Secure handler
One-Line Verified Webhook & Callback Handler
Dedicated endpoint handling 3D Secure returns and provider notifications. Validates signatures in constant time and locks administrative actions behind authorization guards.
createPaymentHandler()
- 1
Bank callback
POST /api/payment/callback Signature check
timingSafeEqual(hash)- 3
Order match
invoice_id === order_id - 4
Your code
onPaymentSuccess()
Bad signature → 400, your code never runs
Why it matters
Why this earns its place in your stack
Constant-Time Signature Check
Timing-safe string comparisons thwarting cryptographic side-channel attacks.
1-Line Next.js App Router
Drop into app/api/pay/route.ts and export { GET, POST } in seconds.
Authorize Hook Protection
High-risk refund and void operations reject automatically without an explicit authorize guard.
Multi-Framework Runtime
Seamless compatibility with Express, Fastify, Hono, and native Web Standards.
Simple, readable, direct.
Without Better Payment
Manual hashing formulas per gateway, exposed refund endpoints, and CSRF vulnerabilities.
With Better Payment
Battle-tested, timing-safe handler configured in a single declarative block.
TypeScript
// app/api/pay/route.ts (Next.js App Router)
import { createPaymentHandler } from "better-payment/next";
import { payment } from "@/lib/payment";
export const { GET, POST } = createPaymentHandler({
payment,
// Protect sensitive endpoints
async authorize(req, action) {
if (action === "refund" || action === "cancel") {
const session = await getAdminSession(req);
return session?.role === "ADMIN";
}
return true;
},
async onPaymentSuccess(result) {
await db.orders.update({ id: result.orderId, status: "PAID" });
}
});