Customers pay from their bank. The money goes straight to yours.

// POST /api/checkout (your backend)
app.post("/api/checkout", async (req, res) => {
  const order = await db.getOrder(req.body.orderId);
  const r = await fetch("https://pay.zyropay.net/api/merchant/payment/requests", {
    method: "POST",
    headers: {
      "x-api-key": process.env.ZYROPAY_API_KEY,
      "Idempotency-Key": order.id,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      amount: { minorUnits: order.minorUnits, currency: "GBP" },
      reference: order.id,
    }),
  });
  const payment = await r.json();
  res.json({ id: payment.id });   // only the id goes to the browser
});

<script src="https://pay.zyropay.net/pay.js"></script>

<pay-button
  create-url="/api/checkout"
  amount="49.99" currency="GBP" ref="ORDER-1001"
  resume>
</pay-button>

<script>
  document.querySelector("pay-button")
    .addEventListener("payment:settled", (e) => showThankYou(e.detail.paymentId));
</script>

// The only place an order is marked paid
app.post("/webhooks/zyropay", express.raw({ type: "application/json" }), async (req, res) => {
  if (!verify(req.body, req.get("x-openpay-signature"), process.env.ZYROPAY_WEBHOOK_SECRET))
    return res.sendStatus(401);

  const evt = JSON.parse(req.body.toString("utf8"));
  res.sendStatus(200);                 // acknowledge fast, then work

  if (evt.event === "payment.completed")
    await db.fulfilOnce(evt.paymentId, evt.reference);   // idempotent
});

curl -X POST https://pay.zyropay.net/api/merchant/payment/requests \
  -H "x-api-key: sk_live_xxx" \
  -H "Idempotency-Key: ORDER-1001" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": { "minorUnits": 4999, "currency": "GBP" },
    "reference": "ORDER-1001"
  }'