Build your session endpoint

{
  "partner_user_id": "usr_8f3ka92m",
  "amount_usd_cents": 345,
  "corridor": "vn_vietqr",
  "kyc_attestation": {
    "verified": true,
    "method": "your_kyc_v2",
    "verified_at": "2026-05-21T13:30:00Z",
    "id_type": "passport",
    "id_country": "IN"
  },
  "sanctions_attestation": {
    "clean": true,
    "screened_at": "2026-05-21T14:25:00Z"
  }
}

{
  "intent_id": "zp_AbCd1234EfGh5678",
  "status": "created",
  "amount_usd_cents": 345,
  "corridor": "vn_vietqr",
  "session_token": "zpst_9b1f…",
  "session_expires_at": 1716305700,
  "created_at": "2026-05-21T14:30:00Z"
}

import crypto from "node:crypto";
import express from "express";

const ZENNOPAY_BASE = process.env.ZENNOPAY_BASE_URL!;   // https://api.sandbox.zennopay.com
                                                         // (api.sandbox.zennopay.in also still served)
const KEY_ID = process.env.ZENNOPAY_HMAC_KEY_ID!;        // e.g. "acme_sandbox_2026q2"
const SECRET = process.env.ZENNOPAY_HMAC_SECRET!;        // <your_secret> — server only

// ── HMAC headers for server-to-server calls ─────────────────────────────
// Canonical string: METHOD\npath\ntimestamp\nnonce\nsha256(body)-hex\n
function hmacHeaders(method: string, urlPath: string, body: string) {
  const timestamp = new Date().toISOString();
  const nonce = crypto.randomBytes(32).toString("hex"); // 64 hex chars
  const bodyHashHex =
    body.length === 0
      ? ""
      : crypto.createHash("sha256").update(body, "utf8").digest("hex");
  const canonical =
    [method.toUpperCase(), urlPath, timestamp, nonce, bodyHashHex].join("\n") + "\n";
  const signature = crypto
    .createHmac("sha256", SECRET)
    .update(canonical, "utf8")
    .digest("base64");
  return {
    "Content-Type": "application/json",
    "X-Zennopay-Key-Id": KEY_ID,
    "X-Zennopay-Timestamp": timestamp,
    "X-Zennopay-Nonce": nonce,
    "X-Zennopay-Signature": signature,
  };
}

// ── The session endpoint your app calls ─────────────────────────────────
const app = express();
app.use(express.json());

app.post("/wallet/checkout-session", async (req, res) => {
  const user = await requireAuthedUser(req);            // your app auth
  const amountUsdCents = authorizeSpend(user, req.body); // your wallet logic

  // Create the intent (HMAC-signed, idempotent). Attestations come from
  // YOUR real KYC + sanctions systems — Zennopay trusts these fields.
  const body = JSON.stringify({
    partner_user_id: user.id,          // your OPAQUE user id — never a gov ID
    amount_usd_cents: amountUsdCents,
    corridor: "vn_vietqr",
    kyc_attestation: {
      verified: true,
      method: "your_kyc_v2",
      verified_at: user.kycVerifiedAt,  // ISO 8601
      id_type: "passport",              // which gov ID the user was KYC'd on
      id_country: "IN",
    },
    sanctions_attestation: {
      clean: true,
      screened_at: user.sanctionsScreenedAt,
    },
  });

  const resp = await fetch(`${ZENNOPAY_BASE}/v1/payment_intents`, {
    method: "POST",
    headers: {
      ...hmacHeaders("POST", "/v1/payment_intents", body),
      "Idempotency-Key": crypto.randomUUID(),
    },
    body,
  });
  if (resp.status !== 201) {
    return res.status(502).json({ error: "intent_creation_failed" });
  }

  // Zennopay minted the session token for us — just pass it through.
  const { intent_id, session_token } = await resp.json();
  res.json({ intentId: intent_id, sessionToken: session_token });
});

// ── Refresh: re-mint the token for the SAME intent ──────────────────────
// Drives the SDK's refreshSession hook. No new intent, no attestations —
// just a fresh session_token for the intent that already exists.
app.post("/wallet/checkout-session/:intentId/refresh", async (req, res) => {
  const user = await requireAuthedUser(req);
  const { intentId } = req.params;
  assertUserOwnsIntent(user, intentId); // look up your own record of the intent

  const path = `/v1/payment_intents/${intentId}/session`;
  const resp = await fetch(`${ZENNOPAY_BASE}${path}`, {
    method: "POST",
    headers: hmacHeaders("POST", path, ""),
  });
  if (resp.status !== 200) {
    return res.status(502).json({ error: "session_remint_failed" });
  }
  const { session_token } = await resp.json();
  res.json({ intentId, sessionToken: session_token });
});