RedotPay payment method (first-party)

This folder contains the RedotPay payment method implementation. For integration, use the first-party SDK package @redotpay/mpp.

Scope

This package mirrors the mppx/stripe structure and provides a first-pass redotpay/charge method for both client and server usage.

Package layout

• src/Methods.ts: shared method schema
• src/client: client-side credential creation
• src/server: server-side verification

Example

import { Mppx, charge } from '@redotpay/mpp/server'

const consumed = new Set<string>()

const mppx = Mppx.create({
  methods: [
    charge({
      consumeReference: async ({ reference }) => {
        if (consumed.has(reference)) return false
        consumed.add(reference)
        return true
      },
      verifyBalance: async ({ rdt }) => {
        return Boolean(rdt)
      },
      verifyCrypto: async ({ hash }) => {
        return Boolean(hash)
      },
    }),
  ],
  realm: process.env.MPP_REALM,
  secretKey: process.env.MPP_SECRET_KEY!,
})

Server verification requirements

This method is fail-closed. Server must provide:

• consumeReference(...) for replay protection
• verifyBalance(...) for payload.type="balance"
• verifyCrypto(...) for payload.type="crypto"

OpenAPI signing

createRedotPayOpenApiHeaders implements RedotPay Connect OpenAPI request signing (SHA256withRSA) and produces:

• X-R-AK
• X-R-TS (milliseconds)
• X-R-KEY-VERSION
• X-R-Signature (base64 signature, URL-encoded)

The default stringToSign format is:

{HTTP_METHOD} {PATH}\n{appKey}.{timestampMs}.{requestBodyJson}

To customize, provide auth.buildStringToSign.

Docs

• charge.md: End-to-end usage guide for the RedotPay charge intent (server + client + parameters)
• overview.md: High-level overview of the RedotPay payment method and intent mapping