How to Integrate Replit with Worldpay

1// Node.js: credential setup and authentication helper
2const WORLDPAY_SERVICE_KEY = process.env.WORLDPAY_SERVICE_KEY;
3const WORLDPAY_CLIENT_KEY = process.env.WORLDPAY_CLIENT_KEY;
4const WORLDPAY_MERCHANT_CODE = process.env.WORLDPAY_MERCHANT_CODE;
5const WORLDPAY_ENV = process.env.WORLDPAY_ENV || 'sandbox';
6
7const WORLDPAY_BASE_URL = WORLDPAY_ENV === 'production'
8  ? 'https://access.worldpay.com'
9  : 'https://try.access.worldpay.com';
10
11// HTTP Basic Auth header
12const basicAuth = Buffer.from(`${WORLDPAY_SERVICE_KEY}:${WORLDPAY_CLIENT_KEY}`).toString('base64');
13
14const worldpayHeaders = {
15  'Authorization': `Basic ${basicAuth}`,
16  'Content-Type': 'application/json',
17  'Accept': 'application/json'
18};
19
20if (!WORLDPAY_SERVICE_KEY || !WORLDPAY_CLIENT_KEY || !WORLDPAY_MERCHANT_CODE) {
21  console.error('ERROR: Worldpay credentials not set in Replit Secrets. Add WORLDPAY_SERVICE_KEY, WORLDPAY_CLIENT_KEY, and WORLDPAY_MERCHANT_CODE.');
22  process.exit(1);
23}

1const express = require('express');
2const axios = require('axios');
3const crypto = require('crypto');
4
5const app = express();
6app.use(express.json());
7
8// Worldpay config (from worldpay-config.js or inline)
9const WORLDPAY_SERVICE_KEY = process.env.WORLDPAY_SERVICE_KEY;
10const WORLDPAY_CLIENT_KEY = process.env.WORLDPAY_CLIENT_KEY;
11const WORLDPAY_MERCHANT_CODE = process.env.WORLDPAY_MERCHANT_CODE;
12const WORLDPAY_BASE_URL = process.env.WORLDPAY_ENV === 'production'
13  ? 'https://access.worldpay.com'
14  : 'https://try.access.worldpay.com';
15
16const basicAuth = Buffer.from(`${WORLDPAY_SERVICE_KEY}:${WORLDPAY_CLIENT_KEY}`).toString('base64');
17const worldpayHeaders = {
18  'Authorization': `Basic ${basicAuth}`,
19  'Content-Type': 'application/json',
20  'Accept': 'application/json'
21};
22
23// Authorize a payment
24app.post('/api/payments/authorize', async (req, res) => {
25  const { sessionHref, amount, currencyCode, orderDescription, merchantReference } = req.body;
26
27  if (!sessionHref || !amount || !currencyCode) {
28    return res.status(400).json({ error: 'sessionHref, amount, and currencyCode are required' });
29  }
30
31  const reference = merchantReference || `ORDER-${Date.now()}-${crypto.randomBytes(4).toString('hex')}`;
32
33  const authorizationPayload = {
34    transactionReference: reference,
35    merchant: { entity: WORLDPAY_MERCHANT_CODE },
36    instruction: {
37      narrative: { line1: orderDescription || 'Order payment' },
38      value: {
39        currency: currencyCode,
40        amount: Math.round(amount * 100) // Convert to minor units (cents/pence)
41      },
42      paymentInstrument: {
43        type: 'card/checkout',
44        sessionHref: sessionHref
45      }
46    }
47  };
48
49  try {
50    const response = await axios.post(
51      `${WORLDPAY_BASE_URL}/payments/authorizations`,
52      authorizationPayload,
53      { headers: worldpayHeaders, timeout: 30000 }
54    );
55
56    const result = response.data;
57    const outcome = result.outcome;
58
59    if (outcome === 'authorized') {
60      res.json({
61        success: true,
62        transactionReference: reference,
63        authorizationCode: result.authorizationCode,
64        outcome: outcome
65      });
66    } else if (outcome === 'challenged') {
67      // 3DS2 challenge required — return challenge details to frontend
68      res.json({
69        success: false,
70        requires3DS: true,
71        transactionReference: reference,
72        challenge: result._links?.['payments:challenge'] || null,
73        outcome: outcome
74      });
75    } else {
76      res.json({
77        success: false,
78        transactionReference: reference,
79        outcome: outcome,
80        description: result.description
81      });
82    }
83  } catch (error) {
84    const apiError = error.response?.data;
85    console.error('Worldpay authorization error:', apiError || error.message);
86    res.status(error.response?.status || 500).json({
87      error: 'Payment authorization failed',
88      details: apiError?.message || error.message
89    });
90  }
91});
92
93app.listen(3000, '0.0.0.0', () => console.log('Worldpay payment server running on port 3000'));

1// Handle 3DS2 completion after customer authenticates with their bank
2app.post('/api/payments/3ds-complete', async (req, res) => {
3  const { transactionReference, authenticationValue, eci, dsTransactionId } = req.body;
4
5  if (!transactionReference) {
6    return res.status(400).json({ error: 'transactionReference is required' });
7  }
8
9  const completionPayload = {
10    transactionReference: transactionReference,
11    merchant: { entity: WORLDPAY_MERCHANT_CODE },
12    authentication: {
13      version: '2.1.0',
14      authenticationValue: authenticationValue,
15      eci: eci,
16      dsTransactionId: dsTransactionId
17    }
18  };
19
20  try {
21    const response = await axios.post(
22      `${WORLDPAY_BASE_URL}/payments/authorizations/threeDS/complete`,
23      completionPayload,
24      { headers: worldpayHeaders, timeout: 30000 }
25    );
26
27    const result = response.data;
28    res.json({
29      success: result.outcome === 'authorized',
30      transactionReference: transactionReference,
31      outcome: result.outcome,
32      authorizationCode: result.authorizationCode || null
33    });
34  } catch (error) {
35    console.error('3DS completion error:', error.response?.data || error.message);
36    res.status(error.response?.status || 500).json({
37      error: '3DS completion failed',
38      details: error.response?.data?.message || error.message
39    });
40  }
41});
42
43// Inquiry endpoint to check transaction status
44app.get('/api/payments/:reference', async (req, res) => {
45  try {
46    const response = await axios.get(
47      `${WORLDPAY_BASE_URL}/payments/authorizations/${req.params.reference}`,
48      { headers: worldpayHeaders, timeout: 15000 }
49    );
50    res.json(response.data);
51  } catch (error) {
52    console.error('Inquiry error:', error.response?.data || error.message);
53    res.status(error.response?.status || 500).json({ error: 'Transaction inquiry failed' });
54  }
55});

1import os
2import base64
3import requests
4from flask import Flask, jsonify, request
5
6app = Flask(__name__)
7
8SERVICE_KEY = os.environ['WORLDPAY_SERVICE_KEY']
9CLIENT_KEY = os.environ['WORLDPAY_CLIENT_KEY']
10MERCHANT_CODE = os.environ['WORLDPAY_MERCHANT_CODE']
11ENV = os.environ.get('WORLDPAY_ENV', 'sandbox')
12
13BASE_URL = 'https://access.worldpay.com' if ENV == 'production' else 'https://try.access.worldpay.com'
14AUTH_HEADER = base64.b64encode(f'{SERVICE_KEY}:{CLIENT_KEY}'.encode()).decode()
15HEADERS = {
16    'Authorization': f'Basic {AUTH_HEADER}',
17    'Content-Type': 'application/json',
18    'Accept': 'application/json'
19}
20
21@app.route('/api/payments/<reference>/capture', methods=['POST'])
22def capture_payment(reference):
23    data = request.json or {}
24    capture_value = data.get('amount')
25
26    payload = {
27        'transactionReference': reference,
28        'merchant': {'entity': MERCHANT_CODE}
29    }
30    if capture_value:
31        payload['value'] = {
32            'currency': data.get('currency', 'GBP'),
33            'amount': int(float(capture_value) * 100)
34        }
35
36    try:
37        resp = requests.post(
38            f'{BASE_URL}/payments/settlements/captures',
39            json=payload, headers=HEADERS, timeout=30
40        )
41        resp.raise_for_status()
42        return jsonify({'success': True, 'reference': reference, 'result': resp.json()})
43    except requests.RequestException as e:
44        error_data = e.response.json() if e.response else {'message': str(e)}
45        return jsonify({'error': 'Capture failed', 'details': error_data}), 500
46
47@app.route('/api/payments/<reference>/refund', methods=['POST'])
48def refund_payment(reference):
49    data = request.json or {}
50    if not data.get('amount') or not data.get('currency'):
51        return jsonify({'error': 'amount and currency are required'}), 400
52
53    payload = {
54        'transactionReference': reference,
55        'merchant': {'entity': MERCHANT_CODE},
56        'value': {
57            'currency': data['currency'],
58            'amount': int(float(data['amount']) * 100)
59        }
60    }
61
62    try:
63        resp = requests.post(
64            f'{BASE_URL}/payments/settlements/refunds',
65            json=payload, headers=HEADERS, timeout=30
66        )
67        resp.raise_for_status()
68        return jsonify({'success': True, 'refund_reference': reference, 'result': resp.json()})
69    except requests.RequestException as e:
70        error_data = e.response.json() if e.response else {'message': str(e)}
71        return jsonify({'error': 'Refund failed', 'details': error_data}), 500
72
73if __name__ == '__main__':
74    app.run(host='0.0.0.0', port=3000)

1# .replit configuration for production payment server
2# Update this in your .replit file
3
4# [deployment]
5# run = ["node", "server.js"]
6# deploymentTarget = "cloudrun"
7#
8# [[ports]]
9# internalPort = 3000
10# externalPort = 80
11
12# Add rate limiting to Express (npm install express-rate-limit)
13const rateLimit = require('express-rate-limit');
14
15const paymentLimiter = rateLimit({
16  windowMs: 60 * 1000, // 1 minute
17  max: 10, // max 10 payment attempts per minute per IP
18  message: { error: 'Too many payment attempts. Please wait before trying again.' },
19  standardHeaders: true
20});
21
22app.post('/api/payments/authorize', paymentLimiter, async (req, res) => {
23  // ... payment authorization code
24});
25
26# Idempotency: generate deterministic transaction references
27function generateMerchantReference(orderId, customerId) {
28  // Include order and customer IDs to make reference deterministic
29  // Re-submitting with the same reference won't duplicate the charge
30  return `ORD-${orderId}-CUST-${customerId}-${Date.now()}`;
31}