Quickstart

// prismapay.js
import { createHash, createHmac, randomUUID } from "node:crypto";

const BASE = "https://api.prismapay.com.br";
const KEY_ID = process.env.PRISMAPAY_KEY_ID;
const SECRET = process.env.PRISMAPAY_SECRET;

function canonicalQuery(params = {}) {
  const parts = Object.keys(params)
    .sort()
    .flatMap((key) =>
      []
        .concat(params[key])
        .sort()
        .map((value) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`),
    );
  return parts.length ? `?${parts.join("&")}` : "";
}

export async function chamar({ method, path, query = {}, payload, idempotencyKey }) {
  const body = payload === undefined ? "" : JSON.stringify(payload);
  const timestamp = Math.floor(Date.now() / 1000).toString();
  const bodyHash = createHash("sha256").update(body).digest("hex");
  const canonicalPath = `${path}${canonicalQuery(query)}`;
  const canonical = `${timestamp}.${method.toUpperCase()}.${canonicalPath}.${bodyHash}`;

  const headers = {
    "X-Api-Key": KEY_ID,
    "X-Timestamp": timestamp,
    "X-Signature": createHmac("sha256", SECRET).update(canonical).digest("hex"),
  };
  if (body) headers["Content-Type"] = "application/json";
  if (idempotencyKey) headers["Idempotency-Key"] = idempotencyKey;

  const res = await fetch(`${BASE}${canonicalPath}`, {
    method,
    headers,
    ...(body ? { body } : {}),
  });

  const json = await res.json().catch(() => ({}));
  if (!res.ok) throw Object.assign(new Error(json.code ?? "erro"), { ...json, http: res.status });
  return json;
}

const saldo = await chamar({ method: "GET", path: "/v1/balance" });
console.log(saldo);
// { available: 1250000, blocked: 0, currencyCode: "BRL", reservedForFees: 0, reservedBreakdown: [] }

const chave = randomUUID(); // guarde no seu banco ANTES de chamar

const conta = await chamar({
  method: "POST",
  path: "/v1/accounts/pf",
  idempotencyKey: chave,
  payload: {
    cpf: "52998224725",
    name: "Maria da Silva",
    email: "maria@example.com",
    password: "uma-senha-forte",
    phone: "+5511999999999",
  },
});

// { accountId: "...", status: "under_review", createdAt: "...", onboardingUrl: "https://..." }

const status = await chamar({
  method: "GET",
  path: `/v1/accounts/${conta.accountId}/status`,
});

import express from "express";
import { createHmac, timingSafeEqual } from "node:crypto";

const app = express();

// Corpo BRUTO: a assinatura é calculada sobre os bytes exatos.
app.post("/webhooks/prismapay", express.raw({ type: "application/json" }), (req, res) => {
  const header = req.get("X-PrismaPay-Signature") ?? "";
  const [, t] = header.match(/t=(\d+)/) ?? [];
  const [, v1] = header.match(/v1=([0-9a-f]+)/) ?? [];
  if (!t || !v1) return res.sendStatus(400);

  const esperado = createHmac("sha256", process.env.PRISMAPAY_WHSEC)
    .update(`${t}.${req.body.toString("utf8")}`)
    .digest();
  const recebido = Buffer.from(v1, "hex");
  if (recebido.length !== esperado.length || !timingSafeEqual(recebido, esperado)) {
    return res.sendStatus(401);
  }

  const evento = JSON.parse(req.body.toString("utf8"));

  // Deduplique pelo id da entrega e responda rápido. Processe depois.
  enfileirar(req.get("X-PrismaPay-Delivery"), evento);
  res.sendStatus(200);
});