inPAY Node.js SDK

Official Node.js / TypeScript SDK for the inPAY payment platform (Uzbekistan). One inPAY contract → accept Click, Payme, UzCard/HUMO with a few lines of code.

Bitta inPAY shartnomasi bilan barcha to'lov usullarini qabul qiling.

O'rnatish / Installation

npm install inpay-js

Talab: Node.js ≥ 18 (global fetch + crypto). Tashqi bog'liqliksiz. TypeScript tayyor (.d.ts ichida).

Tez boshlash / Quick start

import { InPay } from 'inpay-js';

const inpay = new InPay({
  merchantId: 12345,          // kassa merchant_id
  bearerToken: 'xxxxxxxx',    // kassa bearer token
  webhookSecret: 'yyyyyyyy',  // webhook imzosi uchun
});

// 1) To'lov yaratish
const invoice = await inpay.create({
  amount: 50000,                       // so'm (min 1000)
  callbackUrl: 'https://shop.uz/inpay/webhook',
  orderId: 'A-123',                    // sizning ichki reference
});

res.redirect(invoice.payUrl);          // foydalanuvchini yo'naltiring

invoice:

| Xususiyat | Izoh | |---|---| | invoice.orderId | inPAY buyurtma ID (16 hex) | | invoice.payUrl | Universal checkout sahifasi | | invoice.payUrlLink | So'ralgan usulga mos to'g'ridan havola | | invoice.payLinks | { click, payme } to'g'ridan havolalar |

CommonJS

const { InPay } = require('inpay-js');

2) Holatni tekshirish / Status

const tx = await inpay.status('a1b2c3d4e5f6a7b8');
if (tx.isPaid) {
  // ...
}
// tx.status: 'pending' | 'success' | 'failed'

3) Webhook (payment.success)

inPAY to'lov muvaffaqiyatli bo'lganda callbackUrl'ingizga POST yuboradi va uni X-InPAY-Signature (HMAC-SHA256) bilan imzolaydi. SDK imzoni constant-time tekshiradi.

Express misoli (xom tanani oling — express.raw):

import express from 'express';
import { InPay, SignatureError } from 'inpay-js';

const app = express();
const inpay = new InPay({ merchantId: 12345, bearerToken: 'xxx', webhookSecret: 'yyy' });

app.post('/inpay/webhook', express.raw({ type: '*/*' }), (req, res) => {
  const sig = req.header('X-InPAY-Signature') ?? '';
  try {
    const tx = inpay.webhook().verify(req.body.toString('utf8'), sig);
    if (tx.isPaid) {
      // ⚠️ IDEMPOTENT bo'ling — takror kelishi mumkin
      // if (alreadyPaid(tx.orderId)) return res.json({ ok: true });
      // markPaid(tx.orderId, tx.amount);
    }
    res.json({ ok: true });
  } catch (e) {
    if (e instanceof SignatureError) return res.status(401).json({ ok: false });
    res.status(400).json({ ok: false });
  }
});

Xavfsizlik: imzo tekshiruvidan o'tmagan webhook'ni HECH QACHON to'lov deb qabul qilmang.

Xatolar / Errors

import { ApiError, SignatureError, InPayError } from 'inpay-js';

try {
  await inpay.create({ amount: 50000 });
} catch (e) {
  if (e instanceof ApiError) console.log(e.errorCode); // "MERCHANT_INACTIVE", ...
}

Litsenziya

MIT © inPAY