Accept a one-time payment

your server          VINR              customer
    │  create payment  │                   │
    │─────────────────►│                   │
    │  checkoutUrl     │                   │
    │◄─────────────────│   redirect        │
    │──────────────────────────────────────►│ pays on hosted page
    │  payment.completed (webhook)          │
    │◄─────────────────│◄──────────────────│
    │  fulfil order    │                   │

import { Vinr } from '@vinr/sdk';

const vinr = new Vinr({ secretKey: process.env.VINR_SECRET_KEY });

export async function POST(req: Request) {
  const { orderId } = await req.json();

  const payment = await vinr.payments.create(
    {
      amount: 4999,                 // €49.99
      currency: 'EUR',
      description: `Order ${orderId}`,
      returnUrl: `https://yoursite.com/orders/${orderId}/complete`,
      metadata: { orderId },
    },
    { idempotencyKey: `order-${orderId}` },   // safe to retry
  );

  return Response.json({ checkoutUrl: payment.checkoutUrl });
}

const { checkoutUrl } = await fetch('/api/checkout', {
  method: 'POST',
  body: JSON.stringify({ orderId: '1234' }),
}).then((r) => r.json());

window.location.href = checkoutUrl;

const payment = await vinr.payments.retrieve(paymentId);
if (payment.status === 'completed') {
  // show success — but fulfilment happens on the webhook (below)
}

export async function POST(req: Request) {
  const event = vinr.webhooks.verify(
    await req.text(),
    req.headers.get('x-vinr-signature'),
  );

  switch (event.type) {
    case 'payment.completed':
      await fulfillOrder(event.data.metadata.orderId);   // idempotent!
      break;
    case 'payment.failed':
      await notifyCustomer(event.data.metadata.orderId);
      break;
  }
  return new Response('OK', { status: 200 });
}