Khalti ePayment v2 API in Node.js/Express: Initiate, Verify, and Handle Callbacks

const express = require("express");
const router = express.Router();

const KHALTI_API_URL = "https://dev.khalti.com/api/v2/epayment";
const KHALTI_SECRET_KEY = process.env.KHALTI_SECRET_KEY || "key test_secret_key_xxxx";

/**
 * 1. INITIATE PAYMENT
 */
router.post("/initiate", async (req, res) => {
  try {
    const { orderId, amount, customerInfo } = req.body;

    // Amount must be in Paisa (1 NPR = 100 Paisa). Minimum is 1000 Paisa (NPR 10)
    const amountInPaisa = Math.round(Number(amount) * 100);

    const payload = {
      return_url: "http://localhost:5000/api/payment/khalti/callback",
      website_url: "http://localhost:3000",
      amount: amountInPaisa,
      purchase_order_id: orderId || `ORDER_${Date.now()}`,
      purchase_order_name: "Web Development Course Enrollment",
      customer_info: customerInfo || {
        name: "Test Developer",
        email: "developer@example.com",
        phone: "9800000000"
      }
    };

    const response = await fetch(`${KHALTI_API_URL}/initiate/`, {
      method: "POST",
      headers: {
        "Authorization": `Key ${KHALTI_SECRET_KEY}`,
        "Content-Type": "application/json"
      },
      body: JSON.stringify(payload)
    });

    const data = await response.json();

    if (!response.ok) {
      return res.status(response.status).json({ error: data });
    }

    // Save data.pidx with your database order record here
    return res.json({
      success: true,
      pidx: data.pidx,
      payment_url: data.payment_url
    });
  } catch (error) {
    console.error("Khalti initiation error:", error);
    return res.status(500).json({ error: "Internal server error" });
  }
});

/**
 * 2. HANDLE CALLBACK & VERIFY
 */
router.get("/callback", async (req, res) => {
  try {
    const { pidx, status, transaction_id, message } = req.query;

    if (!pidx) {
      return res.redirect("http://localhost:3000/checkout?status=failed&reason=no_pidx");
    }

    // Verify status server-side using Khalti lookup endpoint
    const lookupResponse = await fetch(`${KHALTI_API_URL}/lookup/`, {
      method: "POST",
      headers: {
        "Authorization": `Key ${KHALTI_SECRET_KEY}`,
        "Content-Type": "application/json"
      },
      body: JSON.stringify({ pidx })
    });

    const verificationData = await lookupResponse.json();

    if (lookupResponse.ok && verificationData.status === "Completed") {
      // Mark order as PAID in MongoDB / PostgreSQL
      // await Order.updateOne({ pidx }, { status: 'PAID', transactionId: transaction_id });

      return res.redirect(`http://localhost:3000/order-success?pidx=${pidx}&txn=${transaction_id}`);
    }

    return res.redirect(`http://localhost:3000/checkout?status=failed&message=${encodeURIComponent(message || "Payment not completed")}`);
  } catch (error) {
    console.error("Khalti callback error:", error);
    return res.redirect("http://localhost:3000/checkout?status=error");
  }
});

module.exports = router;