Take Veriss payments on your website

const crypto = require('crypto');
const SECRET = process.env.VERISS_SECRET_KEY; // vrs_sk_...

const serviceId = 'YOUR_SERVICE_ID';
const amount = 500000;          // kobo (₦5,000). Leave out for fixed-price services.
const reference = 'ORDER-1001'; // your order id: each one can be paid only once

const signature = crypto.createHmac('sha256', SECRET)
  .update([serviceId, amount, reference].join('|'))
  .digest('hex');

const res = await fetch(`{{BASE}}/${serviceId}`, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    amount, reference, signature,
    name: 'Ada Obi',
    email: 'ada@example.com',
    callback_url: 'https://shop.example.com/payment/return',
    metadata: { cartId: 'c_123' },
  }),
});
const { data } = await res.json();
// Send the customer to the hosted checkout page
response.redirect(303, data.checkout_url);

<?php
$secret    = getenv('VERISS_SECRET_KEY');  // vrs_sk_...
$serviceId = 'YOUR_SERVICE_ID';
$amount    = 500000;                       // kobo (₦5,000); use '' for fixed-price services
$reference = 'ORDER-1001';

$signature = hash_hmac('sha256', "$serviceId|$amount|$reference", $secret);

$ch = curl_init("{{BASE}}/$serviceId");
curl_setopt_array($ch, [
  CURLOPT_POST           => true,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER     => ['Content-Type: application/json'],
  CURLOPT_POSTFIELDS     => json_encode([
    'amount' => $amount, 'reference' => $reference, 'signature' => $signature,
    'name' => 'Ada Obi', 'email' => 'ada@example.com',
    'callback_url' => 'https://shop.example.com/payment/return',
  ]),
]);
$result = json_decode(curl_exec($ch), true);
header('Location: ' . $result['data']['checkout_url'], true, 303);

import hmac, hashlib, os, requests

SECRET = os.environ["VERISS_SECRET_KEY"]  # vrs_sk_...
service_id = "YOUR_SERVICE_ID"
amount = 500000           # kobo (₦5,000); use "" for fixed-price services
reference = "ORDER-1001"

payload = f"{service_id}|{amount}|{reference}".encode()
signature = hmac.new(SECRET.encode(), payload, hashlib.sha256).hexdigest()

res = requests.post(f"{{BASE}}/{service_id}", json={
    "amount": amount, "reference": reference, "signature": signature,
    "name": "Ada Obi", "email": "ada@example.com",
    "callback_url": "https://shop.example.com/payment/return",
})
checkout_url = res.json()["data"]["checkout_url"]
# return redirect(checkout_url, code=303)

# signature = HMAC-SHA256 of "YOUR_SERVICE_ID|500000|ORDER-1001" with your secret key
curl -X POST "{{BASE}}/YOUR_SERVICE_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 500000,
    "reference": "ORDER-1001",
    "email": "ada@example.com",
    "callback_url": "https://shop.example.com/payment/return",
    "signature": "<hex signature>"
  }'

<form action="{{BASE}}/YOUR_SERVICE_ID" method="POST">
  <input type="hidden" name="amount" value="500000">
  <input type="hidden" name="reference" value="ORDER-1001">
  <input type="hidden" name="name" value="Ada Obi">
  <input type="hidden" name="email" value="ada@example.com">
  <input type="hidden" name="callback_url" value="https://shop.example.com/payment/return">
  <input type="hidden" name="signature" value="<?= $signature ?>">
  <button type="submit">Pay with Veriss</button>
</form>

{
  "success": true,
  "data": {
    "session_id": "cs_9fJxQ2...",
    "checkout_url": "{{ORIGIN}}/checkout/cs_9fJxQ2...",
    "expires_at": "2026-10-12T10:52:01.000Z",
    "amount": 500000,
    "currency": "NGN",
    "merchant_reference": "ORDER-1001",
    "service": { "id": "YOUR_SERVICE_ID", "name": "Annual Dues" }
  }
}

const signature = crypto.createHmac('sha256', process.env.VERISS_SECRET_KEY)
  .update([serviceId, amount ?? '', reference ?? ''].join('|'))
  .digest('hex');

$signature = hash_hmac('sha256', "$serviceId|$amount|$reference", getenv('VERISS_SECRET_KEY'));

signature = hmac.new(SECRET.encode(), f"{service_id}|{amount}|{reference}".encode(), hashlib.sha256).hexdigest()

app.get('/payment/return', async (req, res) => {
  const { status, session_id, reference, merchant_reference, amount, signature } = req.query;
  const expected = crypto.createHmac('sha256', process.env.VERISS_SECRET_KEY)
    .update([session_id, status, reference, merchant_reference, amount].join('|'))
    .digest('hex');
  if (!signature || signature.length !== expected.length ||
      !crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature))) {
    return res.status(400).send('Invalid signature');
  }
  if (status !== 'success') return res.redirect('/cart?payment=' + status);

  // Confirm with Veriss before delivering the order (see "Verify a payment")
  const order = await confirmAndFulfil(merchant_reference, reference);
  res.redirect('/orders/' + order.id);
});

const r = await fetch(`{{BASE}}/transactions/${encodeURIComponent(reference)}`, {
  headers: { Authorization: `Bearer ${process.env.VERISS_SECRET_KEY}` },
});
const { data } = await r.json();
if (data.status === 'success' && data.merchant_reference === order.id && data.amount === order.amountKobo) {
  await markOrderPaid(order, data.reference);
}

curl "{{BASE}}/transactions/VRS-1791795121727-448" \
  -H "Authorization: Bearer $VERISS_SECRET_KEY"

{
  "success": true,
  "data": {
    "reference": "VRS-1791795121727-448",
    "status": "success",
    "amount": 500000,
    "amount_charged": 530458,
    "fees": 30458,
    "currency": "NGN",
    "paid_at": "2026-10-12T08:52:01.793Z",
    "session_id": "cs_75eMdP2o9QwhJwoiQwsIG4u3",
    "merchant_reference": "ORDER-1001",
    "metadata": { "cartId": "c_123" },
    "payer": { "name": "Ada Obi", "email": "ada@example.com", "phone_number": null },
    "service": { "id": "YOUR_SERVICE_ID", "name": "Annual Dues" },
    "source": "api"
  }
}

{
  "success": true,
  "data": {
    "session_id": "cs_75eMdP2o9QwhJwoiQwsIG4u3",
    "status": "paid",            // open | processing | paid | cancelled | expired
    "merchant_reference": "ORDER-1001",
    "amount": 500000,
    "created_at": "2026-10-12T08:51:40.112Z",
    "transaction": { "reference": "VRS-...", "status": "success", ... }
  }
}

app.post('/webhooks/veriss', express.raw({ type: 'application/json' }), async (req, res) => {
  const expected = crypto.createHmac('sha256', process.env.VERISS_SECRET_KEY)
    .update(req.body) // raw bytes, before JSON.parse
    .digest('hex');
  const received = String(req.get('X-Veriss-Signature') || '');
  if (received.length !== expected.length ||
      !crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(received))) {
    return res.sendStatus(401);
  }
  const { event, data } = JSON.parse(req.body);
  if (event === 'payment.completed') {
    await markOrderPaid(data.merchant_reference, data); // idempotent: it can arrive more than once
  }
  res.sendStatus(200);
});

<?php
$body     = file_get_contents('php://input');
$expected = hash_hmac('sha256', $body, getenv('VERISS_SECRET_KEY'));
if (!hash_equals($expected, $_SERVER['HTTP_X_VERISS_SIGNATURE'] ?? '')) {
  http_response_code(401); exit;
}
$event = json_decode($body, true);
if ($event['event'] === 'payment.completed') {
  markOrderPaid($event['data']['merchant_reference'], $event['data']); // idempotent
}
http_response_code(200);

{
  "event": "payment.completed",
  "data": {
    "reference": "VRS-1791795121727-448",
    "status": "success",
    "amount": 500000,
    "amount_charged": 530458,
    "merchant_reference": "ORDER-1001",
    "metadata": { "cartId": "c_123" },
    "...": "same fields as the verify API",
    "duplicate": false
  },
  "sentAt": "2026-10-12T08:52:02.010Z"
}