curl -X POST https://www.mockcard.io/api/v1/generate \
  -H "Content-Type: application/json" \
  -d '{
    "brand": "visa",
    "scenario": "success",
    "amount": 1000,
    "currency": "inr"
  }'

{
  "status": "success",
  "payment_intent_id": "pi_mock_x7y8z9a0b1c2",
  "scenario": "success",
  "card": {
    "brand": "visa",
    "card_number": "4539578763621486",
    "masked_number": "••••••••••••1486",
    "expiry_month": "07",
    "expiry_year": "2028",
    "cvv": "382",
    "cardholder_name": "PRIYA PATEL",
    "luhn_valid": true
  },
  "webhook_event": {
    "id": "evt_mock_a1b2c3d4e5f6",
    "object": "event",
    "type": "payment_intent.succeeded",
    "created": 1741708800,
    "livemode": false,
    "data": {
      "object": {
        "id": "pi_mock_x7y8z9a0b1c2",
        "object": "payment_intent",
        "amount": 1000,
        "currency": "inr",
        "status": "succeeded",
        "payment_method_details": {
          "type": "card",
          "card": { "brand": "visa", "last4": "1486", "exp_month": "07", "exp_year": "2028" }
        }
      }
    },
    "delivery": null
  }
}

{
  "error": {
    "code": "card_declined",
    "message": "Your card has insufficient funds.",
    "decline_code": "insufficient_funds"
  },
  "webhook_event": {
    "id": "evt_mock_d4e5f6g7h8i9",
    "object": "event",
    "type": "payment_intent.payment_failed",
    "created": 1741708800,
    "livemode": false,
    "data": {
      "object": {
        "id": "pi_mock_j0k1l2m3n4o5",
        "object": "payment_intent",
        "amount": 1000,
        "currency": "inr",
        "status": "requires_payment_method",
        "last_payment_error": {
          "code": "card_declined",
          "decline_code": "insufficient_funds",
          "message": "Your card has insufficient funds.",
          "type": "card_error"
        }
      }
    },
    "delivery": null
  }
}

import { createHmac } from "crypto";

// Razorpay uses plain HMAC-SHA256 hex — no "sha256=" prefix
function verifyRazorpayWebhook(
  rawBody: string,   // req.body as raw string (express.text() middleware)
  signature: string, // X-Razorpay-Signature header
  secret: string     // your WEBHOOK_SECRET env var
): boolean {
  const expected = createHmac("sha256", secret).update(rawBody).digest("hex");
  return expected === signature;
}

app.post("/webhook", express.text({ type: "*/*" }), (req, res) => {
  const sig = req.headers["x-razorpay-signature"] as string;
  if (!verifyRazorpayWebhook(req.body, sig, process.env.WEBHOOK_SECRET!)) {
    return res.status(400).send("Invalid signature");
  }
  const event = JSON.parse(req.body);
  const payment = event.payload.payment.entity;

  if (event.event === "payment.captured") {
    // fulfil order — payment.id is your transaction reference
    await db.orders.fulfill(payment.id);
  }
  res.status(200).send("ok");
});

// Headers
// X-MockCard-Event:     payment_intent.succeeded
// X-MockCard-Signature: sha256=a3f9c12b8e1d…

{
  "id": "evt_mock_a3f9c12b8e1d",
  "type": "payment_intent.succeeded",
  "created": 1741843200,
  "data": {
    "object": {
      "id": "pi_mock_7b2e4d9a1c3f",
      "object": "payment_intent",
      "amount": 1000,
      "currency": "inr",
      "status": "succeeded",
      "payment_method_details": {
        "card": {
          "brand": "visa",
          "last4": "1486",
          "exp_month": "07",
          "exp_year": "2028"
        }
      },
      "last_payment_error": null,
      "next_action": null
    }
  }
}

// Headers
// X-Razorpay-Event-Type: payment.captured
// X-Razorpay-Signature:  a3f9c12b8e1d… (plain HMAC-SHA256 hex — no "sha256=" prefix)

{
  "entity": "event",
  "account_id": "acc_mock_f9e8d7c6b5a4",
  "event": "payment.captured",
  "contains": ["payment"],
  "payload": {
    "payment": {
      "entity": {
        "id": "pay_mock_7b2e4d9a1c3f",
        "entity": "payment",
        "amount": 1000,
        "currency": "INR",
        "status": "captured",
        "method": "card",
        "card": {
          "id": "card_mock_x1y2z3a4b5c6",
          "entity": "card",
          "name": "PRIYA PATEL",
          "network": "Visa",
          "last4": "1486",
          "expiry_month": "07",
          "expiry_year": "2028"
        }
      }
    }
  },
  "created_at": 1741843200
}

import { createHmac } from "crypto";

// Call this BEFORE json.parse() — sign the raw body string, not the object
function verifyWebhook(
  rawBody: string,   // req.body as raw string (use express.text() middleware)
  signature: string, // X-MockCard-Signature header
  secret: string     // your WEBHOOK_SECRET env var
): boolean {
  const expected =
    "sha256=" + createHmac("sha256", secret).update(rawBody).digest("hex");
  return expected === signature;
}

// Express.js example
app.post("/webhook", express.text({ type: "*/*" }), (req, res) => {
  const sig = req.headers["x-mockcard-signature"] as string;
  if (!verifyWebhook(req.body, sig, process.env.WEBHOOK_SECRET!)) {
    return res.status(400).send("Invalid signature");
  }
  const event = JSON.parse(req.body);
  if (event.type === "payment_intent.succeeded") {
    // fulfil order…
  }
  res.status(200).send("ok");
});