How to Integrate eSewa Payment Gateway in Node.js and Laravel (Official v2 ePay API)

# eSewa Sandbox Credentials
ESEWA_PRODUCT_CODE=EPAYTEST
ESEWA_SECRET_KEY=8gBm/:&EnhH.1/q
ESEWA_GATEWAY_URL=https://rc-epay.esewa.com.np/api/epay/main/v2/form
ESEWA_STATUS_CHECK_URL=https://rc-epay.esewa.com.np/api/epay/transaction/status/
APP_URL=http://localhost:3000

const crypto = require('crypto');

function generateEsewaSignature(secretKey, totalAmount, transactionUuid, productCode) {
  // Format must strictly match: total_amount=X,transaction_uuid=Y,product_code=Z
  const message = `total_amount=${totalAmount},transaction_uuid=${transactionUuid},product_code=${productCode}`;
  
  const hash = crypto
    .createHmac('sha256', secretKey)
    .update(message)
    .digest('base64');
    
  return hash;
}

module.exports = { generateEsewaSignature };

const express = require('express');
const router = express.Router();
const { v4: uuidv4 } = require('uuid');
const { generateEsewaSignature } = require('../esewaSignature');

router.post('/initiate-esewa', async (req, res) => {
  const { amount, productId } = req.body;
  const totalAmount = Number(amount).toFixed(2);
  const transactionUuid = `ORD-${Date.now()}-${uuidv4().substring(0, 8)}`;
  const productCode = process.env.ESEWA_PRODUCT_CODE;
  const secretKey = process.env.ESEWA_SECRET_KEY;

  const signature = generateEsewaSignature(secretKey, totalAmount, transactionUuid, productCode);

  const esewaPayload = {
    amount: totalAmount,
    tax_amount: "0",
    total_amount: totalAmount,
    transaction_uuid: transactionUuid,
    product_code: productCode,
    product_service_charge: "0",
    product_delivery_charge: "0",
    success_url: `${process.env.APP_URL}/api/payment/esewa/success`,
    failure_url: `${process.env.APP_URL}/api/payment/esewa/failure`,
    signed_field_names: "total_amount,transaction_uuid,product_code",
    signature: signature
  };

  // Return payload to frontend to submit to eSewa
  res.json({
    gatewayUrl: process.env.ESEWA_GATEWAY_URL,
    params: esewaPayload
  });
});

module.exports = router;

const axios = require('axios');

router.get('/esewa/success', async (req, res) => {
  try {
    const { data } = req.query;
    if (!data) return res.status(400).send('Missing eSewa callback payload');

    // Decode base64 payload
    const decodedBuffer = Buffer.from(data, 'base64');
    const callbackData = JSON.parse(decodedBuffer.toString('utf-8'));

    const { total_amount, transaction_uuid, product_code } = callbackData;

    // Verify with eSewa Server-to-Server Status API
    const verifyUrl = `${process.env.ESEWA_STATUS_CHECK_URL}?product_code=${product_code}&total_amount=${total_amount}&transaction_uuid=${transaction_uuid}`;
    
    const verifyRes = await axios.get(verifyUrl);

    if (verifyRes.data.status === 'COMPLETE') {
      // 1. Check if order was already marked completed (Idempotency)
      // 2. Verify total_amount matches the amount in your database
      // 3. Update order status to PAID
      console.log('Payment verified successfully:', verifyRes.data);
      return res.redirect(`/order-success?uuid=${transaction_uuid}`);
    } else {
      return res.redirect('/order-failed?reason=verification_failed');
    }
  } catch (err) {
    console.error('eSewa verification error:', err.message);
    return res.status(500).send('Transaction verification failed');
  }
});