Принимайте оплату через СБП с помощью пары запросов

curl -X POST "https://rustypay.pro/api/v1/payments" \
  -H "Authorization: Bearer rp_live_ВАШ_КЛЮЧ" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: order-A-42" \
  -d '{
    "amount": "2500.50",
    "order_id": "A-42",
    "title": "Заказ A-42",
    "return_url": "https://shop.ru/thanks"
  }'

curl "https://rustypay.pro/api/v1/balance" \
  -H "Authorization: Bearer rp_live_ВАШ_КЛЮЧ"

{
  "error": {
    "code": "invalid_request",
    "message": "amount: Введите сумму (например, 1117,32)"
  }
}

{
  "id": "cmuwwwy3c0003owvizi3zhzqk",
  "status": "pending",
  "amount": "2500.50",
  "fee": "187.54",
  "net_amount": "2312.96",
  "currency": "RUB",
  "title": "Заказ A-42",
  "description": null,
  "order_id": "A-42",
  "client_id": "user_1093",
  "payment_url": "https://rustypay.pro/payments/sbp?id=6LC46QpZ...",
  "qr_payload": "https://qr.nspk.ru/AD10006M...",
  "created_at": "2026-10-06T16:48:02.712Z",
  "expires_at": "2026-10-06T17:03:02.711Z",
  "paid_at": null,
  "paid_late": false
}

curl -X POST "https://rustypay.pro/api/v1/payments" \
  -H "Authorization: Bearer rp_live_ВАШ_КЛЮЧ" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: order-A-42" \
  -d '{
    "amount": "2500.50",
    "order_id": "A-42",
    "title": "Заказ A-42",
    "return_url": "https://shop.ru/thanks"
  }'

{
  "id": "cmuwwwy3c0003owvizi3zhzqk",
  "status": "pending",
  "amount": "2500.50",
  "fee": "187.54",
  "net_amount": "2312.96",
  "currency": "RUB",
  "order_id": "A-42",
  "payment_url": "https://rustypay.pro/payments/sbp?id=6LC46QpZ...",
  "qr_payload": "https://qr.nspk.ru/AD10006M...",
  "expires_at": "2026-10-06T17:03:02.711Z"
}

curl "https://rustypay.pro/api/v1/payments/cmuwwwy3c0003owvizi3zhzqk" \
  -H "Authorization: Bearer rp_live_ВАШ_КЛЮЧ"

curl "https://rustypay.pro/api/v1/payments/cmuwwwy3c0003owvizi3zhzqk/status" \
  -H "Authorization: Bearer rp_live_ВАШ_КЛЮЧ"

{
  "id": "cmuwwwy3c0003owvizi3zhzqk",
  "status": "paid",
  "paid": true,
  "paid_at": "2026-10-06T17:01:48.000Z",
  "expires_at": "2026-10-06T17:03:02.711Z"
}

curl "https://rustypay.pro/api/v1/payments?status=paid&limit=50" \
  -H "Authorization: Bearer rp_live_ВАШ_КЛЮЧ"

{
  "data": [
    { "id": "cmuwx3o2u000mowvicdmgenyb", "status": "paid", "amount": "10.00", ... },
    { "id": "cmuwwwy3c0003owvizi3zhzqk", "status": "expired", "amount": "2500.50", ... }
  ],
  "has_more": true
}

import QRCode from "qrcode";

// Свой QR-код вместо нашей страницы оплаты
const svg = await QRCode.toString(payment.qr_payload, {
  type: "svg",
  errorCorrectionLevel: "M",
});

curl "https://rustypay.pro/api/v1/balance" \
  -H "Authorization: Bearer rp_live_ВАШ_КЛЮЧ"

{
  "currency": "RUB",
  "total": "817537.00",
  "available": "790524.00",
  "on_hold": "27013.00",
  "pending_payouts": "20887.00",
  "paid_out": "564120.00",
  "hold_hours": 24
}

POST /webhooks/rusty HTTP/1.1
Content-Type: application/json
User-Agent: RustyPay-Webhooks/1.0
X-Rusty-Event: payment.succeeded
X-Rusty-Signature: sha256=5d41402abc4b2a76b9719d911017c592...

{
  "event": "payment.succeeded",
  "payment": {
    "id": "cmuwx3o2u000mowvicdmgenyb",
    "status": "paid",
    "amount": "10.00",
    "net_amount": "9.20",
    "order_id": "A-42",
    "paid_at": "2026-10-06T17:01:48.000Z",
    ...
  }
}

import crypto from "crypto";
import express from "express";

const app = express();

// Подпись считается от сырого тела, поэтому не парсите JSON заранее
app.post("/webhooks/rusty", express.raw({ type: "application/json" }), (req, res) => {
  const expected = "sha256=" + crypto
    .createHmac("sha256", process.env.RUSTY_WEBHOOK_SECRET)
    .update(req.body)
    .digest("hex");

  const received = req.get("X-Rusty-Signature") ?? "";
  const valid = received.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(received), Buffer.from(expected));
  if (!valid) return res.sendStatus(401);

  const { event, payment } = JSON.parse(req.body);
  if (event === "payment.succeeded") {
    markOrderPaid(payment.order_id, payment.id); // должно быть идемпотентным
  }
  res.sendStatus(200);
});