L'API de paiement
de la Guinée.

# Authentification HMAC-SHA256, idempotente, sandbox
curl -X POST https://sandbox-api.saalapay.com/api/v1/payments/initiate \
  -H "X-SP-CLIENT-ID: pk_sandbox_..." \
  -H "X-SP-SIGNATURE: $SIGNATURE" \
  -H "X-SP-TIMESTAMP: $TIMESTAMP" \
  -H "Idempotency-Key: $UUID" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 500000,
    "currency": "GNF",
    "method": "MOBILE_MONEY",
    "provider": "orange_money",
    "customer_phone": "+224611223344"
  }'

// Pas de SDK obligatoire — fetch standard suffit
const res = await fetch('https://sandbox-api.saalapay.com/api/v1/payments/initiate', {
  method: 'POST',
  headers: {
    'X-SP-CLIENT-ID': process.env.SP_CLIENT_ID,
    'X-SP-SIGNATURE': signature,
    'X-SP-TIMESTAMP': timestamp,
    'Idempotency-Key': crypto.randomUUID(),
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    amount: 500000,
    currency: 'GNF',
    method: 'MOBILE_MONEY',
    provider: 'orange_money',
  }),
});

const { id, status, redirect_url } = await res.json();

// Avec n'importe quel client HTTP (cURL, Guzzle, fetch...)
$ch = curl_init('https://sandbox-api.saalapay.com/api/v1/payments/initiate');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'X-SP-CLIENT-ID: ' . $clientId,
        'X-SP-SIGNATURE: ' . $signature,
        'X-SP-TIMESTAMP: ' . $timestamp,
        'Idempotency-Key: ' . bin2hex(random_bytes(16)),
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'amount'    => 500000,
        'currency'  => 'GNF',
        'method'    => 'MOBILE_MONEY',
        'provider'  => 'orange_money',
    ]),
]);
$payment = json_decode(curl_exec($ch), true);