Hesap SDK

# 0. Token → {"accessToken":"sdkt_…","tokenType":"Bearer","expiresIn":3600}
TOKEN=$(curl -s -X POST https://sdk.hesap.uz/v1/auth/token \
  -H "Content-Type: application/json" \
  -d "{\"appId\":\"$HESAP_APP_ID\",\"appSecret\":\"$HESAP_APP_SECRET\"}" | jq -r .accessToken)

# 1. Mijoz
curl -X POST https://sdk.hesap.uz/v1/clients \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"in":"31234567890123","firstName":"Aziz","lastName":"Karimov","phone":"998901234567","passport":"AA1234567"}'

# 2. Shartnoma → {"id":"9b3f7c21-..."}
curl -X POST https://sdk.hesap.uz/v1/contracts \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"templateId":"0f0c1f2e-8a41-4d02-9d55-2f7c1b6f9a30","buyerIn":"31234567890123","price":12500000,"currency":"UZS"}'

# 3. Imzolash sessiyasi → {"url":"https://sdk.hesap.uz/sign/…"}
curl -X POST https://sdk.hesap.uz/v1/contracts/9b3f7c21-.../sign-sessions \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"signerIn":"31234567890123","parentOrigin":"https://shop.example.uz"}'

const BASE = "https://sdk.hesap.uz/v1";
let token = null, tokenExp = 0;

// Token 1 soat amal qiladi — keshlaymiz va tugashidan bir daqiqa oldin yangilaymiz.
async function getToken() {
  if (token && Date.now() < tokenExp - 60_000) return token;
  const r = await fetch(`${BASE}/auth/token`, {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ appId: process.env.HESAP_APP_ID, appSecret: process.env.HESAP_APP_SECRET }),
  });
  if (!r.ok) throw new Error((await r.json()).message);
  const t = await r.json();
  token = t.accessToken; tokenExp = Date.now() + t.expiresIn * 1000;
  return token;
}

const api = async (path, body) => {
  const r = await fetch(BASE + path, {
    method: "POST",
    headers: { Authorization: `Bearer ${await getToken()}`, "Content-Type": "application/json" },
    body: JSON.stringify(body),
  });
  if (!r.ok) throw new Error((await r.json()).message);
  return r.json();
};

await api("/clients", { in: "31234567890123", firstName: "Aziz", lastName: "Karimov",
                     phone: "998901234567", passport: "AA1234567" });

const { id } = await api("/contracts", {
  templateId: "0f0c1f2e-8a41-4d02-9d55-2f7c1b6f9a30",
  buyerIn: "31234567890123", price: 12500000, currency: "UZS",
});

const session = await api(`/contracts/${id}/sign-sessions`, {
  signerIn: "31234567890123", parentOrigin: "https://shop.example.uz",
});
// session.url — sahifangizdagi iframe'ga bering

<iframe
  id="hesap-sign"
  src="https://sdk.hesap.uz/sign/Qx7fK2…"
  allow="camera"
  style="width:100%; max-width:520px; height:640px; border:0">
</iframe>

window.addEventListener("message", (event) => {
  if (event.origin !== "https://sdk.hesap.uz") return;
  const msg = event.data;
  if (!msg || msg.source !== "hesap-sdk") return;

  switch (msg.type) {
    case "READY":    /* oyna yuklandi; msg.method */ break;
    case "RESIZE":   document.getElementById("hesap-sign").style.height = msg.height + "px"; break;
    case "SIGNED":   /* imzolandi — serverda tekshiring */ break;
    case "REJECTED": /* mijoz rad etdi */ break;
    case "ERROR":    /* sessiya yaroqsiz; msg.message */ break;
  }
});

{
  "event": "CONTRACT_SIGNED",
  "contractId": "9b3f7c21-55ad-4e10-8b6e-0c4a91f2d773",
  "contractNumber": "260918-0042",
  "status": "CREATED",
  "templateId": "0f0c1f2e-8a41-4d02-9d55-2f7c1b6f9a30",
  "buyerIn": "31234567890123",
  "sellerIn": "301234567",
  "creatorIn": "301234567",
  "actorIn": "31234567890123",
  "amount": 12500000,
  "currency": "UZS",
  "occurredAt": "2026-09-18T11:06:41Z"
}

const crypto = require("crypto");

function verify(rawBody, signature, secret) {
  const expected = "sha256=" + crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(signature || "");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

function verify($rawBody, $signature, $secret) {
    $expected = 'sha256=' . hash_hmac('sha256', $rawBody, $secret);
    return hash_equals($expected, $signature ?? '');
}

{
  "code": 403,
  "status": "403 Forbidden",
  "message": "Bu shablon ilovaga ruxsat etilmagan",
  "timestamp": "18 sentabr 2026 y., 16:04:02 UTC+5"
}