Laravel

'valora' => [
    'key' => env('VALORA_API_KEY'),
    'webhook_secret' => env('VALORA_WEBHOOK_SECRET'),
    'product_id' => env('VALORA_PRODUCT_ID'),
],

<?php

namespace App\Services;

use Illuminate\Http\Client\PendingRequest;
use Illuminate\Support\Facades\Http;

class Valora
{
    private function client(): PendingRequest
    {
        return Http::baseUrl('https://api.valorapayments.com.br')
            ->withToken(config('services.valora.key'))
            ->acceptJson()
            ->timeout(20);
    }

    public function createCheckout(array $payload): array
    {
        return $this->client()->post('/v1/checkouts', $payload)->throw()->json();
    }

    public function createPix(string $amount, string $reference): array
    {
        return $this->client()
            ->withHeaders(['Idempotency-Key' => $reference])
            ->post('/v1/payments', [
                'method' => 'pix',
                'amount' => $amount, // em reais, ex.: "149.90"
                'external_reference' => $reference,
            ])
            ->throw()
            ->json();
    }
}

<?php

namespace App\Http\Controllers;

use App\Services\Valora;
use Illuminate\Http\Request;
use Illuminate\Support\Str;

class CheckoutController extends Controller
{
    public function store(Request $request, Valora $valora)
    {
        $orderId = (string) Str::uuid();
        // Grave o pedido como "pendente" aqui.

        $payload = [
            'product_cart' => [['product_id' => config('services.valora.product_id'), 'quantity' => 1]],
            'success_url' => url("/pedido/{$orderId}"),
            'cancel_url' => url('/'),
            'external_reference' => $orderId,
        ];
        // Campos de cliente não aceitam null: envie só o que existir.
        if ($email = $request->user()?->email) {
            $payload['customer'] = ['email' => $email];
        }

        $session = $valora->createCheckout($payload);

        return redirect()->away($session['checkout_url']);
    }
}

use App\Http\Controllers\CheckoutController;

Route::post('/checkout', [CheckoutController::class, 'store']);

<?php

namespace App\Http\Controllers;

use Illuminate\Http\Request;

class ValoraWebhookController extends Controller
{
    public function __invoke(Request $request)
    {
        $raw = $request->getContent();
        $parts = [];
        foreach (explode(',', (string) $request->header('X-Valora-Signature')) as $p) {
            [$k, $v] = array_pad(explode('=', $p, 2), 2, '');
            $parts[$k] = $v;
        }

        $t = (int) ($parts['t'] ?? 0);
        $expected = hash_hmac('sha256', $t . '.' . $raw, config('services.valora.webhook_secret'));
        if (!hash_equals($expected, $parts['v1'] ?? '') || abs(time() - $t) > 300) {
            return response('assinatura inválida', 400);
        }

        $event = json_decode($raw, true);
        // Ignore eventos repetidos: guarde $event['id'] numa tabela com índice único.

        if ($event['type'] === 'payment.succeeded') {
            $payment = $event['data']['object'];
            // Order::where('id', $payment['external_reference'])->update(['status' => 'paid']);
        }

        return response()->noContent(200);
    }
}

use App\Http\Controllers\ValoraWebhookController;

Route::post('/webhooks/valora', ValoraWebhookController::class);