Quickstart — Votre première transaction en 5 minutes

npm install @tiqopay/sdk

yarn add @tiqopay/sdk

pnpm add @tiqopay/sdk

import { Tiqopay } from '@tiqopay/sdk';

const escrow = new Tiqopay({
  apiKey: process.env.TIQOPAY_SECRET_KEY,
});

const transaction = await escrow.transactions.create({
  amount: 50000,        // 500.00 MAD (centimes)
  description: 'Logo design - 3 concepts',
  buyer_email: 'fatima@email.ma',
  buyer_name: 'Fatima Zahra',
  deadline: '2026-04-01T00:00:00Z',
});

console.log(transaction.id);     // txn_01JQ...
console.log(transaction.status); // "created"

import requests
import os

API_KEY = os.environ["TIQOPAY_SECRET_KEY"]
BASE = "https://tiqopay.com/api/v1"

res = requests.post(
    f"{BASE}/transactions",
    headers={
        "Authorization": f"Bearer {API_KEY}",
        "Content-Type": "application/json",
    },
    json={
        "amount": 50000,
        "description": "Logo design - 3 concepts",
        "buyer_email": "fatima@email.ma",
        "buyer_name": "Fatima Zahra",
        "deadline": "2026-04-01T00:00:00Z",
    },
)

txn = res.json()
print(txn["id"])      # txn_01JQ...
print(txn["status"])  # "created"

<?php
$apiKey = getenv('TIQOPAY_SECRET_KEY');
$base   = 'https://tiqopay.com/api/v1';

$ch = curl_init("$base/transactions");
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => [
        "Authorization: Bearer $apiKey",
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'amount'      => 50000,
        'description' => 'Logo design - 3 concepts',
        'buyer_email' => 'fatima@email.ma',
        'buyer_name'  => 'Fatima Zahra',
        'deadline'    => '2026-04-01T00:00:00Z',
    ]),
]);

$txn = json_decode(curl_exec($ch), true);
curl_close($ch);

echo $txn['id'];      // txn_01JQ...
echo $txn['status'];  // "created"

import express from 'express';
import { verifyWebhook } from '@tiqopay/sdk/webhooks';

const app = express();

// Important: raw body pour la vérification HMAC
app.post('/webhooks', express.raw({ type: 'application/json' }), (req, res) => {
  try {
    const event = verifyWebhook(
      req.body.toString(),
      req.headers['tiqopay-signature'] as string,
      process.env.TIQOPAY_WEBHOOK_SECRET,
    );

    switch (event.type) {
      case 'transaction.funded':
        console.log('Paiement reçu !', event.data.id);
        // Notifier le vendeur de commencer le travail
        break;

      case 'transaction.delivered':
        console.log('Livraison confirmée', event.data.id);
        break;

      case 'transaction.released':
        console.log('Fonds libérés !', event.data.id);
        // Mettre à jour le statut commande
        break;

      case 'transaction.disputed':
        console.log('Litige ouvert', event.data.id);
        // Alerter le support
        break;
    }

    res.json({ received: true });
  } catch (err) {
    console.error('Webhook invalide:', err.message);
    res.status(400).json({ error: err.message });
  }
});

app.listen(3000);

import hmac, hashlib, time, json, os
from flask import Flask, request, jsonify

app = Flask(__name__)
SECRET = os.environ["TIQOPAY_WEBHOOK_SECRET"]

def verify_webhook(payload, signature, secret, tolerance=300):
    parts = dict(p.split("=", 1) for p in signature.split(","))
    ts = int(parts["t"])

    if time.time() - ts > tolerance:
        raise ValueError("Timestamp too old")

    expected = hmac.new(
        secret.encode(),
        f"{ts}.{payload}".encode(),
        hashlib.sha256,
    ).hexdigest()

    if not hmac.compare_digest(expected, parts["v1"]):
        raise ValueError("Invalid signature")

    return json.loads(payload)

@app.post("/webhooks")
def handle_webhook():
    try:
        event = verify_webhook(
            request.get_data(as_text=True),
            request.headers["tiqopay-Signature"],
            SECRET,
        )
    except ValueError as e:
        return jsonify(error=str(e)), 400

    if event["type"] == "transaction.funded":
        print("Paiement reçu !", event["data"]["id"])

    return jsonify(received=True)

<?php
$secret = getenv('TIQOPAY_WEBHOOK_SECRET');
$payload = file_get_contents('php://input');
$signature = $_SERVER['HTTP_TIQOPAY_SIGNATURE'] ?? '';

// Extraire timestamp et signature
$parts = [];
foreach (explode(',', $signature) as $p) {
    [$k, $v] = explode('=', $p, 2);
    $parts[$k] = $v;
}

$ts = (int) $parts['t'];

// Vérifier la fraîcheur (5 min)
if (time() - $ts > 300) {
    http_response_code(400);
    die(json_encode(['error' => 'Timestamp too old']));
}

// Vérifier la signature HMAC-SHA256
$expected = hash_hmac('sha256', "$ts.$payload", $secret);

if (!hash_equals($expected, $parts['v1'])) {
    http_response_code(400);
    die(json_encode(['error' => 'Invalid signature']));
}

$event = json_decode($payload, true);

switch ($event['type']) {
    case 'transaction.funded':
        // Paiement reçu
        break;
    case 'transaction.released':
        // Fonds libérés
        break;
}

echo json_encode(['received' => true]);