Introduction

import time
import json
import hmac
import hashlib
import secrets
import sys
from urllib.parse import urljoin

import requests
import os

BASE_URL   = 'https://api.frillpay.com/'
PATH       = '/v1/deposit/fp-payment.php'
API_KEY    = 'YOUR_API_KEY_HERE'
SECRET_HEX = 'YOUR_SECRET_HEX_HERE'
WANT_JSON  = True
TIMEOUT_S  = 20

BASE_URL   = os.getenv('FP_BASE_URL', BASE_URL)
PATH       = os.getenv('FP_PATH', PATH)
API_KEY    = os.getenv('FP_API_KEY', API_KEY)
SECRET_HEX = os.getenv('FP_SECRET_HEX', SECRET_HEX)

# ---- Request body ----
reqId    = '45613'
amount   = 10
currency = 'USD'
email    = 'john@example.com'

body_dict = {
    'requestedId': reqId,
    'amount': amount,
    'currency': currency,
    'email': email,
}
body = json.dumps(body_dict, separators=(',', ':'), ensure_ascii=False)

qs = 'return=json' if WANT_JSON else ''

ts = int(time.time())
nonce = secrets.token_hex(12)
body_hash = hashlib.sha256(body.encode('utf-8')).hexdigest()

canonical = (
    'POST' + '\n' +
    PATH + '\n' +
    qs + '\n' +
    body_hash + '\n' +
    str(ts) + '\n' +
    nonce
)

try:
    secret_bytes = bytes.fromhex(SECRET_HEX)
except ValueError:
    print('Gateway error: SECRET_HEX is not valid hex', file=sys.stderr)
    sys.exit(2)

fp_sig = hmac.new(secret_bytes, canonical.encode('utf-8'), hashlib.sha256).hexdigest()

url = urljoin(BASE_URL.rstrip('/') + '/', PATH.lstrip('/'))
if qs:
    url = f"{url}?{qs}"

headers = {
    'Content-Type': 'application/json',
    'FP-Key': API_KEY,
    'FP-Ts': str(ts),
    'FP-Nonce': nonce,
    'FP-Sig': fp_sig,
}

try:
    resp = requests.post(
        url,
        data=body.encode('utf-8'),
        headers=headers,
        timeout=TIMEOUT_S,
        allow_redirects=False,
    )
except requests.RequestException as e:
    print(f"Gateway error: {e}", file=sys.stderr)
    sys.exit(502)

code = resp.status_code
resp_headers = resp.headers
resp_text = resp.text

if 200 <= code < 300:
    try:
        data = resp.json()
    except ValueError:
        print(resp_text)
        sys.exit(502)

    hosted_url = (data or {}).get('hosted_url', '')
    if not hosted_url:
        print(resp_text)
        sys.exit(502)

    print(data)
    sys.exit(0)

if 300 <= code < 400:
    location = resp_headers.get('Location', '').strip()
    if not location:
        print('Empty Location', file=sys.stderr)
        sys.exit(502)
    print(location)
    sys.exit(0)

print(resp_text)
sys.exit(code if code else 1)

import { createHash, createHmac, randomBytes } from "node:crypto";
import { fileURLToPath } from "node:url";
import path from "node:path";
import { exit } from "node:process";

const BASE_URL   = "https://api.frillpay.com";        
const PATH       = "/v1/deposit/fp-payment.php";
const API_KEY    = "YOUR_API_KEY_HERE";
const SECRET_HEX = "YOUR_SECRET_HEX_HERE";            
const WANT_JSON  = true;
const TIMEOUT_MS = 20000;

const bodyObj = {
  requestedId: "45613",
  amount: 10,
  currency: "USD",
  email: "john@example.com",
};
function buildSignature({ path, qs, body, ts, nonce, secretHex }) {
  const bodyHash = createHash("sha256").update(body).digest("hex");
  const canonical = `POST\n${path.toLowerCase()}\n${qs}\n${bodyHash}\n${ts}\n${nonce}`;
  const key = Buffer.from(secretHex, "hex");
  const fpSig = createHmac("sha256", key).update(canonical).digest("hex");
  return { bodyHash, canonical, fpSig };
}

async function createPayment() {
  const body = JSON.stringify(bodyObj);
  const qs = WANT_JSON ? "return=json" : "";
  const ts = Math.floor(Date.now() / 1000);
  const nonce = randomBytes(12).toString("hex");

  const { fpSig } = buildSignature({ path: PATH, qs, body, ts, nonce, secretHex: SECRET_HEX });

  const url = `${BASE_URL.replace(/\/$/, "")}${PATH}${qs ? `?${qs}` : ""}`;
  const headers = {
    "Content-Type": "application/json",
    "FP-Key": API_KEY,
    "FP-Ts": String(ts),
    "FP-Nonce": nonce,
    "FP-Sig": fpSig,
  };

  const ctrl = new AbortController();
  const timer = setTimeout(() => ctrl.abort(), TIMEOUT_MS);

  try {
    const res = await fetch(url, { method: "POST", body, headers, redirect: "manual", signal: ctrl.signal });
    clearTimeout(timer);

    const code = res.status;
    const text = await res.text();

    if (code >= 200 && code < 300) {
      let data;
      try { data = JSON.parse(text); } catch {
        return { ok: false, code: 502, error: "Invalid JSON from gateway", raw: text };
      }
      const hosted = (data || {}).hosted_url || "";
      if (!hosted) {
        return { ok: false, code: 502, error: "Missing hosted_url", raw: text };
      }
      return { ok: true, code, hosted_url: hosted };
    }

    if (code >= 300 && code < 400) {
      const loc = (res.headers.get("location") || "").trim();
      if (!loc) return { ok: false, code: 502, error: "Empty Location" };
      return { ok: true, code, location: loc };
    }

    return { ok: false, code: code || 1, raw: text };

  } catch (e) {
    const msg = e?.name === "AbortError" ? "Gateway timeout" : (e?.message || String(e));
    return { ok: false, code: 502, error: `Gateway error: ${msg}` };
  }
}

const __filename = fileURLToPath(import.meta.url);
const isMain = process.argv[1] && path.resolve(process.argv[1]) === __filename;

if (isMain) {
  const out = await createPayment();
  if (out.ok) {
    // console.log(out.hosted_url || out.location);
    console.log(out);
    process.exit(0);
  } else {
    console.error(out.error || out.raw || "Unknown error");
    process.exit(out.code || 1);
  }
}

import 'dart:convert' show utf8, jsonEncode, jsonDecode, JsonEncoder;
import 'dart:math' show Random;
import 'package:http/http.dart' as http;
import 'package:crypto/crypto.dart' show sha256, Hmac, Digest;

class FrillPayClient {
  final String baseUrl;
  final String path;
  final String apiKey;
  final String secretHex;
  final bool wantJson;
  final Duration timeout;

  const FrillPayClient({
    required this.baseUrl,
    required this.path,
    required this.apiKey,
    required this.secretHex,
    this.wantJson = true,
    this.timeout = const Duration(seconds: 20),
  });

  Future<Map<String, dynamic>> createPaymentJson({
    required String requestedId,
    required num amount,
    required String currency,
    required String email,
  }) async {
    final bodyObj = <String, dynamic>{
      'requestedId': requestedId,
      'amount': amount,
      'currency': currency,
      'email': email,
    };
    final body = jsonEncode(bodyObj);
    final qs = wantJson ? 'return=json' : '';
    final ts = (DateTime.now().millisecondsSinceEpoch ~/ 1000).toString();
    final nonce = _randomHex(12);

    final sig = _buildSignature(
      path: path,
      qs: qs,
      body: body,
      ts: ts,
      nonce: nonce,
      secretHex: secretHex,
    );

    final url = '${baseUrl.replaceAll(RegExp(r'\/$'), '')}$path${qs.isNotEmpty ? '?$qs' : ''}';
    final headers = <String, String>{
      'Content-Type': 'application/json',
      'FP-Key': apiKey,
      'FP-Ts': ts,
      'FP-Nonce': nonce,
      'FP-Sig': sig,
    };

    try {
      final resp = await http
          .post(Uri.parse(url), headers: headers, body: body)
          .timeout(timeout);

      final code = resp.statusCode;
      final text = resp.body;

      if (resp.isRedirect || (code >= 300 && code < 400)) {
        final loc = resp.headers['location']?.trim();
        if (loc == null || loc.isEmpty) {
          return {"ok": false, "code": 502, "error": "Empty Location"};
        }
        return {"ok": true, "code": code, "location": loc};
      }

      if (code >= 200 && code < 300) {
        try {
          final data = jsonDecode(text) as Map<String, dynamic>;
          final hosted = (data['hosted_url'] ?? '').toString();
          if (hosted.isEmpty) {
            return {"ok": false, "code": 502, "error": "Missing hosted_url", "raw": text};
          }
          return {"ok": true, "code": code, "hosted_url": hosted, ...data};
        } catch (_) {
          return {"ok": false, "code": 502, "error": "Invalid JSON from gateway", "raw": text};
        }
      }

      return {"ok": false, "code": code == 0 ? 1 : code, "error": "Gateway error", "raw": text};
    } catch (e) {
      return {"ok": false, "code": 502, "error": "Gateway error: $e"};
    }
  }

  // ----- helpers -----
  static String _randomHex(int bytesLen) {
    final r = Random.secure();
    final b = List<int>.generate(bytesLen, (_) => r.nextInt(256));
    return _toHex(b);
  }

  static String _toHex(List<int> bytes) =>
      bytes.map((b) => b.toRadixString(16).padLeft(2, '0')).join();

  static List<int> _hexToBytes(String hex) {
    final h = hex.toLowerCase();
    if (h.length.isOdd) {
      throw ArgumentError('SECRET_HEX must have even length');
    }
    final out = <int>[];
    for (int i = 0; i < h.length; i += 2) {
      out.add(int.parse(h.substring(i, i + 2), radix: 16));
    }
    return out;
  }

  static String _buildSignature({
    required String path,
    required String qs,
    required String body,
    required String ts,
    required String nonce,
    required String secretHex,
  }) {
    final bodyHash = sha256.convert(utf8.encode(body)).toString();
    final canonical = [
      'POST',
      path.toLowerCase(),
      qs,
      bodyHash,
      ts,
      nonce,
    ].join('\n');

    final key = _hexToBytes(secretHex);
    final hmac = Hmac(sha256, key);
    final Digest sig = hmac.convert(utf8.encode(canonical));
    return sig.toString();
  }
}

Future<void> main() async {
  const baseUrl   = 'https://api.frillpay.com';
  const path      = '/v1/deposit/fp-payment.php';
  const apiKey    = 'z5wsovLk95Wv4PcXlu0YvUBefuQzb5y3';
  const secretHex = 'ecad8e4a7355ecbc34949adecb06118c0538326bd14404883fe3ef0f04150a4f';

  final client = FrillPayClient(
    baseUrl: baseUrl,
    path: path,
    apiKey: apiKey,
    secretHex: secretHex,
    wantJson: true,
  );

  final out = await client.createPaymentJson(
    requestedId: '45613',
    amount: 10,
    currency: 'USD',
    email: 'john@example.com',
  );

  print(const JsonEncoder.withIndent('  ').convert(out));
}