A small API you can finish in a sprint.

create-payment.sh

curl https://api.marupay.app/v1/payments \
  -H "Authorization: Bearer mp_live_••••••••" \
  -H "Idempotency-Key: ORD-58202-1" \
  -H "Content-Type: application/json" \
  -d '{
    "orderId": "ORD-58202",
    "customerId": "u_6624",
    "amount": 49500,
    "currency": "KRW",
    "returnUrl": "https://example.com/orders/ORD-58202"
  }'
 
HTTP/1.1 201 Created
{
  "data": {
    "id": "pay_2MzV6hTf9w",
    "orderId": "ORD-58202",
    "amount": 49500,
    "currency": "KRW",
    "status": "pending",
    "payUrl": "https://pay.marupay.app/p/2MzV6hTf9w",
    "expiresAt": "2026-09-29T05:01:58Z"
  }
}

webhook.http

POST /webhooks/marupay HTTP/1.1
Host: api.example.com
Content-Type: application/json
MaruPay-Event-Id: evt_5hRd0Xw8Ne
MaruPay-Signature: t=1790656319,v1=e2c97b…0f5a
 
{
  "id": "evt_5hRd0Xw8Ne",
  "type": "payment.completed",
  "data": {
    "paymentId": "pay_2MzV6hTf9w",
    "orderId": "ORD-58202",
    "amount": 49500,
    "currency": "KRW",
    "completedAt": "2026-09-29T04:31:58Z"
  }
}
 
HTTP/1.1 200 OK

verify.ts

import crypto from "node:crypto";
 
// header: "t=<unix>,v1=<hex>"  body: the raw request body
export function verify(body: string, header: string, secret: string) {
  const [, t, v1] = /^t=(\d+),v1=([a-f0-9]{64})$/.exec(header) ?? [];
  if (!t || !v1) return false;
 
  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${t}.${body}`)
    .digest("hex");
 
  const fresh = Math.abs(Date.now() / 1000 - Number(t)) <= 300;
  return fresh && crypto.timingSafeEqual(
    Buffer.from(v1, "hex"),
    Buffer.from(expected, "hex"),
  );
}
 
// Retried deliveries reuse the event ID: credit each one once.
if (await processed.has(event.id)) return res.status(200).end();