決済を、
数行のコードで。

curl https://www.swapay-app.com/api/v1/payment_intents \
  -H "Authorization: Bearer sk_test_…" \
  -H "Idempotency-Key: order-1029" \
  -d amount=3300 \
  -d currency=jpy \
  -d description="ご注文 1029" \
  -d "metadata[order_id]=1029" \
  -d return_url=https://shop.example.co.jp/thanks

$ch = curl_init('https://www.swapay-app.com/api/v1/payment_intents');
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => [
    'Authorization: Bearer ' . getenv('SWAPAY_SECRET_KEY'),
    'Content-Type: application/json',
    'Idempotency-Key: order-1029',
  ],
  CURLOPT_POSTFIELDS => json_encode([
    'amount' => 3300,
    'currency' => 'jpy',
    'description' => 'ご注文 1029',
    'metadata' => ['order_id' => '1029'],
    'return_url' => 'https://shop.example.co.jp/thanks',
  ]),
]);
$pi = json_decode(curl_exec($ch), true);

const r = await fetch('https://www.swapay-app.com/api/v1/payment_intents', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.SWAPAY_SECRET_KEY}`,
    'Content-Type': 'application/json',
    'Idempotency-Key': 'order-1029',
  },
  body: JSON.stringify({
    amount: 3300,
    currency: 'jpy',
    description: 'ご注文 1029',
    metadata: { order_id: '1029' },
    return_url: 'https://shop.example.co.jp/thanks',
  }),
});
const pi = await r.json();

# 返ってきた checkout_url に、お客様を案内します
{
    "id": "pi_01jbx3q4w2k8m5n6p7r8s9t0va",
    "object": "payment_intent",
    "amount": 3300,
    "status": "requires_payment_method",
    "checkout_url": "https://www.swapay-app.com/pay/01jbx3q4w2k8m5n6p7r8s9t0va"
}

// お客様の画面を、SWAPay の決済画面へ
header('Location: ' . $pi['checkout_url'], true, 303);
exit;

// 支払いが終わると return_url に戻ります。
// 注文の確定は、戻り先ではなくウェブフックで。

// お客様の画面を、SWAPay の決済画面へ（Express の例）
res.redirect(303, pi.checkout_url);

// 支払いが終わると return_url に戻ります。
// 注文の確定は、戻り先ではなくウェブフックで。

# 届くウェブフックの本文（POST・application/json）
# ヘッダー  SWAPay-Signature: t=…,v1=…
{
    "id": "evt_01jbx9e1v2e3n4t5a6b7c8d9e0",
    "object": "event",
    "type": "payment_intent.succeeded",
    "api_version": "2026-11-07",
    "data": {
        "object": {
            "id": "pi_01jbx3q4w2k8m5n6p7r8s9t0va",
            "object": "payment_intent",
            "amount": 3300,
            "amount_received": 3300,
            "status": "succeeded",
            "metadata": {
                "order_id": "1029"
            }
        }
    }
}

$payload = file_get_contents('php://input');
$header  = $_SERVER['HTTP_SWAPAY_SIGNATURE'] ?? '';

// t=<UNIX秒>,v1=<署名>（鍵の入れ替え中は v1 が2つ）
$t = 0; $sigs = [];
foreach (explode(',', $header) as $part) {
  [$k, $v] = array_pad(explode('=', $part, 2), 2, '');
  if ($k === 't')  $t = (int) $v;
  if ($k === 'v1') $sigs[] = $v;
}
$expected = hash_hmac('sha256', $t . '.' . $payload, getenv('SWAPAY_WEBHOOK_SECRET'));
$ok = abs(time() - $t) <= 300
  && array_filter($sigs, fn ($s) => hash_equals($expected, $s));
if (!$ok) { http_response_code(400); exit; }

$event = json_decode($payload, true);
if ($event['type'] === 'payment_intent.succeeded') {
  // 注文を「支払い済み」に（同じ event.id は1回だけ処理）
}
http_response_code(200);

import crypto from 'node:crypto';

app.post('/webhooks/swapay', express.raw({ type: 'application/json' }), (req, res) => {
  const header = req.get('SWAPay-Signature') ?? '';
  let t = 0; const sigs = [];
  for (const part of header.split(',')) {
    const [k, v] = part.split('=');
    if (k === 't') t = Number(v);
    if (k === 'v1') sigs.push(v);
  }
  const expected = crypto.createHmac('sha256', process.env.SWAPAY_WEBHOOK_SECRET)
    .update(`${t}.${req.body}`).digest('hex');
  const ok = Math.abs(Date.now() / 1000 - t) <= 300 && sigs.some((s) =>
    s.length === expected.length && crypto.timingSafeEqual(Buffer.from(s), Buffer.from(expected)));
  if (!ok) return res.sendStatus(400);

  const event = JSON.parse(req.body);
  if (event.type === 'payment_intent.succeeded') {
    // 注文を「支払い済み」に（同じ event.id は1回だけ処理）
  }
  res.sendStatus(200);
});