Game Developer Integration Guide

// MyGameStore.cpp — runs on your dedicated server / authority
#include "Http.h"
#include "Json.h"

void UMyGameStore::RequestCheckoutSession(const FString& UserEmail, double UsdAmount,
                                          TFunction<void(FString)> OnUrl)
{
    TSharedPtr<FJsonObject> Body = MakeShareable(new FJsonObject);
    Body->SetStringField("player_email", UserEmail);
    Body->SetStringField("usd_amount", FString::Printf(TEXT("%.2f"), UsdAmount));
    Body->SetStringField("success_url", "https://yourgame.com/store/success");
    Body->SetStringField("cancel_url",  "https://yourgame.com/store/cancel");

    FString BodyStr;
    auto Writer = TJsonWriterFactory<>::Create(&BodyStr);
    FJsonSerializer::Serialize(Body.ToSharedRef(), Writer);

    auto Request = FHttpModule::Get().CreateRequest();
    Request->SetURL(TEXT("https://invo.network/api/checkout/sessions"));
    Request->SetVerb(TEXT("POST"));
    Request->SetHeader(TEXT("X-Game-Secret-Key"), GetEnvSecretKey()); // server-side env var
    Request->SetHeader(TEXT("Content-Type"), TEXT("application/json"));
    Request->SetContentAsString(BodyStr);

    Request->OnProcessRequestComplete().BindLambda(
        [OnUrl](FHttpRequestPtr, FHttpResponsePtr Response, bool bOk) {
            if (!bOk || !Response.IsValid()) { OnUrl(FString()); return; }
            TSharedPtr<FJsonObject> Json;
            auto Reader = TJsonReaderFactory<>::Create(Response->GetContentAsString());
            if (FJsonSerializer::Deserialize(Reader, Json)) {
                OnUrl(Json->GetStringField("checkout_url"));
            } else {
                OnUrl(FString());
            }
        });
    Request->ProcessRequest();
}

// SwiftUI / UIKit
import WebKit

class CheckoutVC: UIViewController, WKScriptMessageHandler {
    private var webView: WKWebView!

    override func viewDidLoad() {
        super.viewDidLoad()
        let config = WKWebViewConfiguration()
        // postMessage from the hosted page comes through this handler
        config.userContentController.add(self, name: "INVO_CHECKOUT")
        webView = WKWebView(frame: view.bounds, configuration: config)
        view.addSubview(webView)

        Task {
            // Ask YOUR backend for a session URL
            let url = try await fetchCheckoutUrlFromBackend()
            self.webView.load(URLRequest(url: url))
        }
    }

    func userContentController(_ controller: WKUserContentController,
                               didReceive message: WKScriptMessage) {
        // The hosted page does:
        //   window.webkit?.messageHandlers?.INVO_CHECKOUT?.postMessage({...})
        guard let body = message.body as? [String: Any],
              let type = body["type"] as? String,
              type == "INVO_CHECKOUT_COMPLETE",
              let data = body["data"] as? [String: Any] else { return }

        if let status = data["status"] as? String, status == "success" {
            // Optimistic UI refresh. Authoritative source: your webhook handler.
            self.dismiss(animated: true)
        }
    }
}

// Kotlin
class CheckoutActivity : AppCompatActivity() {
    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)
        val webView = WebView(this).apply {
            settings.javaScriptEnabled = true
            addJavascriptInterface(InvoBridge { result ->
                runOnUiThread {
                    // result is the parsed JSON object posted by the hosted page
                    finish()
                }
            }, "InvoBridge")
        }
        setContentView(webView)

        lifecycleScope.launch {
            // Ask YOUR backend for the checkout URL
            val url = fetchCheckoutUrlFromBackend()
            webView.loadUrl(url)
        }
    }
}

// JS interface — the hosted page calls window.InvoBridge.onComplete(JSON.stringify(data))
class InvoBridge(private val onResult: (Map<String, Any?>) -> Unit) {
    @JavascriptInterface
    fun onComplete(json: String) {
        val parsed = JSONObject(json)
        // Forward to your activity / view-model
    }
}

// Node.js / Express webhook handler
import crypto from 'crypto';

const SIGNING_SECRET = process.env.INVO_WEBHOOK_SECRET;
const TOLERANCE_SECONDS = 300;

app.post('/webhooks/invo', express.raw({ type: 'application/json' }), (req, res) => {
  const sigHeader = req.header('X-Invo-Signature') || '';
  const parts = Object.fromEntries(sigHeader.split(',').map(p => p.split('=', 2)));
  if (!parts.t || !parts.v1) return res.status(400).end();

  if (Math.abs(Math.floor(Date.now()/1000) - parseInt(parts.t, 10)) > TOLERANCE_SECONDS) {
    return res.status(400).end();
  }

  const expected = crypto.createHmac('sha256', SIGNING_SECRET)
    .update(`${parts.t}.`).update(req.body).digest('hex');

  if (!crypto.timingSafeEqual(Buffer.from(parts.v1), Buffer.from(expected))) {
    return res.status(400).end();
  }

  const eventId = req.header('X-Invo-Event-Id');
  if (await alreadyProcessed(eventId)) {
    return res.status(200).json({ received: true, duplicate: true });
  }

  const event = JSON.parse(req.body.toString('utf8'));
  await handleEvent(event); // your business logic
  res.status(200).json({ received: true });
});