Bắt đầu nhanh

curl https://app.bankopenapi.com/api/v1/account \
  -H "Authorization: Bearer $BANKOPENAPI_API_KEY"

const res = await fetch("https://app.bankopenapi.com/api/v1/account", {
  headers: {
    Authorization: `Bearer ${process.env.BANKOPENAPI_API_KEY}`,
  },
});
const data = await res.json();
if (!res.ok) throw new Error(`${data.error.code}: ${data.error.message}`);
console.log(data);

<?php
$ch = curl_init('https://app.bankopenapi.com/api/v1/account');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('BANKOPENAPI_API_KEY'),
    ],
]);
$data = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($status >= 400) {
    throw new Exception($data['error']['code'] . ': ' . $data['error']['message']);
}
print_r($data);

import os
import requests

res = requests.get(
    "https://app.bankopenapi.com/api/v1/account",
    headers={"Authorization": f"Bearer {os.environ['BANKOPENAPI_API_KEY']}"},
    timeout=15,
)
data = res.json()
if not res.ok:
    raise RuntimeError(f"{data['error']['code']}: {data['error']['message']}")
print(data)

curl -X POST https://app.bankopenapi.com/api/v1/payment-requests \
  -H "Authorization: Bearer $BANKOPENAPI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 150000,
    "orderId": "DH1028",
    "description": "Đơn hàng DH1028"
  }'

const res = await fetch("https://app.bankopenapi.com/api/v1/payment-requests", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.BANKOPENAPI_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    amount: 150000,
    orderId: "DH1028",
    description: "Đơn hàng DH1028",
  }),
});
const data = await res.json();
if (!res.ok) throw new Error(`${data.error.code}: ${data.error.message}`);
console.log(data);

<?php
$ch = curl_init('https://app.bankopenapi.com/api/v1/payment-requests');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('BANKOPENAPI_API_KEY'),
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'amount' => 150000,
        'orderId' => 'DH1028',
        'description' => 'Đơn hàng DH1028',
    ]),
]);
$data = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($status >= 400) {
    throw new Exception($data['error']['code'] . ': ' . $data['error']['message']);
}
print_r($data);

import os
import requests

res = requests.post(
    "https://app.bankopenapi.com/api/v1/payment-requests",
    headers={"Authorization": f"Bearer {os.environ['BANKOPENAPI_API_KEY']}"},
    json={
        "amount": 150000,
        "orderId": "DH1028",
        "description": "Đơn hàng DH1028",
    },
    timeout=15,
)
data = res.json()
if not res.ok:
    raise RuntimeError(f"{data['error']['code']}: {data['error']['message']}")
print(data)

import express from "express";
import { Webhook } from "standardwebhooks";

const app = express();
// Signing secret của endpoint (dạng "whsec_..."), lấy ở trang Webhook trong app
const wh = new Webhook(process.env.BANKOPENAPI_WEBHOOK_SECRET);

// express.raw giữ nguyên body thô: verify phải chạy trên đúng chuỗi BankOpenAPI đã ký
app.post("/webhooks/bankopenapi", express.raw({ type: "application/json" }), async (req, res) => {
  let event;
  try {
    event = wh.verify(req.body, req.headers);
  } catch {
    return res.status(400).send("Invalid signature");
  }

  // Chống xử lý trùng: một sự kiện giữ nguyên event.id qua mọi lần retry
  if (await alreadyProcessed(event.id)) return res.sendStatus(200);

  if (event.type === "payment_request.paid") {
    await markOrderPaid(event.data.orderId, event.data);
  }

  await markProcessed(event.id);
  res.sendStatus(200);
});

app.listen(3000);

<?php
// composer require standard-webhooks/standard-webhooks  (PHP 8+)
require __DIR__ . '/vendor/autoload.php';

use StandardWebhooks\Webhook;
use StandardWebhooks\Exception\WebhookVerificationException;

$payload = file_get_contents('php://input');
// Thư viện đọc header bằng tên chữ thường: webhook-id, webhook-timestamp, webhook-signature
$headers = array_change_key_case(getallheaders(), CASE_LOWER);

try {
    $wh = new Webhook(getenv('BANKOPENAPI_WEBHOOK_SECRET'));
    $event = $wh->verify($payload, $headers);
} catch (WebhookVerificationException $e) {
    http_response_code(400);
    exit('Invalid signature');
}

// Chống xử lý trùng: một sự kiện giữ nguyên id qua mọi lần retry
if (alreadyProcessed($event['id'])) {
    http_response_code(200);
    exit;
}

if ($event['type'] === 'payment_request.paid') {
    markOrderPaid($event['data']['orderId'], $event['data']);
}

markProcessed($event['id']);
http_response_code(200);

import os
from flask import Flask, request
from standardwebhooks import Webhook, WebhookVerificationError

app = Flask(__name__)
# Signing secret của endpoint (dạng "whsec_..."), lấy ở trang Webhook trong app
wh = Webhook(os.environ["BANKOPENAPI_WEBHOOK_SECRET"])


@app.post("/webhooks/bankopenapi")
def bankopenapi_webhook():
    try:
        # get_data() trả body thô (bytes), đúng chuỗi BankOpenAPI đã ký
        event = wh.verify(request.get_data(), dict(request.headers))
    except WebhookVerificationError:
        return "Invalid signature", 400

    # Chống xử lý trùng: một sự kiện giữ nguyên id qua mọi lần retry
    if already_processed(event["id"]):
        return "", 200

    if event["type"] == "payment_request.paid":
        mark_order_paid(event["data"]["orderId"], event["data"])

    mark_processed(event["id"])
    return "", 200