Sell digital productswith one link.

<a href="https://pay.pexally.com/your-workspace/your-product"
   style="display:inline-block;padding:14px 28px;border-radius:999px;
          background:#29741d;color:#fff;font:600 16px/1 system-ui;
          text-decoration:none">
  Buy now
</a>

https://pay.pexally.com/your-workspace/your-product?ref=summer-launch

PEXALLY_API_KEY=pxf_…your key…

curl https://flow.pexally.com/api/v1/products \
  -H "Authorization: Bearer $PEXALLY_API_KEY"

PEXALLY_WEBHOOK_SECRET=whsec_…your secret…

app.post("/buy", async (req, res) => {
  const response = await fetch("https://flow.pexally.com/api/v1/checkout-links", {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.PEXALLY_API_KEY}`,
      "Content-Type": "application/json",
      "Idempotency-Key": `cart_${req.body.cartId}`, // a retry returns the same link
    },
    body: JSON.stringify({
      product_id: "3f6c…",              // from GET /products
      ref: req.user.id,                 // your id for this buyer
      customer_email: req.user.email,
      success_url: "https://yourstore.com/thank-you",
    }),
  });
  const link = await response.json();
  if (!response.ok) return res.status(502).send(link.error.message);
  res.redirect(303, link.url);          // Pexally's secure checkout
});

import crypto from "node:crypto";
import express from "express";

app.post("/webhooks/pexally", express.raw({ type: "application/json" }), async (req, res) => {
  // 1. Is it really from Pexally, and recent?
  const timestamp = req.get("Pexally-Timestamp");
  const expected = "v1=" + crypto
    .createHmac("sha256", process.env.PEXALLY_WEBHOOK_SECRET)
    .update(`${timestamp}.${req.body}`)
    .digest("hex");
  const presented = req.get("Pexally-Signature") ?? "";
  const fresh = Math.abs(Date.now() / 1000 - Number(timestamp)) < 300;
  if (!fresh || presented.length !== expected.length ||
      !crypto.timingSafeEqual(Buffer.from(presented), Buffer.from(expected))) {
    return res.sendStatus(400);
  }

  // 2. Answer at once, then do the work — a slow answer gets a retry.
  res.sendStatus(200);

  // 3. Handle each event once: deliveries can repeat.
  const event = JSON.parse(req.body);
  if (await alreadyHandled(event.id)) return;

  if (event.type === "order.paid") {
    const order = await fetch(`https://flow.pexally.com/api/v1/orders/${event.ref}`, {
      headers: { Authorization: `Bearer ${process.env.PEXALLY_API_KEY}` },
    }).then((r) => r.json());
    await deliver(event.ref, order);        // your code: email the file, unlock the course…
  }
  if (event.type === "order.refunded") await revoke(event.ref);
});