@voxepay/checkout 0.5.0 → 0.5.2

package/src/api/client.ts

@@ -119,16 +119,21 @@ export class VoxePayApiClient {
         this.bearerToken = token;
     }
 
-    private async request<T>(endpoint: string, body: unknown): Promise<T> {
+    private async request<T>(endpoint: string, body: unknown, includeApiKey = true): Promise<T> {
         const url = `${this.baseUrl}${endpoint}`;
 
+        const headers: Record<string, string> = {
+            'Content-Type': 'application/json',
+            'Accept': 'application/json',
+        };
+
+        if (includeApiKey) {
+            headers['X-API-Key'] = this.apiKey;
+        }
+
         const response = await fetch(url, {
             method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                'X-API-Key': this.apiKey,
-                'Accept': 'application/json',
-            },
+            headers,
             body: JSON.stringify(body),
         });
 
@@ -146,18 +151,19 @@ export class VoxePayApiClient {
         return data as T;
     }
 
-    private async get<T>(endpoint: string, useBearerAuth = false): Promise<T> {
+    private async get<T>(endpoint: string, authType: 'api-key' | 'bearer' | 'none' = 'api-key'): Promise<T> {
         const url = `${this.baseUrl}${endpoint}`;
 
         const headers: Record<string, string> = {
             'Accept': 'application/json',
         };
 
-        if (useBearerAuth && this.bearerToken) {
+        if (authType === 'bearer' && this.bearerToken) {
             headers['Authorization'] = `Bearer ${this.bearerToken}`;
-        } else {
+        } else if (authType === 'api-key') {
             headers['X-API-Key'] = this.apiKey;
         }
+        // authType === 'none' → no auth header added
 
         const response = await fetch(url, {
             method: 'GET',
@@ -181,11 +187,15 @@ export class VoxePayApiClient {
 
     /**
      * Initiate a payment (card or bank transfer)
+     * BANK_TRANSFER uses the public endpoint — no X-API-Key required
+     * CARD uses X-API-Key authentication
      */
     async initiatePayment(data: InitiatePaymentRequest): Promise<InitiatePaymentResponse> {
+        const includeApiKey = data.paymentMethod !== 'BANK_TRANSFER';
         const response = await this.request<{ success?: boolean; data?: InitiatePaymentResponse } & InitiatePaymentResponse>(
             '/api/v1/payments/initiate',
-            data
+            data,
+            includeApiKey
         );
         // Handle both wrapped { success, data: {...} } and flat response formats
         if (response.data && typeof response.data === 'object' && 'transactionRef' in response.data) {
@@ -234,7 +244,7 @@ export class VoxePayApiClient {
 
         const response = await this.get<{ success: boolean; message: string; data: PaymentStatusResponse; errorCode?: string }>(
             endpoint,
-            false // Use X-API-Key (public endpoint doesn't need Bearer token)
+            'none' // Public endpoint — no auth required
         );
 
         if (!response.success) {

package/src/components/modal.ts

@@ -999,7 +999,13 @@ export class VoxePayModal {
       if (!this.apiClient || !this.state.transactionRef) return;
 
       try {
-        const statusData = await this.apiClient.getPaymentStatus(this.state.transactionRef);
+        const statusData = await this.apiClient.getPaymentStatus(
+          this.state.transactionRef,
+          {
+            simulateWebhook: this.options._sdkConfig?.simulateWebhook,
+            bypassKey: this.options._sdkConfig?.bypassKey,
+          }
+        );
         this.handlePollingStatusUpdate(statusData.status, statusData);
       } catch (error: any) {
         console.error('[VoxePay] Status polling error:', error);

package/src/types.ts

@@ -18,6 +18,16 @@ export interface VoxePayConfig {
     locale?: string;
     /** Custom CSS variables to override default theme */
     customStyles?: Partial<VoxePayTheme>;
+    /**
+     * Simulate webhook on payment status polling (useful for testing in dev/sandbox).
+     * When true, the API will trigger a simulated webhook on each status check.
+     */
+    simulateWebhook?: boolean;
+    /**
+     * Bypass key required when simulateWebhook is true.
+     * Only needed in sandbox/testing environments.
+     */
+    bypassKey?: string;
 }
 
 /**
@@ -83,6 +93,8 @@ export interface CheckoutOptions {
         apiKey: string;
         organizationId: string;
         baseUrl?: string;
+        simulateWebhook?: boolean;
+        bypassKey?: string;
     };
     /** Callback when payment succeeds */
     onSuccess: (result: PaymentResult) => void;

package/src/voxepay.ts

@@ -109,6 +109,8 @@ class VoxePaySDK {
                 apiKey: this.config!.apiKey,
                 organizationId: this.config!.organizationId,
                 baseUrl: this.config!.baseUrl,
+                simulateWebhook: this.config!.simulateWebhook,
+                bypassKey: this.config!.bypassKey,
             },
             onClose: () => {
                 this.currentModal = null;