Example app

A working merchant integration you can read and run — one-off purchases and subscriptions, with webhook verification.

Everything in these guides is a fragment. This is the whole thing, running:

github.com/paygatehq/paygate-example

A small shop that sells one thing two ways — buy once and subscribe. It redirects a customer to the hosted pages, receives webhooks, and verifies their signatures. It is a real integration rather than a script, and it stops where a real integration stops: at the authorisation URL. Signing a mandate is a transaction from the customer's own wallet, and nothing on a server can do it for them.

What is in it

src/env.ts        configuration, checked at boot — refuses rather than guesses
src/paygate.ts    the whole API client: fetch, a bearer token, idempotency keys
src/catalogue.ts  product + price + webhook endpoint, created once
src/webhook.ts    signature verification, and why it is shaped that way
src/server.ts     the merchant app: /buy, /subscribe, /webhooks/paygate
src/views.ts      server-rendered HTML, no framework

No runtime dependencies and no framework. Node ≥ 22.6 runs the TypeScript directly. That is on purpose: a worked example whose interesting parts are hidden behind an SDK teaches the SDK. paygate.ts is about eighty lines and shows the only three things this API asks of a client — a bearer token, an Idempotency-Key on writes, and an error envelope to branch on.

The part worth reading first

src/webhook.ts. Signature verification is the one piece an integration gets wrong in a way nothing tells it about: a check that always passes looks exactly like a check that works, until somebody posts you a payment that never happened. It verifies over the raw bytes as they arrived, compares in constant time, and enforces the timestamp tolerance — with the reasoning written down beside each.

Running it

The README carries the full set-up, including the two dev-only settings that let a gateway deliver webhooks to localhost and why neither can be combined with live mode.