Software products for how Nepal actually works.

# Create a payment and get a checkout URL
curl https://api.milaap.app/v1/payments \
  -H "Authorization: Bearer sk_test_••••••••" \
  -H "Idempotency-Key: order_8841" \
  -d amount=245000 \
  -d currency=NPR \
  -d reference="order_8841" \
  -d return_url="https://shop.example/thanks"

# → 201 Created
{
  "id": "pay_01JCK9Q2W3X4Y5Z6A7B8C9D0E1",
  "status": "created",
  "checkout_url": "https://pay.milaap.app/c/pay_01JCK9…"
}

import Milaap from "@milaap/node";

const milaap = new Milaap(process.env.MILAAP_SECRET_KEY);

const payment = await milaap.payments.create({
  amount: 245000,            // paisa
  currency: "NPR",
  reference: "order_8841",
  returnUrl: "https://shop.example/thanks",
}, { idempotencyKey: "order_8841" });

res.redirect(payment.checkoutUrl);

// Verify NP-Signature: t=<unix>,v1=<hmac>
import { createHmac, timingSafeEqual } from "node:crypto";

function verify(body, header, secret) {
  const { t, v1 } = Object.fromEntries(
    header.split(",").map((kv) => kv.split("="))
  );
  const expected = createHmac("sha256", secret)
    .update(`${t}.${body}`).digest("hex");
  return timingSafeEqual(Buffer.from(v1), Buffer.from(expected));
}