Get paid on bKash and Nagad. ▍On your own number.

curl -X POST "$KRONX_BASE_URL/api/v1/checkout/initialize" \
  -H "authorization: Bearer $KRONX_API_KEY" \
  -H "content-type: application/json" \
  -d '{
    "amount": "1450.00",
    "order_id": "ORD-1042",
    "webhook_url": "https://yourshop.example/webhooks/kronx",
    "metadata": { "cart": "8841" },
    "locale": "bn"
  }'

# 200 { checkout_url, session_id, payment_id, trid, expires_at }

import crypto from 'node:crypto';

// req.rawBody must be the exact bytes ToruPay sent.
export function handleKronxWebhook(req, res) {
  const expected = crypto
    .createHmac('sha256', process.env.KRONX_CALLBACK_SECRET)
    .update(req.rawBody)
    .digest('hex');

  const a = Buffer.from(expected, 'hex');
  const b = Buffer.from(req.headers['x-kronx-signature'] ?? '', 'hex');
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
    return res.status(401).end();
  }

  const event = JSON.parse(req.rawBody);
  // Deliveries are at-least-once: key your own work on the event id.
  applyOnce(req.headers['x-kronx-event-id'], event.order_id, event.trx_id);
  res.status(200).end();
}