FonePay

@payments-sdk/fonepay implements FonePay Dynamic QR checkout and transaction status verification.

Install and configure

npm install @payments-sdk/payments @payments-sdk/fonepay

import { fonepay } from '@payments-sdk/fonepay';

const provider = fonepay({
  merchantCode: process.env.FONEPAY_MERCHANT_CODE!,
  secretKey: process.env.FONEPAY_SECRET_KEY!,
  username: process.env.FONEPAY_USERNAME!,
  password: process.env.FONEPAY_PASSWORD!,
});

The package uses FonePay's development client API hosts by default. If a merchant contract supplies different hosts or paths, configure both endpoints explicitly:

const provider = fonepay({
  merchantCode,
  secretKey,
  username,
  password,
  endpoints: {
    generateQr: 'https://merchant.example/qr',
    status: 'https://merchant.example/status',
  },
});

Confirm endpoint hosts and signing fields against the merchant contract before using production credentials.

Dynamic QR checkout

const result = await payments.checkout({
  provider: 'fonepay',
  amount: 1500_00,
  currency: 'NPR',
  reference: 'order_123',
  providerOptions: {
    remarks1: 'Order 123',
    remarks2: 'Online checkout',
  },
});

if (
  result.action.type === 'qr' &&
  result.action.format === 'payload'
) {
  // Give result.action.data to the application's QR renderer.
  return result.action.data;
}

Amounts are integer paisa. The provider sends FonePay a two-decimal rupee amount. The normalized action contains the QR payload; the SDK does not render QR images or manage a QR WebSocket connection.

The provider result data can include the generated PRN, QR message, and an optional third-party QR WebSocket URL. Persist the reference/PRN in the application if later reconciliation needs it.

Verification

The application reference is sent as FonePay's PRN:

const verified = await payments.verify({
  provider: 'fonepay',
  reference: 'order_123',
  providerOptions: {},
});

Documented FonePay statuses are normalized to the shared status model. A missing or unrecognized status is unknown, never succeeded.

Capabilities and security

FonePay implements checkout and verify. It does not implement browser returns, webhooks, refunds, or cancellations. Keep the secret key, username, and password on the server, and do not log signed request bodies.