const crypto = require('crypto');

const apiKey = 'sk_live_abc123def456...';
const apiSecret = 'ss_live_xyz789...';
const timestamp = Math.floor(Date.now() / 1000);

const payload = {
  walletCode: '12345678',
  currency: 'KES',
  phoneNumber: '254712345678',
  amount: 100,
  accountReference: 'ORDER-001',
};

// Build signature string
const signatureString = `${apiKey}${timestamp}${payload.walletCode}${payload.currency}${payload.phoneNumber}${payload.amount}${payload.accountReference}`;

// Generate HMAC-SHA256 signature
const signature = crypto
  .createHmac('sha256', apiSecret)
  .update(signatureString)
  .digest('hex');

const response = await fetch('https://www.sparkpesa.io/api/v1/payments/request-payment', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Authorization': `Bearer ${apiKey}`,
    'X-Signature': signature,
    'X-Timestamp': timestamp.toString(),
  },
  body: JSON.stringify(payload),
});

{
  "sourceWalletId": "550e8400-e29b-41d4-a716-446655440000",
  "destinationWalletId": "660f9511-f30c-52e5-b827-557766551111",
  "amount": 5000,
  "description": "Funds reallocation to Uganda ops",
  "reference": "TRF-REALLOC-001"
}

curl -X GET "https://www.sparkpesa.io/api/v1/wallets/550e8400-e29b-.../transactions?page=1&limit=10&status=completed" \
  -H "Authorization: Bearer $API_KEY" \
  -H "X-Signature: $SIGNATURE" \
  -H "X-Timestamp: $TIMESTAMP"

{
  "walletCode": "12345678",
  "phoneNumber": "254712345678",
  "amount": 500,
  "currency": "KES",
  "accountReference": "INV-2026-001",
  "transactionDesc": "Payment for Invoice #001",
  "callbackUrl": "https://yourapp.com/webhooks/sparkpesa"
}

{
  "walletCode": "12345678",
  "phoneNumber": "254712345678",
  "amount": 5000,
  "currency": "KES",
  "commandId": "SalaryPayment",
  "description": "March 2026 salary",
  "callbackUrl": "https://yourapp.com/webhooks/sparkpesa"
}

{
  "walletCode": "12345678",
  "tillNumber": "518518",
  "amount": 2500,
  "currency": "KES",
  "accountReference": "PO-2026-042",
  "requesterPhone": "254712345678",
  "remarks": "Office supplies"
}

{
  "walletCode": "12345678",
  "paybillNumber": "320320",
  "accountNumber": "12345678901",
  "amount": 3500,
  "currency": "KES",
  "requesterPhone": "254712345678",
  "remarks": "KPLC electricity"
}

{
  "walletCode": "87654321",
  "phoneNumber": "256712345678",
  "amount": 50000,
  "currency": "UGX",
  "accountReference": "ORDER-UG-001",
  "transactionDesc": "Payment for groceries"
}

{
  "walletCode": "87654321",
  "phoneNumber": "256712345678",
  "amount": 100000,
  "currency": "UGX",
  "description": "Freelance payment for March"
}

const crypto = require('crypto');

app.post('/webhooks/sparkpesa', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-sparkpesa-signature'];
  const rawBody = req.body.toString();

  const expected = crypto
    .createHmac('sha256', process.env.WEBHOOK_SECRET)
    .update(rawBody).digest('hex');

  if (!crypto.timingSafeEqual(
    Buffer.from(signature, 'hex'),
    Buffer.from(expected, 'hex')
  )) {
    return res.status(401).send('Invalid signature');
  }

  const event = JSON.parse(rawBody);

  switch (event.event) {
    case 'payment.completed':
      // Credit user, fulfill order
      break;
    case 'payout.completed':
      // Payout confirmed
      break;
  }

  res.status(200).json({ received: true });
});

import crypto from 'crypto';

class SparkPesaClient {
  private apiKey: string;
  private apiSecret: string;
  private baseUrl: string;

  constructor(apiKey: string, apiSecret: string, baseUrl = 'https://www.sparkpesa.io/api/v1') {
    this.apiKey = apiKey;
    this.apiSecret = apiSecret;
    this.baseUrl = baseUrl;
  }

  private sign(payload: Record<string, any>) {
    const timestamp = Math.floor(Date.now() / 1000);
    const sigString = [
      this.apiKey, timestamp,
      payload.walletCode ?? '', payload.currency ?? '',
      payload.phoneNumber ?? '', payload.amount ?? '',
      payload.accountReference ?? '',
    ].join('');
    const signature = crypto.createHmac('sha256', this.apiSecret)
      .update(sigString).digest('hex');
    return { signature, timestamp };
  }

  private async post(endpoint: string, payload: Record<string, any>) {
    const { signature, timestamp } = this.sign(payload);
    const res = await fetch(`${this.baseUrl}${endpoint}`, {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        Authorization: `Bearer ${this.apiKey}`,
        'X-Signature': signature,
        'X-Timestamp': timestamp.toString(),
      },
      body: JSON.stringify(payload),
    });
    const data = await res.json();
    if (!res.ok) throw new Error(data.error || 'Request failed');
    return data;
  }

  // Collect M-Pesa payment
  async requestPayment(walletCode: string, phone: string, amount: number, ref: string) {
    return this.post('/payments/request-payment', {
      walletCode, phoneNumber: phone, amount, currency: 'KES', accountReference: ref,
    });
  }

  // Send M-Pesa B2C payout
  async sendPayment(walletCode: string, phone: string, amount: number) {
    return this.post('/payments/send-payment', {
      walletCode, phoneNumber: phone, amount, currency: 'KES', commandId: 'BusinessPayment',
    });
  }

  // Pay to Till Number
  async buyGoods(walletCode: string, till: string, amount: number, ref: string, phone: string) {
    return this.post('/payments/buy-goods', {
      walletCode, tillNumber: till, amount, currency: 'KES', accountReference: ref, requesterPhone: phone,
    });
  }

  // Pay to PayBill Number
  async payBill(walletCode: string, paybill: string, acc: string, amount: number, phone: string) {
    return this.post('/payments/paybill', {
      walletCode, paybillNumber: paybill, accountNumber: acc, amount, currency: 'KES', requesterPhone: phone,
    });
  }
}

// Usage
const client = new SparkPesaClient('sk_live_...', 'ss_live_...');
const result = await client.requestPayment('12345678', '254712345678', 500, 'ORDER-001');
console.log('Transaction:', result.transactionId);

{
  "mcpServers": {
    "sparkpesa": {
      "command": "npx",
      "args": ["-y", "@sparkpesa/mcp-server"],
      "env": {
        "SPARKPESA_API_KEY": "sk_live_your_api_key",
        "SPARKPESA_API_SECRET": "ss_live_your_api_secret"
      }
    }
  }
}