Next.js

import "server-only";

const BASE_URL = "https://api.valorapayments.com.br";

export class ValoraError extends Error {
  constructor(public status: number, public type: string, message: string) {
    super(message);
  }
}

export async function valora<T>(path: string, init: RequestInit = {}): Promise<T> {
  const res = await fetch(`${BASE_URL}${path}`, {
    ...init,
    headers: {
      Authorization: `Bearer ${process.env.VALORA_API_KEY}`,
      "Content-Type": "application/json",
      ...init.headers,
    },
    cache: "no-store",
  });
  const body = await res.json();
  if (!res.ok) throw new ValoraError(res.status, body.error?.type, body.error?.message);
  return body as T;
}

export type CheckoutSession = {
  id: string;
  status: "open" | "processing" | "paid" | "failed" | "expired";
  checkout_url: string;
};

"use server";

import { redirect } from "next/navigation";
import { valora, type CheckoutSession } from "@/lib/valora";

export async function startCheckout(formData: FormData) {
  const orderId = crypto.randomUUID();
  // Grave o pedido como "pendente" no seu banco aqui, com o orderId.

  const session = await valora<CheckoutSession>("/v1/checkouts", {
    method: "POST",
    body: JSON.stringify({
      product_cart: [{ product_id: process.env.VALORA_PRODUCT_ID, quantity: 1 }],
      customer: { email: String(formData.get("email") ?? "") || undefined },
      success_url: `${process.env.APP_URL}/pedido/${orderId}`,
      cancel_url: `${process.env.APP_URL}/`,
      external_reference: orderId,
    }),
  });

  redirect(session.checkout_url);
}

import { startCheckout } from "./actions/checkout";

export default function Page() {
  return (
    <form action={startCheckout}>
      <input name="email" type="email" placeholder="Seu e-mail" />
      <button type="submit">Comprar</button>
    </form>
  );
}

import crypto from "node:crypto";

export const runtime = "nodejs";

function isValid(raw: string, header: string | null, secret: string) {
  const parts = Object.fromEntries((header ?? "").split(",").map((p) => p.split("=")));
  const t = Number(parts.t);
  if (!parts.v1 || !Number.isFinite(t) || Math.abs(Date.now() / 1000 - t) > 300) return false;
  const expected = crypto.createHmac("sha256", secret).update(`${t}.${raw}`).digest("hex");
  const a = Buffer.from(parts.v1);
  const b = Buffer.from(expected);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

export async function POST(request: Request) {
  const raw = await request.text();
  if (!isValid(raw, request.headers.get("x-valora-signature"), process.env.VALORA_WEBHOOK_SECRET!)) {
    return new Response("assinatura inválida", { status: 400 });
  }

  const event = JSON.parse(raw);
  const payment = event.data.object;

  // 1) Ignore eventos já processados (o mesmo evento pode chegar mais de uma vez).
  // if (await db.webhookEvents.exists(event.id)) return new Response(null, { status: 200 });
  // await db.webhookEvents.insert(event.id);

  if (event.type === "payment.succeeded") {
    // 2) Em produção, só libere pedidos reais.
    // if (!payment.livemode && process.env.NODE_ENV === "production") return new Response(null, { status: 200 });
    // 3) Marque o pedido como pago.
    // await db.orders.markPaid(payment.external_reference, payment.id);
  }

  return new Response(null, { status: 200 });
}

export default async function Pedido({ params }: { params: Promise<{ id: string }> }) {
  const { id } = await params;
  // const order = await db.orders.find(id);
  const paid = false; // order?.status === "paid"
  return <p>{paid ? "Pagamento confirmado!" : "Estamos aguardando a confirmação do pagamento."}</p>;
}