Direct-QR API

{
  "amount": 10000,
  "currency": "NPR",
  "customer": {
    "name": "Ram Sharma",
    "email": "ram@example.com",
    "phone": "9800000000",
    "address": { "line1": "Thamel-12", "city": "Kathmandu" }
  },
  "metadata": { "order_id": "ORD-123" }
}

{
  "id": "cs_vOKk570ctWssNmFPcFiGfCnM",
  "amount": 10000,
  "currency": "NPR",
  "provider": "fonepay",
  "status": "initiated",
  "qr_message": "00020101021226580011fonepay.com...",
  "qr_image": "data:image/png;base64,iVBORw0KGgo...",
  "events_url": "https://api.paybridgenp.com/v1/qr/cs_vOKk.../events",
  "expires_at": "2026-04-25T00:25:05.347Z"
}

curl -X POST https://api.paybridgenp.com/v1/qr/cs_01j9x2k3m4n5p6q7r8s9t0u1v2/refresh \
  -H "Authorization: Bearer sk_live_your_key"

<form id="checkout-form">
  <input name="name" placeholder="Full name" required />
  <input name="email" type="email" required />
  <input name="phone" placeholder="98XXXXXXXX" />
  <button type="submit">Pay Rs 100</button>
</form>

<div id="qr-panel" hidden>
  <img id="qr-img" />
  <p id="status">Waiting for scan…</p>
</div>

<script>
const form = document.getElementById("checkout-form");
form.addEventListener("submit", async (e) => {
  e.preventDefault();
  const fd = new FormData(form);

  // Call YOUR server, not PayBridgeNP directly - the API key must stay private
  const res = await fetch("/api/start-payment", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({
      amount: 10000,                       // Rs 100 in paisa
      customer: {
        name: fd.get("name"),
        email: fd.get("email"),
        phone: fd.get("phone"),
      },
    }),
  });
  const data = await res.json();

  document.getElementById("qr-img").src = data.qr_image;
  document.getElementById("qr-panel").hidden = false;

  const es = new EventSource(data.events_url);
  es.addEventListener("qr.scanned", () => {
    document.getElementById("status").textContent = "Scanned - confirm in your bank app";
  });
  es.addEventListener("qr.paid", (ev) => {
    document.getElementById("status").textContent = "Paid!";
    es.close();
    window.location.href = "/thank-you?p=" + JSON.parse(ev.data).paymentId;
  });
  es.addEventListener("qr.expired", () => {
    // Not terminal: a late payment can still confirm, so DON'T close the stream
    // here - qr.paid may still fire. Show a fresh QR for the best scan
    // experience, but your server's webhook is the source of truth either way.
    document.getElementById("status").textContent =
      "QR expired - tap to get a fresh one. If you already paid, hold on…";
  });
});
</script>

// /api/start-payment
import { Hono } from "hono";
const app = new Hono();

app.post("/api/start-payment", async (c) => {
  const body = await c.req.json();
  const r = await fetch("https://api.paybridgenp.com/v1/qr/fonepay", {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${process.env.PAYBRIDGENP_SECRET_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify(body),
  });
  return c.json(await r.json(), r.status);
});

curl -X POST https://api.paybridgenp.com/v1/billing/invoices/{id}/qr \
  -H "Authorization: Bearer sk_live_your_key"