Every rail. One integration.

const response = await fetch(
  'https://api.idealbox.org/v1/payment_intents',
  {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${process.env.IDEALBOX_SECRET_KEY}`,
      'Idempotency-Key': crypto.randomUUID(),
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      amount: '500000',        // minor units, as a string
      currency: 'XAF',
      country: 'CM',           // decides the corridor and the route
      methodType: 'MOBILE_MONEY',
      reference: 'order-4471',
      providerParams: { phoneNumber: '+237699000000' },
    }),
  },
);

const intent = await response.json();
// REQUIRES_CONFIRMATION. Nothing has been charged yet — confirm to start it.
console.log(intent.id, intent.status);

import { createHmac, timingSafeEqual } from 'node:crypto';

// The raw bytes, not the parsed body. Express's JSON parser re-serialises,
// and the re-serialised bytes will not match the HMAC we computed.
app.post('/webhooks/idealbox', express.raw({ type: 'application/json' }),
  (req, res) => {
    if (!verify(req.body, req.get('IdealBox-Signature'))) {
      return res.sendStatus(400);
    }

    const event = JSON.parse(req.body.toString('utf8'));

    // Delivery is at-least-once and can arrive out of order. Deduplicate on
    // the id, and compare against your own state rather than assuming order.
    if (alreadyProcessed(event.id)) return res.sendStatus(200);

    if (event.type === 'payment_intent.succeeded') {
      fulfil(event.data.object.reference);   // <- fulfil HERE
    }

    res.sendStatus(200);
  });