The software, the integration, and where the payment gateway sits

import { LmsPay } from '@lmspay/sdk';

const pay = new LmsPay({
  baseUrl: process.env.LMSPAY_URL,      // https://lmspay.online
  apiKey:  process.env.LMSPAY_API_KEY,  // issued per platform, stored hashed by us
});

// At the end of a billing period, the platform asks for an invoice.
const invoice = await pay.invoices.create({
  externalRef: period.id,               // the platform's own id for the period
  periodKey:   period.key,              // '2026-10'
  amountMinor: period.feeAmountMinor,   // 4500000 = LKR 45,000.00
  currency:    'LKR',
  description: `Platform fee — ${period.key}`,
});

// Send the operator here. Nothing is charged until they act.
return invoice.checkoutUrl;

import { verifyWebhook, SIGNATURE_HEADER } from '@lmspay/sdk';

export async function POST(request: Request) {
  const rawBody = await request.text();          // RAW — before any JSON parsing

  const ok = verifyWebhook({
    rawBody,
    header: request.headers.get(SIGNATURE_HEADER),
    secret: process.env.LMSPAY_WEBHOOK_SECRET,
  });

  if (!ok) return new Response('bad signature', { status: 400 });

  const { event, data } = JSON.parse(rawBody);
  if (event === 'invoice.paid') await markPeriodPaid(data.invoice.externalRef);

  return new Response('ok');
}