# Thuprai Pay

> Hosted checkout payment service for merchants. Server-to-server API at `https://pay.awecode.com`. Amounts are integers in minor units (paisa for NPR, cents for USD). JSON is camelCase. Deliver goods only when `POST /api/orders/{id}/verify` returns `fulfilled: true`. Never trust the browser redirect alone.

Auth: `Authorization: Bearer ps_...`

Core flow: create order → redirect customer to `checkoutUrl` → on return (`?id=&status=`) or webhook → verify with our order `id` → fulfill only if `fulfilled: true`.

## Security (required)

- Merchant API is server-to-server only. Never put API keys in browsers or mobile apps.
- Never trust browser redirect query params for fulfillment.
- Deliver only after `POST /api/orders/{id}/verify` returns `fulfilled: true`.
- Verify webhook HMAC (`X-Webhook-Signature`) on the raw body; secret is UTF-8 (not base64-decoded).
- Use `X-Event-ID` for idempotent webhook handling (retries must not double-ship).
- Keep API keys and signing secrets in server env only.
- Use HTTPS for redirects, webhooks, and voucher URLs.
- Before go-live: spoof a success redirect (must not fulfill), replay a webhook (must not double-ship), reject a bad signature.

## Docs

- [Merchant guide](https://pay.awecode.com/docs): Human docs including security checklist
- [Full LLM context](https://pay.awecode.com/llms-full.txt): Complete merchant API reference for agents
- [OpenAPI 3.1](https://pay.awecode.com/openapi.json): Machine-readable Merchant API schema

## Optional

- [Request access](https://pay.awecode.com/request): Merchant onboarding
- [Home](https://pay.awecode.com/): Product overview