Pay by bank in three steps.

const API = "https://pay.zyropay.net";

app.post("/api/checkout", express.json(), async (req, res) => {
  const orderId = req.body.orderId;
  const order = await db.getOrder(orderId);   // never trust a browser price
  const r = await fetch(`${API}/api/merchant/payment/requests`, {
    method: "POST",
    headers: {
      "x-api-key": process.env.ZYROPAY_API_KEY,
      "Idempotency-Key": orderId,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      amount: { minorUnits: order.minorUnits, currency: order.currency },
      reference: orderId,
    }),
  });
  if (!r.ok) return res.status(502).json({ error: "create_failed" });
  const payment = await r.json();
  res.json({ id: payment.id });
});

<script src="https://pay.zyropay.net/pay.js"></script>
<pay-button create-url="/api/checkout"
  amount="49.99" currency="GBP" ref="ORDER-1001" resume>
</pay-button>

import { createHmac, timingSafeEqual } from "node:crypto";

app.post("/webhooks/zyropay", express.raw({ type: "application/json" }), async (req, res) => {
  if (!verify(req.body, req.get("x-openpay-signature"), process.env.ZYROPAY_WEBHOOK_SECRET))
    return res.sendStatus(401);
  const evt = JSON.parse(req.body.toString("utf8"));
  res.sendStatus(200);
  if (evt.event === "payment.completed") await db.fulfilOnce(evt.paymentId, evt.reference);
  else if (evt.event === "payment.rejected" || evt.event === "payment.failed") await db.markUnpaid(evt.reference);
});

function verify(rawBody, header, secret) {
  const expected = createHmac("sha256", secret).update(rawBody).digest("hex");
  const got = (header || "").replace(/^sha256=/, "");
  const a = Buffer.from(got), b = Buffer.from(expected);
  return a.length === b.length && timingSafeEqual(a, b);
}