How to Integrate Replit with Sage Pay

1import os
2import base64
3import requests
4from flask import Flask, request, jsonify, redirect
5
6app = Flask(__name__)
7
8INTEGRATION_KEY = os.environ["OPAYO_INTEGRATION_KEY"]
9INTEGRATION_PASSWORD = os.environ["OPAYO_INTEGRATION_PASSWORD"]
10ENVIRONMENT = os.environ.get("OPAYO_ENVIRONMENT", "sandbox")
11
12BASE_URL = (
13    "https://pi-test.sagepay.com/api/v1"
14    if ENVIRONMENT == "sandbox"
15    else "https://pi.sagepay.com/api/v1"
16)
17
18
19def get_auth_header() -> str:
20    """Create Basic auth header from integration key and password."""
21    credentials = f"{INTEGRATION_KEY}:{INTEGRATION_PASSWORD}"
22    encoded = base64.b64encode(credentials.encode()).decode()
23    return f"Basic {encoded}"
24
25
26HEADERS = {
27    "Authorization": get_auth_header(),
28    "Content-Type": "application/json",
29    "Cache-Control": "no-cache"
30}
31
32
33@app.route("/session-key", methods=["POST"])
34def create_session_key():
35    """Create a merchant session key for frontend card tokenisation."""
36    resp = requests.post(
37        f"{BASE_URL}/merchant-session-keys",
38        json={"vendorName": os.environ.get("OPAYO_VENDOR_NAME", "sandbox")},
39        headers=HEADERS
40    )
41    resp.raise_for_status()
42    return jsonify(resp.json())
43
44
45@app.route("/transaction", methods=["POST"])
46def create_transaction():
47    """Submit a card payment using a card identifier from the frontend."""
48    data = request.get_json()
49    card_identifier = data.get("cardIdentifier")
50    amount = data.get("amount")  # in pence, e.g. 1000 = £10.00
51    order_ref = data.get("orderRef", "ORDER001")
52
53    transaction_payload = {
54        "transactionType": "Payment",
55        "paymentMethod": {
56            "card": {
57                "merchantSessionKey": data.get("merchantSessionKey"),
58                "cardIdentifier": card_identifier
59            }
60        },
61        "vendorTxCode": order_ref,
62        "amount": amount,
63        "currency": "GBP",
64        "description": data.get("description", "Online payment"),
65        "apply3DSecure": "UseMSPSetting",
66        "customerFirstName": data.get("firstName", ""),
67        "customerLastName": data.get("lastName", ""),
68        "billingAddress": {
69            "address1": data.get("address1", ""),
70            "city": data.get("city", ""),
71            "postalCode": data.get("postalCode", ""),
72            "country": data.get("country", "GB")
73        },
74        "strongCustomerAuthentication": {
75            "website": data.get("returnUrl", ""),
76            "notificationURL": f"{request.host_url}3ds-callback"
77        }
78    }
79
80    resp = requests.post(
81        f"{BASE_URL}/transactions",
82        json=transaction_payload,
83        headers=HEADERS
84    )
85
86    result = resp.json()
87
88    # Check if 3DS challenge is required
89    if result.get("status") == "3DAuth":
90        return jsonify({
91            "status": "3DAuth",
92            "acsUrl": result.get("acsUrl"),
93            "acsTransId": result.get("acsTransId"),
94            "dsTransId": result.get("dsTransId"),
95            "cReq": result.get("cReq"),
96            "transactionId": result.get("transactionId")
97        })
98
99    return jsonify(result)
100
101
102@app.route("/3ds-callback", methods=["POST"])
103def handle_3ds_callback():
104    """Handle 3D Secure authentication callback from Opayo."""
105    cres = request.form.get("cres")
106    transaction_id = request.form.get("transactionId")
107
108    resp = requests.post(
109        f"{BASE_URL}/transactions/{transaction_id}/3d-secure-challenge",
110        json={"cRes": cres},
111        headers=HEADERS
112    )
113    result = resp.json()
114    status = result.get("status", "")
115
116    if status == "Ok":
117        return redirect("/payment-success")
118    else:
119        return redirect(f"/payment-failed?status={status}")
120
121
122@app.route("/payment-success")
123def payment_success():
124    return jsonify({"message": "Payment completed successfully"})
125
126
127@app.route("/payment-failed")
128def payment_failed():
129    status = request.args.get("status", "Failed")
130    return jsonify({"message": f"Payment failed: {status}"}), 400
131
132
133if __name__ == "__main__":
134    app.run(host="0.0.0.0", port=3000, debug=False)

1const express = require('express');
2const axios = require('axios');
3
4const app = express();
5app.use(express.json());
6app.use(express.urlencoded({ extended: true })); // for 3DS form POST
7
8const INTEGRATION_KEY = process.env.OPAYO_INTEGRATION_KEY;
9const INTEGRATION_PASSWORD = process.env.OPAYO_INTEGRATION_PASSWORD;
10const ENVIRONMENT = process.env.OPAYO_ENVIRONMENT || 'sandbox';
11const VENDOR_NAME = process.env.OPAYO_VENDOR_NAME || 'sandbox';
12
13const BASE_URL = ENVIRONMENT === 'sandbox'
14  ? 'https://pi-test.sagepay.com/api/v1'
15  : 'https://pi.sagepay.com/api/v1';
16
17const AUTH = Buffer.from(`${INTEGRATION_KEY}:${INTEGRATION_PASSWORD}`).toString('base64');
18const HEADERS = {
19  Authorization: `Basic ${AUTH}`,
20  'Content-Type': 'application/json',
21  'Cache-Control': 'no-cache'
22};
23
24// Create merchant session key
25app.post('/session-key', async (req, res) => {
26  try {
27    const { data } = await axios.post(
28      `${BASE_URL}/merchant-session-keys`,
29      { vendorName: VENDOR_NAME },
30      { headers: HEADERS }
31    );
32    res.json(data);
33  } catch (err) {
34    res.status(err.response?.status || 500).json(err.response?.data || { error: err.message });
35  }
36});
37
38// Create payment transaction
39app.post('/transaction', async (req, res) => {
40  const {
41    cardIdentifier, merchantSessionKey, amount, orderRef,
42    description, firstName, lastName,
43    address1, city, postalCode, country = 'GB'
44  } = req.body;
45
46  const payload = {
47    transactionType: 'Payment',
48    paymentMethod: {
49      card: { merchantSessionKey, cardIdentifier }
50    },
51    vendorTxCode: orderRef || `ORDER-${Date.now()}`,
52    amount: Number(amount),
53    currency: 'GBP',
54    description: description || 'Online payment',
55    apply3DSecure: 'UseMSPSetting',
56    customerFirstName: firstName || '',
57    customerLastName: lastName || '',
58    billingAddress: {
59      address1: address1 || '',
60      city: city || '',
61      postalCode: postalCode || '',
62      country
63    },
64    strongCustomerAuthentication: {
65      website: req.body.returnUrl || '',
66      notificationURL: `${req.protocol}://${req.get('host')}/3ds-callback`
67    }
68  };
69
70  try {
71    const { data } = await axios.post(`${BASE_URL}/transactions`, payload, { headers: HEADERS });
72    res.json(data);
73  } catch (err) {
74    res.status(err.response?.status || 500).json(err.response?.data || { error: err.message });
75  }
76});
77
78// Handle 3D Secure callback
79app.post('/3ds-callback', async (req, res) => {
80  const { cres, transactionId } = req.body;
81  try {
82    const { data } = await axios.post(
83      `${BASE_URL}/transactions/${transactionId}/3d-secure-challenge`,
84      { cRes: cres },
85      { headers: HEADERS }
86    );
87    if (data.status === 'Ok') {
88      return res.redirect('/payment-success');
89    }
90    res.redirect(`/payment-failed?status=${data.status}`);
91  } catch (err) {
92    res.redirect(`/payment-failed?status=error`);
93  }
94});
95
96app.get('/payment-success', (req, res) => {
97  res.json({ message: 'Payment completed successfully' });
98});
99
100app.get('/payment-failed', (req, res) => {
101  res.status(400).json({ message: `Payment failed: ${req.query.status || 'Unknown'}` });
102});
103
104app.listen(3000, '0.0.0.0', () => {
105  console.log('Opayo payment server running on port 3000');
106});

1[[ports]]
2internalPort = 3000
3externalPort = 80
4
5[deployment]
6run = ["node", "server.js"]
7deploymentTarget = "cloudrun"