Widget V2 Integration

const crypto = require("crypto");
const axios = require("axios");

const API_KEY = "YOUR_API_KEY";
const SECRET = "YOUR_ORG_HMAC_SECRET"; // generate from the dashboard
const HOST = "https://sandbox-ramp-server.transfi.com";

const payload = {
  view: "buy",
  email: "[email protected]",
  firstName: "John",
  lastName: "Doe",
  phone: "1234567890",
  phoneCode: "+1",
  country: "IN",
  fiatAmount: "100",
  fiatTicker: "USD",
  cryptoTicker: "USDT",
  cryptoNetwork: "tron",
  redirectUrl: "",
  webhookUrl: "https://example.com/webhook",
  partnerContext: "ctx-123",
  customerOrderId: "order-12345",
};

// Sign the EXACT bytes you send on the wire.
const body = JSON.stringify(payload);
const timestamp = Date.now().toString();
const message = `${timestamp}.${body}`;
const signature = crypto
  .createHmac("sha256", SECRET)
  .update(message)
  .digest("hex");

const { data } = await axios.post(`${HOST}/v2/ramp-session`, body, {
  headers: {
    "Content-Type": "application/json",
    "x-api-key": API_KEY,
    "x-timestamp": timestamp,
    "x-signature": signature,
  },
});

// Redirect the customer to this URL.
console.log(data.data.redirectUrl); // https://sandbox-buy.transfi.com?sessionId=RS-...

import hashlib
import hmac
import json
import time

import requests

API_KEY = "YOUR_API_KEY"
SECRET = "YOUR_ORG_HMAC_SECRET"  # generate from the dashboard
HOST = "https://sandbox-ramp-server.transfi.com"

payload = {
    "view": "buy",
    "email": "[email protected]",
    "firstName": "John",
    "lastName": "Doe",
    "phone": "1234567890",
    "phoneCode": "+1",
    "country": "IN",
    "fiatAmount": "100",
    "fiatTicker": "USD",
    "cryptoTicker": "USDT",
    "cryptoNetwork": "tron",
    "redirectUrl": "",
    "webhookUrl": "https://example.com/webhook",
    "partnerContext": "ctx-123",
    "customerOrderId": "order-12345",
}

# Sign the EXACT bytes you send on the wire.
body = json.dumps(payload)
timestamp = str(int(time.time() * 1000))
message = f"{timestamp}.{body}"
signature = hmac.new(SECRET.encode(), message.encode(), hashlib.sha256).hexdigest()

response = requests.post(
    f"{HOST}/v2/ramp-session",
    data=body,
    headers={
        "Content-Type": "application/json",
        "x-api-key": API_KEY,
        "x-timestamp": timestamp,
        "x-signature": signature,
    },
)

# Redirect the customer to this URL.
redirect_url = response.json()["data"]["redirectUrl"]
print(redirect_url)  # https://sandbox-buy.transfi.com?sessionId=RS-...

{
  "info": {
    "name": "TransFi Ramp Session API",
    "description": "Create a Ramp Session (POST /v2/ramp-session) with automatic HMAC-SHA256 signature generation.\n\n**Quick Start:**\n1. Import this collection into Postman\n2. Click on 'TransFi Ramp Session API' collection → Variables tab\n3. Add your PUBLIC_KEY (x-api-key) and SECRET_KEY in the 'Current Value' column\n4. Send the request!\n\n**Signing scheme:**\n  message   = TIMESTAMP + \".\" + BODY\n  signature = HMAC_SHA256(message, SECRET_KEY) -> lowercase hex\n\nx-timestamp is bound INTO the signed message (so a captured signature can't be replayed under a new timestamp) AND checked for freshness (within 5 minutes of server time). The signature and timestamp are generated automatically by the pre-request script.",
    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
  },
  "variable": [
    {
      "key": "PUBLIC_KEY",
      "value": "",
      "type": "string"
    },
    {
      "key": "SECRET_KEY",
      "value": "",
      "type": "string"
    },
    {
      "key": "API_BASE_URL",
      "value": "https://sandbox-ramp-server.transfi.com",
      "type": "string"
    },
    {
      "key": "timestamp",
      "value": "",
      "type": "string"
    },
    {
      "key": "signature",
      "value": "",
      "type": "string"
    }
  ],
  "item": [
    {
      "name": "Create Ramp Session",
      "event": [
        {
          "listen": "prerequest",
          "script": {
            "exec": [
              "// Check if API keys are configured",
              "const publicKey = pm.collectionVariables.get(\"PUBLIC_KEY\");",
              "const secretKey = pm.collectionVariables.get(\"SECRET_KEY\");",
              "",
              "if (!publicKey || !secretKey || publicKey === \"\" || secretKey === \"\") {",
              "    console.error(\"❌ API Keys not configured!\");",
              "    console.log(\"📝 Please configure your API keys:\");",
              "    console.log(\"   1. Click on 'TransFi Ramp Session API' collection name\");",
              "    console.log(\"   2. Go to 'Variables' tab\");",
              "    console.log(\"   3. Add your PUBLIC_KEY and SECRET_KEY in 'Current Value' column\");",
              "    console.log(\"   4. Click 'Save' and try again\");",
              "    throw new Error(\"API keys not configured. Please add PUBLIC_KEY and SECRET_KEY in collection variables.\");",
              "}",
              "",
              "// Generate timestamp (ms epoch) — sent as x-timestamp AND bound into the signature.",
              "const timestamp = Date.now().toString();",
              "",
              "// Sign the EXACT raw body bytes that go on the wire. The server verifies over",
              "// req.rawBody (not a re-serialized copy), so do NOT JSON.parse + re-stringify here —",
              "// that would change whitespace/key order and cause a signature mismatch. The body",
              "// below contains no {{variables}}, so pm.request.body.raw equals what is sent.",
              "const requestBodyString = pm.request.body.raw;",
              "",
              "// Ramp-session signing message = TIMESTAMP + \".\" + BODY (raw bytes).",
              "const signingMessage = timestamp + \".\" + requestBodyString;",
              "",
              "// Generate HMAC SHA256 signature (lowercase hex).",
              "const signature = CryptoJS.HmacSHA256(signingMessage, secretKey).toString(CryptoJS.enc.Hex);",
              "",
              "// Set variables for use in request headers.",
              "pm.collectionVariables.set(\"timestamp\", timestamp);",
              "pm.collectionVariables.set(\"signature\", signature);",
              "",
              "console.log(\"✅ Signature generated successfully\");",
              "console.log(\"📅 Timestamp:\", timestamp);",
              "console.log(\"📦 Signed body:\", requestBodyString);",
              "console.log(\"🔐 Signature:\", signature);"
            ],
            "type": "text/javascript"
          }
        },
        {
          "listen": "test",
          "script": {
            "exec": [
              "// Parse response",
              "const response = pm.response.json();",
              "",
              "// Log response",
              "console.log(\"📬 Response:\", response);",
              "",
              "// Check if request was successful",
              "if (pm.response.code === 200 && response.success) {",
              "    console.log(\"✅ Ramp session created successfully!\");",
              "    console.log(\"🆔 Session ID:\", response.data.sessionId);",
              "    console.log(\"🔗 Widget URL:\", response.data.redirectUrl);",
              "    // Save for chaining into a follow-up resolve request if needed.",
              "    pm.collectionVariables.set(\"sessionId\", response.data.sessionId);",
              "} else {",
              "    console.log(\"❌ Request failed:\", response);",
              "}"
            ],
            "type": "text/javascript"
          }
        }
      ],
      "request": {
        "method": "POST",
        "header": [
          {
            "key": "Content-Type",
            "value": "application/json",
            "type": "text"
          },
          {
            "key": "x-api-key",
            "value": "{{PUBLIC_KEY}}",
            "type": "text"
          },
          {
            "key": "x-timestamp",
            "value": "{{timestamp}}",
            "type": "text"
          },
          {
            "key": "x-signature",
            "value": "{{signature}}",
            "type": "text"
          }
        ],
        "body": {
          "mode": "raw",
          "raw": "{\n  \"view\": \"buy\",\n  \"email\": \"[email protected]\",\n  \"firstName\": \"John\",\n  \"lastName\": \"Doe\",\n  \"phone\": \"1234567890\",\n  \"phoneCode\": \"+1\",\n  \"country\": \"IN\",\n  \"fiatAmount\": \"100\",\n  \"fiatTicker\": \"USD\",\n  \"cryptoTicker\": \"USDT\",\n  \"cryptoAmount\": \"\",\n  \"cryptoNetwork\": \"tron\",\n  \"walletAddress\": \"\",\n  \"paymentCode\": \"\",\n  \"quoteId\": \"\",\n  \"redirectUrl\": \"\",\n  \"webhookUrl\": \"https://example.com/webhook\",\n  \"partnerContext\": \"ctx-123\",\n  \"customerOrderId\": \"order-12345\"\n}",
          "options": {
            "raw": {
              "language": "json"
            }
          }
        },
        "url": {
          "raw": "{{API_BASE_URL}}/v2/ramp-session",
          "host": [
            "{{API_BASE_URL}}"
          ],
          "path": [
            "v2",
            "ramp-session"
          ]
        },
        "description": "Creates a merchant-initiated ramp session. Returns { sessionId, redirectUrl }. Open redirectUrl (…?sessionId=RS_...) in the widget to launch the prefilled flow.\n\n**The signature is automatically generated** by the pre-request script — you don't need to do anything.\n\nOnly these top-level fields are stored (SESSION_DETAIL_FIELDS): view, email, firstName, lastName, phone, phoneCode, country, fiatAmount, fiatTicker, cryptoTicker, cryptoAmount, cryptoNetwork, walletAddress, paymentCode, quoteId, sumsubKycToken, kycToken, merchantUrl, redirectUrl, webhookUrl, partnerContext, customerOrderId. Anything else is dropped. `view` is required so the widget knows which flow (buy/sell) to render."
      },
      "response": [
        {
          "name": "Successful Response",
          "originalRequest": {
            "method": "POST",
            "header": [
              { "key": "Content-Type", "value": "application/json" },
              { "key": "x-api-key", "value": "{{PUBLIC_KEY}}" },
              { "key": "x-timestamp", "value": "{{timestamp}}" },
              { "key": "x-signature", "value": "{{signature}}" }
            ],
            "body": {
              "mode": "raw",
              "raw": "{\n  \"view\": \"buy\",\n  \"email\": \"[email protected]\",\n  \"fiatAmount\": \"100\",\n  \"fiatTicker\": \"USD\",\n  \"cryptoTicker\": \"USDT\",\n  \"cryptoNetwork\": \"tron\"\n}"
            },
            "url": {
              "raw": "{{API_BASE_URL}}/v2/ramp-session",
              "host": ["{{API_BASE_URL}}"],
              "path": ["v2", "ramp-session"]
            }
          },
          "status": "OK",
          "code": 200,
          "_postman_previewlanguage": "json",
          "header": [{ "key": "Content-Type", "value": "application/json" }],
          "body": "{\"success\": true,\"data\": {\"sessionId\": \"RS_123456\",\"redirectUrl\": \"https://sandbox-buy.transfi.com?sessionId=RS_123456\"}}"
        }
      ]
    }
  ]
}

 {
    "success": true,
    "data": {
      "sessionId": "RS-550e8400-e29b-41d4-a716-446655440000",
      "redirectUrl": "https://sandbox-buy.transfi.com?sessionId=RS-550e8400-e29b-41d4-a716-446655440000"
    }
 }