curl -X POST https://api.pay.zkp2p.xyz/api/merchants \
  -H "Content-Type: application/json" \
  -d '{"name": "My AI Agent"}'

{
  "success": true,
  "responseObject": {
    "merchant": {
      "id": "merchant_abc123",
      "name": "My AI Agent",
      "walletAddress": "0x..."
    },
    "apiKey": "sk_live_xxxxx"
  }
}

curl -X POST https://api.pay.zkp2p.xyz/v1/merchant/webhooks \
  -H "Content-Type: application/json" \
  -H "x-api-key: sk_live_xxxxx" \
  -d '{"url": "https://your-agent.example.com/webhooks/zkp2p"}'

const API_BASE = 'https://api.pay.zkp2p.xyz';

const response = await fetch(`${API_BASE}/v1/checkout/session`, {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'x-api-key': process.env.ZKP2P_PAY_API_KEY!,
  },
  body: JSON.stringify({
    merchantId: 'your_merchant_id',
    checkoutMode: 'exact-fiat',
    fiatAmount: '25.00',
    fiatCurrency: 'USD',
    destinationChainId: 8453,
    destinationToken: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913',
    recipientAddress: AGENT_WALLET,
    metadata: { serviceId: 'task_123' },
  }),
});

const session = await response.json();

// session.checkoutUrl   -- send this to the payer
// session.orderId       -- use for tracking
// session.expiresAt     -- session expiration timestamp

const response = await fetch(`${API_BASE}/v1/checkout/session`, {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'x-api-key': process.env.ZKP2P_PAY_API_KEY!,
  },
  body: JSON.stringify({
    merchantId: 'your_merchant_id',
    checkoutMode: 'exact-token',
    amountUsdc: '25.00',
    destinationChainId: 8453,
    destinationToken: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913',
    recipientAddress: AGENT_WALLET,
    metadata: { serviceId: 'task_123' },
  }),
});

import express from 'express';
import crypto from 'crypto';

const app = express();
app.use(express.json());

app.post('/webhooks/zkp2p', (req, res) => {
  const signature = req.headers['x-zkp2p-signature'] as string;
  const timestamp = req.headers['x-zkp2p-timestamp'] as string;
  const body = JSON.stringify(req.body);

  // Verify signature
  if (!verifyWebhookSignature(body, signature, timestamp, WEBHOOK_SECRET)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  const { event, data } = req.body;

  switch (event) {
    case 'order.fulfilled':
      console.log(`Payment settled: ${data.orderId}`);
      console.log(`Amount: ${data.amountUsdc} USDC`);
      console.log(`Tx hash: ${data.transactionHash}`);
      // Deliver the service or product
      break;

    case 'order.payment_failed':
      console.log(`Payment failed: ${data.orderId}`);
      // Notify payer, offer retry
      break;

    case 'order.expired':
      console.log(`Session expired: ${data.orderId}`);
      // Clean up, optionally create new session
      break;

    default:
      console.log(`Event: ${event}`, data);
  }

  res.status(200).json({ received: true });
});

function verifyWebhookSignature(
  body: string,
  signature: string,
  timestamp: string,
  secret: string
): boolean {
  const payload = `${timestamp}.${body}`;
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  );
}

const statusResponse = await fetch(
  `${API_BASE}/v1/checkout/session/${session.orderId}`,
  {
    headers: { 'x-api-key': process.env.ZKP2P_PAY_API_KEY! },
  },
);

const status = await statusResponse.json();

// status.state -- current order state
// status.transactionHash -- on-chain tx hash (when fulfilled)
// status.amountUsdc -- settled USDC amount

created -> payment_started -> payment_completed -> proof_generated -> proof_submitted -> fulfilled
                  |
                  +-> payment_failed
                  +-> expired

# Get available presets (public, no auth)
curl https://api.pay.zkp2p.xyz/api/checkout/theme-presets

# Set a preset (requires Privy auth)
curl -X PUT https://api.pay.zkp2p.xyz/api/merchants/me/checkout-theme \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <privy_token>" \
  -d '{"presetName": "dark"}'

# Set custom colors (requires Privy auth)
curl -X PUT https://api.pay.zkp2p.xyz/api/merchants/me/checkout-theme \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <privy_token>" \
  -d '{
    "presetName": "custom",
    "pageBackgroundColor": "#0f0f0f",
    "panelBackgroundColor": "#1a1a1a",
    "panelTextColor": "#ffffff",
    "panelTextMutedColor": "#a0a0a0",
    "panelAccentColor": "#3b82f6",
    "panelBorderColor": "#2a2a2a",
    "buttonBackgroundColor": "#3b82f6",
    "buttonTextColor": "#ffffff"
  }'