curl -H "Authorization: Bearer sk_test_..." \
  https://recasmart.online/api/public/checkouts

curl -X POST "https://recasmart.online/api/public/checkout/create" \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 100.00,
    "currency": "BRL",
    "payment_method": "pix",
    "description": "Venda Teste PIX"
  }'

Alias: recasmart.pago.x82
CVU: 00000031000... (Variable)

curl -X POST "https://recasmart.online/api/public/pos/POS_ID/checkout" \
  -H "Authorization: Bearer sk_test_DEVICE_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 12000,
    "currency": "PYG",
    "description": "Coca-Cola 500ml",
    "expires_in_seconds": 300
  }'

curl -X POST "https://recasmart.online/api/public/invoices/bulk" \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  -d '[
      {
        "amount": 15000.00,
        "first_due_date": "2026-04-10T23:59:59Z",
        "currency": "ARS"
      }
  ]'

import { RecaSmart } from "@recasmart/sdk";

const reca = new RecaSmart(); // lee RECASMART_API_KEY

// Idempotency-Key manejada nativamente por el SDK
const checkout = await reca.checkouts.create({
  amount: 5000,
  currency: "ARS",
  description: "Servicios Digitales",
  external_reference: "ORDER-12345",
});

console.log(checkout.payment_url);

<!-- 1. Agrega el script en tu <head> -->
<script src="https://recasmart.online/sdk/js/magic.js"></script>

<!-- 2. Abre el checkout cuando el cliente haga clic en Pagar -->
<script>
  window.RecaSmart.openCheckout({
    checkoutId: "14b1abb3-1458-...", // ID generado en tu backend
    onSuccess: (data) => {
      console.log("¡Pago exitoso!", data);
      window.location.href = "/gracias";
    },
    onClose: () => {
      console.log("El cliente cerró el modal");
    }
  });
</script>

curl "https://recasmart.online/api/public/transactions?start_date=2026-01-01&end_date=2026-02-01" \
  -H "Authorization: Bearer sk_live_..."

curl "https://recasmart.online/api/public/settlements" \
  -H "Authorization: Bearer sk_live_..."

1. Plugin ZIP: recasmart-woo.zip
2. Admin → Plugins → Añadir nuevo
3. Webhook: ?wc-api=recasmart

curl -X POST "https://recasmart.online/api/public/subscriptions/plans" \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Plan Mensual Pro",
    "amount": 5000,
    "currency": "ARS",
    "interval_unit": "month",
    "interval_count": 1,
    "grace_period_days": 3
  }'

curl -X POST "https://recasmart.online/api/public/checkout/create" \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 10000,
    "currency": "ARS",
    "description": "Compra en marketplace",
    "splits": [
      {
        "destination": "cvu-o-alias-vendedor",
        "percentage": 90,
        "description": "Pago al vendedor"
      },
      {
        "destination": "cvu-o-alias-plataforma",
        "percentage": 10,
        "description": "Comisión plataforma"
      }
    ]
  }'

import { constructEvent } from "@recasmart/sdk";
import express from "express";

const app = express();

// ¡OJO! raw body: la firma se calcula sobre los bytes exactos
app.post("/webhook", express.raw({ type: "application/json" }), async (req, res) => {
  try {
    // Valida X-RecaSmart-Signature + ventana anti-replay.
    // Lanza WebhookSignatureError si alguien falsifica la firma.
    const event = await constructEvent(
      req.body.toString("utf8"), // raw body, no parseado
      req.headers,
      process.env.RECASMART_WEBHOOK_SECRET // whsec_... del dashboard
    );

    if (event.type === "checkout.completed") {
      console.log("Cobro Completado:", event.data.checkout_id);
    }

    res.json({ received: true });
  } catch (err) {
    res.status(400).send(`Webhook Error: ${err.message}`);
  }
});

{
  "type": "checkout.completed",
  "data": {
    "checkout_id": "14b1abb3-1458-4f3d-8740-83e457a4596e",
    "transaction_id": "a3f8c2d1-9b7e-4f3a-bc21-5d8e1f2a9c4b",
    "status": "COMPLETED",
    "amount": 5000,
    "currency": "ARS",
    "external_reference": "ORDER-12345",
    "paid_at": "2026-02-19T12:00:00Z"
  },
  "timestamp": "2026-02-19T12:00:01Z"
}

const crypto = require("crypto");

function verifyWebhook(req, webhookSecret) {
  const signature = req.headers["x-recasmart-signature"];
  const timestamp = req.headers["x-recasmart-timestamp"];
  const body = JSON.stringify(req.body);

  // 1. Verificar que el timestamp no sea viejo (5 min)
  const age = Math.floor(Date.now() / 1000) - parseInt(timestamp);
  if (age > 300) return false;

  // 2. Calcular firma esperada
  const signedPayload = `${timestamp}.${body}`;
  const expected = crypto
    .createHmac("sha256", webhookSecret)
    .update(signedPayload)
    .digest("hex");

  // 3. Comparar
  const received = signature.replace("sha256=", "");
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(received)
  );
}

curl -X POST "https://recasmart.online/api/public/checkout/create" \
  -H "Authorization: Bearer sk_live_..." \
  -H "Idempotency-Key: idm_8f29c1b3d..." \
  -H "Content-Type: application/json" \
  -d '{"amount": 5000, "currency": "ARS"}'

import { useCheckoutStatus } from "./recasmart/sdk";

function StatusPantalla({ checkoutId }) {
  const { status, isPaid, isLoading } = useCheckoutStatus(
    "TU_SUPABASE_URL",
    "TU_SUPABASE_ANON_KEY",
    checkoutId
  );

  if (isLoading) return <p>Cargando websocket...</p>;

  if (isPaid) {
    return <p>✅ ¡Pago Completado al instante!</p>;
  }

  return <p>⏳ Esperando que escanees el QR...</p>;
}