Landing tĩnh trên Vercel/Netlify, không backend: nhận chuyển khoản và biết khách đã trả

// Ví dụ Vercel Serverless Function (api/create-checkout.js)
export default async function handler(req, res) {
  if (req.method !== 'POST') return res.status(405).end();
  
  const response = await fetch('https://api.monapay.vn/api/v1/checkouts', {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${process.env.MONAPAY_TOKEN}`,
      'X-Client-Secret': process.env.MONAPAY_CLIENT_SECRET,
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      amount: 500000,
      order_code: 'ORDER-' + Date.now(),
      return_url: 'https://yoursite.com/thank-you',
      cancel_url: 'https://yoursite.com/cancel'
    })
  });
  const data = await response.json();
  
  if (data.checkout_url) {
    res.redirect(302, data.checkout_url);
  } else {
    res.status(500).json({ error: 'Tạo checkout thất bại' });
  }
}

// Ví dụ Vercel Serverless Function (api/webhook.js)
import crypto from 'crypto';

export const config = {
  api: {
    bodyParser: false, // Tắt phân tích JSON để lấy raw body
  },
};

export default async function handler(req, res) {
  if (req.method !== 'POST') return res.status(405).end();

  let rawBody = '';
  for await (const chunk of req) {
    rawBody += chunk;
  }

  const timestamp = req.headers['x-mona-timestamp'] || '';
  const signature = req.headers['x-mona-signature'] || ''; // header gốc gửi lên là X-Mona-Signature (Node tự lowercase key)
  const secret = process.env.MONAPAY_WEBHOOK_SECRET;

  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) {
    return res.status(400).send('Timestamp quá hạn');
  }

  const expected = 'sha256=' + crypto.createHmac('sha256', secret)
    .update(timestamp + '.' + rawBody).digest('hex');

  if (signature.length !== expected.length || !crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
    return res.status(401).send('Sai chữ ký');
  }

  res.status(200).send('OK');

  const data = JSON.parse(rawBody);
  // Gọi API gửi Telegram hoặc Email báo đơn hàng thành công
  // fetch('https://api.telegram.org/bot/sendMessage', { ... })
}

curl -X POST https://api.monapay.vn/api/v1/sandbox/transactions \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-Client-Secret: $CLIENT_SECRET" \
  -H 'Content-Type: application/json' \
  -d '{
    "amount": 500000,
    "description": "Thanh toan don hang",
    "virtual_account_id": "va_abc123"
  }'