Add payments to your app
in minutes, not weeks

app.post('/api/paycan/token', requireAuth, async (req, res) => {
  const response = await fetch(`${process.env.PAYCAN_URL}/api/admin/users/sync`, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'X-API-Key': process.env.PAYCAN_API_SECRET, // secret key: backend only!
    },
    body: JSON.stringify({
      user_id: req.session.userId, // from YOUR session — not the request body
      user: { name: req.user.name, email: req.user.email },
    }),
  });

  const { token } = await response.json();
  res.json({ token }); // return ONLY the token to the browser
});

import { auth } from '@/lib/auth'; // your auth helper (NextAuth, Clerk, …)

export async function POST() {
  const session = await auth();
  if (!session?.user) {
    return Response.json({ error: 'Unauthenticated' }, { status: 401 });
  }

  const response = await fetch(`${process.env.PAYCAN_URL}/api/admin/users/sync`, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'X-API-Key': process.env.PAYCAN_API_SECRET, // secret key: backend only!
    },
    body: JSON.stringify({
      user_id: session.user.id, // from YOUR session — not the request body
      user: { name: session.user.name, email: session.user.email },
    }),
  });

  const { token } = await response.json();
  return Response.json({ token }); // return ONLY the token to the browser
}

// routes/api.php
Route::post('/paycan/token', [PayCanController::class, 'getToken'])
    ->middleware('auth:sanctum');

// app/Http/Controllers/PayCanController.php
public function getToken(Request $request)
{
    $user = $request->user(); // from auth middleware — not the request body

    $response = Http::withHeaders([
        'X-API-Key' => config('services.paycan.secret'), // secret key: backend only!
    ])->post(config('services.paycan.url').'/api/admin/users/sync', [
        'user_id' => $user->id,
        'user' => ['name' => $user->name, 'email' => $user->email],
    ]);

    // return ONLY the token to the browser
    return response()->json(['token' => $response->json('token')]);
}

@login_required
def paycan_token(request):
    user = request.user  # from the auth decorator — not the request body

    response = requests.post(
        f"{os.environ['PAYCAN_URL']}/api/admin/users/sync",
        headers={'X-API-Key': os.environ['PAYCAN_API_SECRET']},  # backend only!
        json={
            'user_id': str(user.id),
            'user': {'name': user.get_full_name(), 'email': user.email},
        },
    )

    # return ONLY the token to the browser
    return JsonResponse({'token': response.json()['token']})