Venomin Pay Integration Guide

Complete technical documentation for embedding Venomin Pay checkout flows, initiating payment intents, and verifying signed webhook notifications.

Sandbox Safety: Use test API endpoints with base URL https://api.venomin.com/sandbox/v1. No real payment credentials or live bank data are accepted in development sandbox mode.

1. API Authentication

All API requests must include your client identifier and authorization token in the request headers:

Authorization: Bearer vn_sbx_sec_••••••••••••••••

X-Merchant-ID: vn_merch_sbx_01h8...

Content-Type: application/json

2. Create Payment Intent

Initialize an idempotent payment checkout session:

POST /sandbox/v1/payments/intent

{
  "amount": 250.00,
  "currency": "USD",
  "orderId": "VN-ORD-202608-8842",
  "customer": {
    "id": "VN-CUS-94827103",
    "name": "Jane Doe",
    "email": "jane@example.com"
  },
  "callbackUrl": "https://yourapp.com/checkout/callback"
}

3. Webhook Signature Verification

Verify every incoming event signature using your webhook secret key and SHA-256 HMAC digest:

import crypto from 'crypto';

function verifyVenominWebhook(payloadString, signatureHeader, secretKey) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secretKey)
    .update(payloadString)
    .digest('hex');
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signatureHeader));
}