Documentación de Integración Andino Pay

// Ejemplo en PHP (cURL / Guzzle / Laravel Http)
$apiKey    = 'pk_live_xxxxxxxxxxxxxxxxxxxxxxxx';
$apiSecret = 'sec_live_yyyyyyyyyyyyyyyyyyyyyyyy';
$rawBody   = json_encode($payload);

$firma = 'sha256=' . hash_hmac('sha256', $rawBody, $apiSecret);

$response = Http::withHeaders([
    'Authorization' => 'Bearer ' . $apiKey,
    'X-Signature'   => $firma,
    'Content-Type'  => 'application/json',
])->post('https://api.andinopay.com/api/v1/transactions', $payload);

// Ejemplo en Node.js (Crypto + Fetch)
const crypto = require('crypto');

const apiKey = 'pk_live_xxxxxxxxxxxxxxxxxxxxxxxx';
const apiSecret = 'sec_live_yyyyyyyyyyyyyyyyyyyyyyyy';
const rawBody = JSON.stringify(payload);

const firma = 'sha256=' + crypto
  .createHmac('sha256', apiSecret)
  .update(rawBody)
  .digest('hex');

const res = await fetch('https://api.andinopay.com/api/v1/transactions', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${apiKey}`,
    'X-Signature': firma,
    'Content-Type': 'application/json',
  },
  body: rawBody,
});

# Ejemplo en Python (hashlib + hmac + requests)
import hmac, hashlib, json, requests

api_key = "pk_live_xxxxxxxxxxxxxxxxxxxxxxxx"
api_secret = "sec_live_yyyyyyyyyyyyyyyyyyyyyyyy"
raw_body = json.dumps(payload)

firma = "sha256=" + hmac.new(
    api_secret.encode("utf-8"),
    raw_body.encode("utf-8"),
    hashlib.sha256
).hexdigest()

headers = {
    "Authorization": f"Bearer {api_key}",
    "X-Signature": firma,
    "Content-Type": "application/json",
}
response = requests.post("https://api.andinopay.com/api/v1/transactions", data=raw_body, headers=headers)

curl -X POST https://api.andinopay.com/api/v1/checkout/sessions \
  -H "Authorization: Bearer pk_test_qyNu58wqSrIFeGYr0EiLwJBKFI8fZjwJ" \
  -H "Content-Type: application/json" \
  -d '{
    "monto": 250000,
    "moneda": "COP",
    "order_id": "ORDER-001",
    "descripcion": "Pago del pedido #ORDER-001",
    "redirect_url": "https://tu-tienda.com/orden/ORDER-001/resultado",
    "webhook_url": "https://tu-tienda.com/webhooks/pago",
    "metadata": {
      "customer_id": "USR-789"
    },
    "payer": {
      "nombre": "María",
      "apellido": "López",
      "email": "maria@ejemplo.com",
      "tipo_documento": "CC",
      "documento": "9876543210",
      "telefono": "3001234567"
    }
  }'

$response = Http::withToken('pk_test_qyNu58wqSrIFeGYr0EiLwJBKFI8fZjwJ')
  ->post('https://api.andinopay.com/api/v1/checkout/sessions', [
      'monto'        => 250000,
      'moneda'       => 'COP',
      'order_id'     => 'ORDER-001',
      'descripcion'  => 'Pago del pedido #ORDER-001',
      'redirect_url' => 'https://tu-tienda.com/orden/ORDER-001/resultado',
      'webhook_url'  => 'https://tu-tienda.com/webhooks/pago',
      'metadata'     => ['customer_id' => 'USR-789'],
  ]);

const res = await fetch('https://api.andinopay.com/api/v1/checkout/sessions', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer pk_test_qyNu58wqSrIFeGYr0EiLwJBKFI8fZjwJ',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    monto: 250000,
    moneda: 'COP',
    order_id: 'ORDER-001',
    redirect_url: 'https://tu-tienda.com/orden/ORDER-001/resultado',
    webhook_url: 'https://tu-tienda.com/webhooks/pago',
  }),
});

curl -X GET https://api.andinopay.com/api/v1/checkout/sessions/550e8400-e29b-41d4-a716-446655440000 \
  -H "Authorization: Bearer pk_test_qyNu58wqSrIFeGYr0EiLwJBKFI8fZjwJ"

$response = Http::withToken('pk_test_qyNu58wqSrIFeGYr0EiLwJBKFI8fZjwJ')
  ->get('https://api.andinopay.com/api/v1/checkout/sessions/550e8400-e29b-41d4-a716-446655440000');

const res = await fetch('https://api.andinopay.com/api/v1/checkout/sessions/550e8400-e29b-41d4-a716-446655440000', {
  headers: {
    'Authorization': 'Bearer pk_test_qyNu58wqSrIFeGYr0EiLwJBKFI8fZjwJ',
  },
});

curl -X POST https://api.andinopay.com/api/v1/transactions \
  -H "Authorization: Bearer pk_test_qyNu58wqSrIFeGYr0EiLwJBKFI8fZjwJ" \
  -H "Content-Type: application/json" \
  -d '{
    "monto": 150000,
    "moneda": "COP",
    "referencia_externa": "ORDER-2026-001",
    "descripcion": "Pago del pedido #ORDER-2026-001",
    "redirect_url": "https://tucomercio.com/gracias",
    "webhook_url": "https://tucomercio.com/webhooks/andinopay",
    "payer": {
      "nombre": "Juan",
      "apellido": "Pérez",
      "email": "juan@ejemplo.com",
      "tipo_documento": "CC",
      "documento": "1234567890",
      "telefono": "3001234567",
      "tipo_persona": "natural",
      "banco_pse": "1007"
    }
  }'

$response = Http::withToken('pk_test_qyNu58wqSrIFeGYr0EiLwJBKFI8fZjwJ')
  ->post('https://api.andinopay.com/api/v1/transactions', [
      'monto'              => 150000,
      'moneda'             => 'COP',
      'referencia_externa' => 'ORDER-2026-001',
      'descripcion'        => 'Pago del pedido #ORDER-2026-001',
      'redirect_url'       => 'https://tucomercio.com/gracias',
      'webhook_url'        => 'https://tucomercio.com/webhooks/andinopay',
      'payer' => [
          'nombre'         => 'Juan',
          'apellido'       => 'Pérez',
          'email'          => 'juan@ejemplo.com',
          'tipo_documento' => 'CC',
          'documento'      => '1234567890',
          'telefono'       => '3001234567',
          'tipo_persona'   => 'natural',
          'banco_pse'      => '1007',
      ]
  ]);

const res = await fetch('https://api.andinopay.com/api/v1/transactions', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer pk_test_qyNu58wqSrIFeGYr0EiLwJBKFI8fZjwJ',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    monto: 150000,
    moneda: 'COP',
    referencia_externa: 'ORDER-2026-001',
    descripcion: 'Pago del pedido #ORDER-2026-001',
    redirect_url: 'https://tucomercio.com/gracias',
    webhook_url: 'https://tucomercio.com/webhooks/andinopay',
    payer: {
      nombre: 'Juan',
      apellido: 'Pérez',
      email: 'juan@ejemplo.com',
      tipo_documento: 'CC',
      documento: '1234567890',
      telefono: '3001234567',
      tipo_persona: 'natural',
      banco_pse: '1007',
    }
  }),
});

// Validación en PHP puro o Laravel
$rawBody   = file_get_contents('php://input');
$recibida  = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';
$apiSecret = 'TU_API_SECRET';

$esperada = 'sha256=' . hash_hmac('sha256', $rawBody, $apiSecret);

if (! hash_equals($esperada, $recibida)) {
    http_response_code(401);
    exit('Firma del webhook inválida');
}

$payload = json_decode($rawBody, true);
// Procesar $payload['estado'] y actualizar tu base de datos
http_response_code(200);
echo 'OK';

// Validación en Node.js (Express con express.raw)
const crypto = require('crypto');

app.post('/webhooks/andinopay', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-webhook-signature'];
  const expected = 'sha256=' + crypto
    .createHmac('sha256', process.env.ANDINO_API_SECRET)
    .update(req.body)
    .digest('hex');

  if (signature !== expected) {
    return res.status(401).send('Invalid signature');
  }

  const event = JSON.parse(req.body.toString());
  console.log('Evento recibido:', event.estado);
  res.status(200).send('OK');
});