<?php
$apiBase = 'https://riskpaygo.com/portal/api/plugin';
$merchantId = 'TU_MERCHANT_ID';
$apiToken = 'TU_API_TOKEN';

$payload = [
    'merchant_order_id' => 'PED-1001',
    'order_id' => 1001,
    'order_key' => 'wc_order_abc123',
    'amount' => '149.99',
    'currency' => 'USD',
    'customer_name' => 'Nombre Cliente',
    'customer_email' => 'cliente@ejemplo.com',
    'site' => ['url' => 'https://tu-dominio.com/', 'name' => 'Mi tienda', 'platform' => 'custom'],
    'notify_url' => 'https://tu-dominio.com/wp-json/riskpaygo/v1/webhook',
    'return_url' => 'https://tu-dominio.com/pago/completado',
    'cancel_url' => 'https://tu-dominio.com/pago/cancelado',
];

$ch = curl_init($apiBase . '/payments/create');
curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER => true, CURLOPT_POST => true, CURLOPT_HTTPHEADER => ['Accept: application/json','Content-Type: application/json','Authorization: Bearer ' . $apiToken,'X-RPG-Merchant: ' . $merchantId], CURLOPT_POSTFIELDS => json_encode($payload, JSON_UNESCAPED_SLASHES), CURLOPT_TIMEOUT => 30]);
$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
$error = curl_error($ch);
curl_close($ch);
if ($error || $status >= 400) { throw new RuntimeException('Error creando pago: ' . ($error ?: $response)); }
$data = json_decode($response, true);
header('Location: ' . $data['data']['checkout_url']);
exit;

const apiBase = 'https://riskpaygo.com/portal/api/plugin';
const merchantId = 'TU_MERCHANT_ID';
const apiToken = 'TU_API_TOKEN';

const payload = {
  merchant_order_id: 'PED-1001', order_id: 1001, order_key: 'wc_order_abc123', amount: '149.99', currency: 'USD',
  customer_name: 'Nombre Cliente', customer_email: 'cliente@ejemplo.com',
  site: {url: 'https://tu-dominio.com/', name: 'Mi tienda', platform: 'custom'},
  notify_url: 'https://tu-dominio.com/wp-json/riskpaygo/v1/webhook', return_url: 'https://tu-dominio.com/pago/completado', cancel_url: 'https://tu-dominio.com/pago/cancelado'
};
const response = await fetch(`${apiBase}/payments/create`, {method: 'POST', headers: {'Accept':'application/json','Content-Type':'application/json','Authorization':`Bearer ${apiToken}`,'X-RPG-Merchant':merchantId}, body: JSON.stringify(payload)});
const data = await response.json();
if (!response.ok || !data.success) throw new Error(data.message || 'No se pudo crear el pago');
console.log(data.data.checkout_url);

import crypto from 'crypto';
const webhookSecret = 'TU_WEBHOOK_SECRET';
export async function riskpaygoWebhook(req, res) {
  const rawBody = req.rawBody;
  const signature = req.headers['x-rpg-signature'] || '';
  const expected = crypto.createHmac('sha256', webhookSecret).update(rawBody).digest('base64');
  if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature))) return res.status(401).send('invalid_signature');
  const event = JSON.parse(rawBody.toString('utf8'));
  if (event.status === 'paid') {
    // Marca tu pedido como pagado de forma idempotente.
  }
  return res.status(200).send('ok');
}