Yoco online payments setup for South African stores.

const YOCO_BASE = 'https://payments.yoco.com/api';

export async function yocoFetch(path: string, init: RequestInit = {}) {
  const res = await fetch(`${YOCO_BASE}${path}`, {
    ...init,
    headers: {
      authorization: `Bearer ${process.env.YOCO_SECRET_KEY}`,
      'content-type': 'application/json',
      ...(init.headers || {}),
    },
  });
  if (!res.ok) {
    throw new Error(`Yoco ${res.status}: ${await res.text()}`);
  }
  return res.json();
}

export async function createYocoCheckout(order: {
  id: string;
  amountRands: number;
  email: string;
}) {
  return yocoFetch('/checkouts', {
    method: 'POST',
    body: JSON.stringify({
      amount: Math.round(order.amountRands * 100),
      currency: 'ZAR',
      successUrl: `https://yourstore.co.za/checkout/success?order=${order.id}`,
      cancelUrl: `https://yourstore.co.za/checkout/cancel?order=${order.id}`,
      metadata: { orderId: order.id, customerEmail: order.email },
    }),
  });
}

import crypto from 'node:crypto';

export async function handleYocoWebhook(req: Request, secret: string) {
  const raw = await req.text();
  const sig = req.headers.get('webhook-signature') || '';

  const expected = crypto
    .createHmac('sha256', secret)
    .update(raw)
    .digest('hex');

  // Constant-time compare to avoid timing attacks
  if (
    sig.length !== expected.length ||
    !crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))
  ) {
    return new Response('invalid signature', { status: 401 });
  }

  const event = JSON.parse(raw);
  if (event.type === 'payment.succeeded') {
    await markOrderPaid(event.payload.metadata.orderId, event.payload.id);
  }
  return new Response('ok', { status: 200 });
}