Zenic Pay

AI agent setup

সব AI agent-এর জন্য একটি complete prompt

একটি prompt-এ checkout, database ও signed webhook setup। Brand Secret Key (zps_live_…) শুধু server Secrets-এ রাখুন, chat-এ নয়।

Lovable · Bolt · Replit · Codex · Cursor · Antigravity · VS Code AI

Universal Zenic Pay setup prompt

এই একটি prompt যেকোনো capable AI agent-কে দিন। Agent website-এর platform, framework, backend ও database নিজে detect করে native integration path বেছে নেবে।

✓ Existing website, backend ও database আগে inspect করবে
✓ Checkout, webhook, database migration ও fulfilment বানাবে
✓ Secret frontend/chat-এ প্রকাশ করবে না
✓ Test/build শেষে বাকি dashboard steps জানাবে

Prompt দেখুন

You are an AI software agent working inside an existing
e-commerce website. You may be running in Lovable, Bolt, Replit, Codex, Cursor,
Antigravity, VS Code AI or another capable builder/IDE. Integrate Zenic Pay completely
into this website and its real database. Do not stop at a UI mockup, sample button or guide.

ADAPT TO THIS ENVIRONMENT
1. Inspect before editing: identify the platform, framework/runtime, package manager,
authentication, products/cart/orders, database/ORM, migration system, server/backend
functions, deployment domain, success page, fulfilment logic and existing tests.
2. Choose the native implementation path automatically:
- Lovable/Bolt with Supabase: versioned SQL migration + secured Edge Function/backend.
- Replit or another hosted builder: its private Secrets, server runtime and database.
- Codex/Cursor/Antigravity/VS Code: follow repository instructions and existing architecture.
- WordPress/WooCommerce: install/configure the official Zenic Pay plugin instead of
duplicating its checkout and webhook implementation.
- Next.js/Node, Laravel/PHP, Django/FastAPI/Flask or custom backend: use that framework's
server routes, raw request-body API, ORM transactions and deployment conventions.
If the website is frontend-only, add/enable a supported backend first. Never put payment
secrets or order-verification authority in browser code.
3. Briefly state the detected stack and concrete files/functions/tables to change, then
implement every safe change available. Preserve unrelated work and existing order rules.

SECRETS AND DOMAIN
4. Ask the owner for ONLY server-only ZENIC_BRAND_KEY (the Brand Secret Key, zps_live_…)
through the platform Secrets UI. The public ZPK- Brand Key cannot connect webhooks.
Discover MERCHANT_ORIGIN from the deployed site. Provision the webhook signing secret
automatically using the connect contract below; do not ask for a second secret.
Runtime code generally cannot edit hosting environment variables: use an encrypted
backend credential store (e.g. Supabase Vault with server-only RPC access), shared by
setup and webhook verification. Never put credentials in publicly readable tables.
Never request secrets in chat, print/log them, commit values, or use NEXT_PUBLIC_/VITE_
variables. Tell the owner exactly where the platform's private Secrets UI is when needed.
5. MERCHANT_ORIGIN and success_url must use the published HTTPS storefront origin registered
in Zenic Pay Brands—not an editor/preview URL. Ask only if this origin is unavailable.

DATABASE, CHECKOUT AND WEBHOOK
6. Add a versioned database migration adapted to the existing database/ORM. Preserve current
data. Store payment attempts and processed webhook event IDs with unique constraints.
Customers may read only their own order status and can never mark an order paid.
7. Implement an authenticated server checkout endpoint. Load and authorize the order from
the database, use the immutable stored amount, lock/reuse an existing pending attempt,
call Zenic Pay, validate the response, persist all references, and only then return or
redirect to checkout_url. Do not blindly create another checkout after a timeout.
8. Deploy the HTTPS webhook route, then provision and confirm the Brand connection using
the contract below. Persist the secret before confirming, under a per-Brand setup lock.
Setup must be an admin-only operation, never triggered by unauthenticated visitors.
Implement a public HTTPS webhook endpoint. Read the exact raw body before JSON parsing,
verify the timestamp and HMAC in constant time, then atomically match order_id + saved
public_token + BDT + saved payable_minor. Deduplicate event IDs and fulfil each order once.
9. Connect Buy/Pay buttons, pending state and an authorized success page to the merchant's
database status. The redirect/query-string is never proof of payment. Support the site's
existing physical-stock or digital-delivery workflow idempotently.

VERIFY AND FINISH
10. Add focused tests with mocked Zenic responses for valid/invalid signatures, changed raw
body, expired/future timestamp, duplicate and concurrent events, wrong references,
currency/amount mismatch, fee-inclusive payable amount, rollback and fulfilment once.
11. Run the project's typecheck/lint/tests/build. Deploy database/backend/frontend only when
the environment authorizes it. Report changed files/migrations, tests run, rollback steps,
and any concrete hosting limitation. No manual webhook registration is needed after
successful automatic connection. Clearly separate mocked tests from a real
low-value end-to-end payment.
12. Ask only for an unavailable external account action or a business rule that materially
changes fulfilment. Otherwise continue until the integration is production-ready.

ZENIC PAY CONTRACT
- Docs: https://zenicpay.com/developer-docs
- Create checkout from the merchant backend only:
POST https://zenicpay.com/api/v1/checkout/sessions
Authorization: Bearer $ZENIC_BRAND_KEY
- Required JSON: amount_minor (integer paisa), immutable order_id, and success_url
on the exact HTTPS origin registered in Zenic Pay Brands.
- Persist response data.public_token, amount_minor, payable_minor, expires_at and
checkout_url against the merchant order before browser navigation.
- Provision automatically via POST https://zenicpay.com/api/v1/connect using the Brand
Key as Bearer authorization (backend only; do not forward browser Origin headers).
First deploy a webhook route on the registered storefront HTTPS origin.
POST {action:"connect",callback_url:"https://store.example/api/zenic-webhook",request_id:"persisted-random-uuid"}.
Save request_id durably before calling; retries use the same UUID. Pending responses
return data.connection_id and data.signing_secret. Store the secret in server-only
encrypted durable storage, then POST {action:"confirm",connection_id,signing_secret}.
Confirmation activates invoice.paid and invoice.cancelled. Show Connected only after
confirmation. Never ask the owner to configure a webhook or signing secret manually.
Same-request secret recovery lasts 10 minutes until confirmation; after confirmation
connect never returns the secret again. Retry pending setup after expiry to issue a
fresh pending secret. Do not overwrite an already connected secret. Disabled means
an owner disabled the endpoint: stop and report rather than silently re-enable it.
Backend helper: https://zenicpay.com/developer/zenic-connect.mjs (inspect before using).
Supply durable read/save adapters and a per-Brand setup lock; never use browser storage.
Supabase/hosted builders with a different backend domain must configure a same-origin
webhook proxy on the registered storefront. Forward the exact raw body and signature
headers unchanged. An arbitrary Supabase callback URL is not accepted by connect.
If hosting cannot serve/proxy a backend route, report that concrete hosting limitation.
- Verify the exact raw request body with HMAC-SHA256 of
timestamp + "." + rawBody using X-NextGen-Timestamp and X-NextGen-Signature.
- Accept timestamps within 300 seconds and signatures matching v1=<64 lowercase hex>.
- Fulfil only after the signed invoice.paid webhook. Browser redirect is not proof.
- Atomically match saved order_id + public_token + BDT + saved payable_minor, insert
unique event.id, mark the order paid once and enqueue idempotent fulfilment.
- Keep original order price immutable. Brand fees can make payable_minor larger than
amount_minor. Never match an order from customer phone or amount alone.

MERCHANT DATABASE
Inspect and preserve the existing order/customer/product schema. Add a versioned migration
for payment_attempts and processed webhook events. Store Zenic public_token, invoice id,
original amount, fee-inclusive payable amount, currency, expiry and status. Add unique
constraints for public_token/event id and one fulfilment per order. Use a transaction with
an order/payment-attempt row lock so concurrent or duplicate webhooks cannot deliver twice.
Do not store the Brand Key or webhook secret in database rows readable by customers.

CHECKOUT BODY
{
"amount_minor": 5000,
"order_id": "order-123",
"success_url": "https://store.example/payment-success",
"items": [
{
"name": "Gemini Pro",
"sku": "GEM-PRO",
"image_url": "https://store.example/images/gemini-pro.png",
"quantity": 1,
"unit_price_minor": 5000,
"validity": "30 days"
}
],
"subtotal_minor": 5000,
"discount_minor": 0,
"delivery_minor": 0,
"tax_minor": 0
}

PAID EVENT EXAMPLE
{
"id": "11111111-1111-4111-8111-111111111111",
"type": "invoice.paid",
"created_at": "2026-09-12T12:00:00Z",
"data": {
"invoice": {
"id": "22222222-2222-4222-8222-222222222222",
"invoice_number": "INV-EXAMPLE",
"order_id": "order-123",
"public_token": "33333333-3333-4333-8333-333333333333",
"amount_minor": 5000,
"currency": "BDT",
"status": "paid",
"paid_at": "2026-09-12T12:00:00Z",
"cancelled_at": null
}
}
}

SIGNED WEBHOOK → ATOMIC MERCHANT DATABASE TRANSACTION
1. Verify the raw-body HMAC and timestamp, then parse JSON with error handling.
2. webhook.test: return 200 without changing any order.
3. Handle invoice.paid and optionally invoice.cancelled; ignore other events.
4. Require event.id, data.invoice.id, order_id, public_token and currency.
Legacy references can be null. Never guess an order from amount/phone.
5. Find the payment attempt by BOTH your order_id and saved public_token.
Manually configured endpoints may receive events for other Brands in the
same account. Acknowledge unrelated events without fulfilling an order.
6. Begin transaction; lock the order/payment attempt. Verify BDT and compare
invoice.amount_minor with the SAVED checkout payable_minor, including fees.
Compare the saved original amount_minor with the immutable local order total.
7. Insert event.id under a unique constraint in this transaction. Duplicate:
return 200. Also prevent fulfilment twice by unique order/payment identity,
since multiple endpoints can have different event IDs for the same invoice.
8. invoice.paid requires status=paid and non-null paid_at. Mark paid once and
enqueue fulfilment in a transactional outbox. Commit before returning 200.
9. A worker delivers digital access or reserves physical stock idempotently.
Retrying the job must not send a second licence or reduce stock twice.
10. invoice.cancelled may cancel unpaid attempts only. Never downgrade a paid
or refunded order. Quarantine late-payment/state conflicts for review.
11. Temporary DB failure => 500 for retry; malformed/invalid signature => 4xx.
Log a safe event reference for mismatches, never secrets or customer SMS.
12. Authorize the success page by account ownership or a secure guest order
session. Poll YOUR stored order status if the webhook has not arrived.
A redirect or query-string order_id alone does not grant product access.

Official WordPress plugin when applicable:
https://zenicpay.com/downloads/zenic-pay-woocommerce-1.1.0.zip

Complete the integration now.

Prompt copy করার আগে Zenic Pay-এ Brand তৈরি করুন। Agent code বানানোর পরে আপনাকে private Secrets panel-এ ZENIC_BRAND_KEY ও ZENIC_WEBHOOK_SECRET বসাতে বলবে। Secret কখনো agent chat বা public environment variable-এ দেবেন না।

Technology অনুযায়ী setup process

WordPress, JavaScript, PHP, Python অথবা অন্য backend-এর জন্য আলাদা guide বেছে নিন।

WordPress / WooCommerce

WordPress-এ plugin upload permission ও WooCommerce প্রয়োজন। Plugin ZIP download → Plugins → Add New → Upload → Install → Activate।
WooCommerce → Settings → Payments → Zenic Pay → Manage। Store currency BDT রাখুন; website HTTPS হতে হবে।
Zenic Pay → Brands-এ store-এর exact HTTPS origin দিন। www, subdomain ও port-এর পার্থক্য দেখুন। Active trial/plan, receiving gateway ও paired SMS app প্রস্তুত করুন।
Brands → Secret Key থেকে zps_live_… Secret Key plugin settings-এ দিন, Enable করে Save করুন। Connected দেখালে webhook নিজে configure হয়েছে; আলাদা manual endpoint বানাতে হবে না।
Classic বা Block checkout থেকে order করুন। Verified payment-এর পরে WooCommerce নিজের নিয়মে Processing/Completed, stock ও download access পরিচালনা করে।
Pending হলে SMS app internet ও received SMS দেখুন; order Actions → Zenic Pay: Check payment status ব্যবহার করুন। Key rotate হলে নতুন key দিয়ে reconnect করুন।
Firewall-এ /?wc-api=zenic_pay HTTPS POST চলতে দিন; checkout, order pages ও webhook full-page cache থেকে বাদ দিন। Low-traffic store-এ cron চালু রাখুন। Refund টাকা ফেরত পাঠায় না—manual ব্যবস্থা লাগে।

Download WooCommerce plugin

Plugin webhook ও WooCommerce order completion নিজে manage করে। একই store-এর জন্য আবার custom webhook code বানাবেন না।

Merchant database connection

Zenic Pay merchant-এর database login নেয় না। Merchant backend checkout response ও signed webhook ব্যবহার করে নিজের order-এর সঙ্গে payment reference সংরক্ষণ করে।

1 · Checkout

নিজের database থেকে authorized order ও amount নিয়ে Zenic Pay session তৈরি করুন।

2 · Save attempt

public_token, original amount, payable amount, expiry ও checkout URL order-এর সঙ্গে save করুন।

3 · Webhook

Signed invoice.paid event একই database transaction-এ match, dedupe ও order paid করবে।

Reference payment database schema

-- Adapt names/types to the merchant's existing database and migration system.
-- Keep the existing orders table as the source of truth for price and ownership.
create table payment_attempts (
  id uuid primary key,
  order_id varchar(80) not null references orders(id),
  zenic_public_token uuid not null unique,
  original_amount_minor bigint not null check (original_amount_minor >= 100),
  payable_minor bigint not null check (payable_minor >= original_amount_minor),
  currency char(3) not null default 'BDT' check (currency = 'BDT'),
  checkout_url text not null,
  expires_at timestamp with time zone not null,
  status varchar(16) not null default 'pending',
  zenic_invoice_id uuid unique,
  paid_at timestamp with time zone,
  fulfilled_at timestamp with time zone,
  created_at timestamp with time zone not null default current_timestamp
);

create table zenic_webhook_events (
  event_id uuid primary key,
  event_type varchar(40) not null,
  invoice_id uuid,
  received_at timestamp with time zone not null default current_timestamp,
  processed_at timestamp with time zone
);

-- Also enforce one successful fulfilment per order in the merchant's own schema.
-- PostgreSQL example:
create unique index one_paid_attempt_per_order
  on payment_attempts(order_id) where status = 'paid';
-- For MySQL/SQLite, enforce the equivalent through a unique payment/fulfilment
-- record and a locked database transaction.

Schema-টি reference। Agent merchant-এর existing database/ORM অনুযায়ী migration বানাবে। WooCommerce plugin WordPress order metadata ব্যবহার করে, তাই WordPress-এ এই SQL manually চালানোর প্রয়োজন নেই।

API & webhook reference

Server থেকে POST /api/v1/checkout/sessions call করুন। Required: integer amount_minor, immutable order_id এবং Brand-এর exact HTTPS origin-এর success_url। ৳50 = 5000 paisa।

Checkout request JSON

{
  "amount_minor": 5000,
  "order_id": "order-123",
  "success_url": "https://store.example/payment-success",
  "items": [
    {
      "name": "Gemini Pro",
      "sku": "GEM-PRO",
      "image_url": "https://store.example/images/gemini-pro.png",
      "quantity": 1,
      "unit_price_minor": 5000,
      "validity": "30 days"
    }
  ],
  "subtotal_minor": 5000,
  "discount_minor": 0,
  "delivery_minor": 0,
  "tax_minor": 0
}

invoice.paid event

{
  "id": "11111111-1111-4111-8111-111111111111",
  "type": "invoice.paid",
  "created_at": "2026-09-12T12:00:00Z",
  "data": {
    "invoice": {
      "id": "22222222-2222-4222-8222-222222222222",
      "invoice_number": "INV-EXAMPLE",
      "order_id": "order-123",
      "public_token": "33333333-3333-4333-8333-333333333333",
      "amount_minor": 5000,
      "currency": "BDT",
      "status": "paid",
      "paid_at": "2026-09-12T12:00:00Z",
      "cancelled_at": null
    }
  }
}

Atomic order-processing contract

SIGNED WEBHOOK → ATOMIC MERCHANT DATABASE TRANSACTION
1. Verify the raw-body HMAC and timestamp, then parse JSON with error handling.
2. webhook.test: return 200 without changing any order.
3. Handle invoice.paid and optionally invoice.cancelled; ignore other events.
4. Require event.id, data.invoice.id, order_id, public_token and currency.
   Legacy references can be null. Never guess an order from amount/phone.
5. Find the payment attempt by BOTH your order_id and saved public_token.
   Manually configured endpoints may receive events for other Brands in the
   same account. Acknowledge unrelated events without fulfilling an order.
6. Begin transaction; lock the order/payment attempt. Verify BDT and compare
   invoice.amount_minor with the SAVED checkout payable_minor, including fees.
   Compare the saved original amount_minor with the immutable local order total.
7. Insert event.id under a unique constraint in this transaction. Duplicate:
   return 200. Also prevent fulfilment twice by unique order/payment identity,
   since multiple endpoints can have different event IDs for the same invoice.
8. invoice.paid requires status=paid and non-null paid_at. Mark paid once and
   enqueue fulfilment in a transactional outbox. Commit before returning 200.
9. A worker delivers digital access or reserves physical stock idempotently.
   Retrying the job must not send a second licence or reduce stock twice.
10. invoice.cancelled may cancel unpaid attempts only. Never downgrade a paid
    or refunded order. Quarantine late-payment/state conflicts for review.
11. Temporary DB failure => 500 for retry; malformed/invalid signature => 4xx.
    Log a safe event reference for mismatches, never secrets or customer SMS.
12. Authorize the success page by account ownership or a secure guest order
    session. Poll YOUR stored order status if the webhook has not arrived.
    A redirect or query-string order_id alone does not grant product access.

Download Postman collection

API live। Postman collection-এ secret খালি থাকে। Demo কোনো API payment তৈরি করে না।

Build. Connect. Get paid.

সব AI agent-এর জন্য একটি complete prompt

Universal Zenic Pay setup prompt

Technology অনুযায়ী setup process

WordPress / WooCommerce

Merchant database connection

1 · Checkout

2 · Save attempt

3 · Webhook

API & webhook reference

Checkout demo

Build. Connect. Get paid.

সব AI agent-এর জন্য একটি complete prompt

Universal Zenic Pay setup prompt

Technology অনুযায়ী setup process

WordPress / WooCommerce

Merchant database connection

1 · Checkout

2 · Save attempt

3 · Webhook

API & webhook reference

Checkout demo