Build on Codeproof

https://codeproof.fluxusforge.in

# every request
Authorization: Bearer cp_…

# 1 · catalogue
curl -s https://codeproof.fluxusforge.in/v1/catalog -H "Authorization: Bearer $KEY"

# 2 · quote (price held 60 s)
curl -s https://codeproof.fluxusforge.in/v1/quotes -H "Authorization: Bearer $KEY" \
  -H "Content-Type: application/json" -d '{"sku":"GPLAY-IN-500","qty":1}'

# 3 · order — keep the key; reuse it on retry
curl -s https://codeproof.fluxusforge.in/v1/orders -H "Authorization: Bearer $KEY" \
  -H "Content-Type: application/json" -H "Idempotency-Key: $(uuidgen)" \
  -d '{"quoteId":"<quoteId>","clientReference":"txn-8841"}'

# 4 · reveal once
curl -s -X POST https://codeproof.fluxusforge.in/v1/orders/<orderId>/codes/<codeId>/reveal \
  -H "Authorization: Bearer $KEY" -H "X-Device-Id: pos-12"

Authorization: Bearer cp_…

# keys start with cp_ and are issued per
# deployment: a sandbox key only works in
# the sandbox, a production key only in production

curl -s "https://codeproof.fluxusforge.in/v1/catalog?region=IN" \
  -H "Authorization: Bearer $CODEPROOF_KEY"

{
  "items": [
    {
      "sku": "GPLAY-IN-500",
      "brand": "Google Play",
      "product": "Google Play gift code",
      "region": "IN",
      "currency": "INR",
      "faceValueMinor": "50000",
      "available": true,
      "unitPriceMinor": "49000",
      "terms": null
    },
    {
      "sku": "STEAM-IN-800",
      "brand": "Steam",
      "available": false,
      "unavailableReason": "FX_STALE",
      "...": "…"
    }
  ]
}

curl -s https://codeproof.fluxusforge.in/v1/quotes \
  -H "Authorization: Bearer $CODEPROOF_KEY" \
  -H "Content-Type: application/json" \
  -d '{"sku":"GPLAY-IN-500","qty":2}'

{
  "quoteId": "cmg3q8t2k0001",
  "sku": "GPLAY-IN-500",
  "qty": 2,
  "unitPriceMinor": "49000",
  "totalMinor": "98000",
  "currency": "INR",
  "expiresAt": "2026-09-29T10:15:00.000Z"
}

curl -s https://codeproof.fluxusforge.in/v1/orders \
  -H "Authorization: Bearer $CODEPROOF_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 6f1c2a52-7d8e-4c1b-9a51-3f0e0c2b9d11" \
  -d '{"quoteId":"cmg3q8t2k0001","clientReference":"txn-8841"}'

{
  "orderId": "cmg3qa1xk0004",
  "state": "FULFILLED",
  "sku": "GPLAY-IN-500",
  "qty": 2,
  "deliveredQty": 2,
  "quarantinedQty": 0,
  "unitPriceMinor": "49000",
  "chargedMinor": "98000",
  "currency": "INR",
  "deliveryMode": "API",
  "clientReference": "txn-8841",
  "failureCode": null,
  "createdAt": "2026-09-29T10:14:12.000Z",
  "codes": [
    {
      "codeId": "cmg3qa1xm0005",
      "masked": "****-****-7Q2K",
      "status": "DELIVERED",
      "expiresAt": "2027-09-29T00:00:00.000Z",
      "revealedAt": null
    }
  ]
}

curl -s https://codeproof.fluxusforge.in/v1/orders/cmg3qa1xk0004 \
  -H "Authorization: Bearer $CODEPROOF_KEY"

{ "orderId": "cmg3qa1xk0004", "state": "SUPPLIER_AMBIGUOUS", "deliveredQty": 0, "codes": [], "...": "…" }

// 202 → SUPPLIER_AMBIGUOUS: money is held, not lost.
// Do NOT retry with a new Idempotency-Key.
async function waitForFinal(orderId) {
  for (let i = 0; i < 40; i++) {
    const o = await (await fetch(`https://codeproof.fluxusforge.in/v1/orders/${orderId}`, {
      headers: { Authorization: `Bearer ${KEY}` },
    })).json();
    if (!['CREATED', 'WALLET_RESERVED', 'SUPPLIER_PENDING',
          'SUPPLIER_AMBIGUOUS'].includes(o.state)) return o;
    await new Promise((r) => setTimeout(r, 15000));
  }
  // still ambiguous: keep waiting for the webhook
}

curl -s -X POST \
  https://codeproof.fluxusforge.in/v1/orders/cmg3qa1xk0004/codes/cmg3qa1xm0005/reveal \
  -H "Authorization: Bearer $CODEPROOF_KEY" \
  -H "X-Device-Id: pos-terminal-12"

{
  "codeId": "cmg3qa1xm0005",
  "code": "ABCD-EFGH-7Q2K",
  "revealedAt": "2026-09-29T10:16:40.000Z"
}

curl -s https://codeproof.fluxusforge.in/v1/wallet -H "Authorization: Bearer $CODEPROOF_KEY"

{ "currency": "INR", "availableMinor": "4852500", "reservedMinor": "49000" }

curl -s "https://codeproof.fluxusforge.in/v1/wallet/ledger?limit=50" -H "Authorization: Bearer $CODEPROOF_KEY"

{
  "entries": [
    { "at": "…", "bucket": "reserved",  "kind": "fulfil",  "reference": "cmg3qa1xk0004", "memo": null, "amountMinor": "-98000" },
    { "at": "…", "bucket": "available", "kind": "reserve", "reference": "cmg3qa1xk0004", "memo": null, "amountMinor": "-98000" },
    { "at": "…", "bucket": "available", "kind": "topup",   "reference": "UTR2026092900421",     "memo": null, "amountMinor": "5000000" }
  ]
}

curl -s "https://codeproof.fluxusforge.in/v1/events?since=1040" -H "Authorization: Bearer $CODEPROOF_KEY"

{
  "events": [
    { "seq": "1041", "type": "order.fulfilled", "createdAt": "…", "data": { "orderId": "…", "clientReference": "txn-8841", "codes": [ … ] } },
    { "seq": "1042", "type": "wallet.credited", "createdAt": "…", "data": { "amountMinor": "5000000", "utr": "UTR2026092900421" } }
  ]
}

POST https://your-app.example/codeproof/webhook
Content-Type: application/json
X-Codeproof-Event: order.partial
X-Codeproof-Seq: 1042
X-Codeproof-Signature: t=1790000000,v1=5f2c…e9

{"seq":"1042","type":"order.partial","createdAt":"…","data":{…}}

import { createHmac, timingSafeEqual } from 'node:crypto';
import express from 'express';

const SECRET = process.env.CODEPROOF_WEBHOOK_SECRET; // shown once in the portal
const TOLERANCE_S = 300; // 5 minutes

const app = express();
// Verify the RAW body — re-serialised JSON will not match.
app.post('/codeproof/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const header = req.get('X-Codeproof-Signature') ?? '';
  const parts = Object.fromEntries(header.split(',').map((p) => p.split('=', 2)));
  const t = Number(parts.t);
  const body = req.body.toString('utf8');

  const expected = createHmac('sha256', SECRET).update(`${t}.${body}`).digest();
  const given = Buffer.from(parts.v1 ?? '', 'hex');
  const fresh = Number.isFinite(t) && Math.abs(Date.now() / 1000 - t) <= TOLERANCE_S;

  if (!fresh || given.length !== expected.length || !timingSafeEqual(given, expected)) {
    return res.sendStatus(400);
  }
  const event = JSON.parse(body); // { seq, type, createdAt, data }
  // Idempotent: skip if you have already processed event.seq.
  res.sendStatus(200); // any 2xx within 5 s acknowledges
});

// Generate once per checkout attempt and store it with the attempt.
const key = checkout.idempotencyKey ??= crypto.randomUUID();

for (let attempt = 0; attempt < 3; attempt++) {
  try {
    const res = await createOrder(quoteId, key); // same key, same body
    return res;                                  // original result on replay
  } catch (e) {
    if (!isNetworkError(e)) throw e;             // only retry transport errors
  }
}