// Votre API route: POST /api/payments/create
const response = await fetch('https://api.sahelpay.ml/v1/payments', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${SAHELPAY_SECRET_KEY}`,
    'Content-Type': 'application/json',
    'X-Idempotency-Key': `order-${orderId}`, // obligatoire
  },
  body: JSON.stringify({
    amount: 5000,
    currency: 'XOF',
    payment_method: 'ORANGE_MONEY', // seul moyen de paiement
    country: 'ML',
    customer_phone: '+22370123456',
    client_reference: orderId,
    return_url: `${APP_URL}/checkout/return?order=${orderId}`,
    hosted_checkout: true,
    metadata: { order_id: orderId }
  })
});

const { data } = await response.json();
// Retourner data.redirect_url au frontend

// Frontend
window.location.href = redirectUrl;

// POST /api/webhooks/sahelpay
export async function POST(request) {
  const rawBody = await request.text();
  const signature = request.headers.get('x-sahelpay-signature');

  // TOUJOURS vérifier la signature sur le corps brut
  if (!verifySignature(rawBody, signature, WEBHOOK_SECRET)) {
    return Response.json({ error: 'Invalid signature' }, { status: 401 });
  }

  const { id: eventId, event, data } = JSON.parse(rawBody);

  // Idempotence : un même événement peut être livré plusieurs fois
  if (await db.webhookEvents.exists(eventId)) {
    return Response.json({ received: true, already_processed: true });
  }

  switch (event) {
    case 'payment.success':
      await db.orders.markPaid(data.client_reference, { payment_id: data.id });
      break;
    case 'payment.failed':
    case 'payment.expired':
      // Laisser la commande payable : le client peut réessayer
      break;
  }

  await db.webhookEvents.save(eventId);
  return Response.json({ received: true });
}

headers: {
  'X-Idempotency-Key': `order-${orderId}`
}