@voxepay/checkout 0.5.1 → 0.5.3

package/src/api/client.ts

@@ -119,16 +119,21 @@ export class VoxePayApiClient {
         this.bearerToken = token;
     }
 
-    private async request<T>(endpoint: string, body: unknown): Promise<T> {
+    private async request<T>(endpoint: string, body: unknown, includeApiKey = true): Promise<T> {
         const url = `${this.baseUrl}${endpoint}`;
 
+        const headers: Record<string, string> = {
+            'Content-Type': 'application/json',
+            'Accept': 'application/json',
+        };
+
+        if (includeApiKey) {
+            headers['X-API-Key'] = this.apiKey;
+        }
+
         const response = await fetch(url, {
             method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                'X-API-Key': this.apiKey,
-                'Accept': 'application/json',
-            },
+            headers,
             body: JSON.stringify(body),
         });
 
@@ -146,18 +151,19 @@ export class VoxePayApiClient {
         return data as T;
     }
 
-    private async get<T>(endpoint: string, useBearerAuth = false): Promise<T> {
+    private async get<T>(endpoint: string, authType: 'api-key' | 'bearer' | 'none' = 'api-key'): Promise<T> {
         const url = `${this.baseUrl}${endpoint}`;
 
         const headers: Record<string, string> = {
             'Accept': 'application/json',
         };
 
-        if (useBearerAuth && this.bearerToken) {
+        if (authType === 'bearer' && this.bearerToken) {
             headers['Authorization'] = `Bearer ${this.bearerToken}`;
-        } else {
+        } else if (authType === 'api-key') {
             headers['X-API-Key'] = this.apiKey;
         }
+        // authType === 'none' → no auth header added
 
         const response = await fetch(url, {
             method: 'GET',
@@ -181,11 +187,15 @@ export class VoxePayApiClient {
 
     /**
      * Initiate a payment (card or bank transfer)
+     * BANK_TRANSFER uses the public endpoint — no X-API-Key required
+     * CARD uses X-API-Key authentication
      */
     async initiatePayment(data: InitiatePaymentRequest): Promise<InitiatePaymentResponse> {
+        const includeApiKey = data.paymentMethod !== 'BANK_TRANSFER';
         const response = await this.request<{ success?: boolean; data?: InitiatePaymentResponse } & InitiatePaymentResponse>(
             '/api/v1/payments/initiate',
-            data
+            data,
+            includeApiKey
         );
         // Handle both wrapped { success, data: {...} } and flat response formats
         if (response.data && typeof response.data === 'object' && 'transactionRef' in response.data) {
@@ -234,7 +244,7 @@ export class VoxePayApiClient {
 
         const response = await this.get<{ success: boolean; message: string; data: PaymentStatusResponse; errorCode?: string }>(
             endpoint,
-            false // Use X-API-Key (public endpoint doesn't need Bearer token)
+            'none' // Public endpoint — no auth required
         );
 
         if (!response.success) {