(function (result) {        console.log(result.verified ? 'Payment verified' : 'INVALID, do not trust this response');      });  });</script>

function verifyPurchaseResponse(sharedSecret, { responseCode, successful, amount, currency, id, token, verification }) {  const expected = crypto    .createHmac('md5', sharedSecret)    .update(`${responseCode}:${successful}:${amount}:${currency}:${id}:${token}`)    .digest('hex')  return expected === verification}const verified = verifyPurchaseResponse(sharedSecret, {  responseCode: r, successful, amount, currency, id, token, verification: v,})if (!verified) {  // tampered or invalid, do not mark the order as paid}