# Veracity Pay – Walley Checkout

Base URL `https://walley.pay.veracity.se` in place of https://api.uat.walleydev.com – Walley's own paths follow (also at `https://pay.veracity.se/walley`). Auth: OAuth2 client credentials at `/oauth2/v2.0/token` (client_id = your account id, client_secret = your secret key; any scope), then `Authorization: Bearer <access_token>`. The legacy SharedKey header works too (username = account id, shared key = secret key).

## 1. Environment
```
WALLEY_BASE_URL=https://walley.pay.veracity.se
WALLEY_CLIENT_ID=acct_…
WALLEY_CLIENT_SECRET=vp_sk_test_…
WALLEY_STORE_ID=<your MID>
WALLEY_WEBHOOK_SECRET=…        # HMAC key for Walley-Signature, if you use webhooks
```

## 2. Initialize a checkout
`POST /checkouts` with storeId, countryCode "SE", reference, notificationUri (`{checkout.id}` is replaced), redirectPageUri (`{checkout.publictoken}`), merchantTermsUri and cart.items [{id, description, unitPrice (SEK, decimal), quantity, vat (percent)}]. The answer is `{"id":…,"data":{"privateId","publicToken","expiresAt","paymentUri"},"error":null}`.

## 3. Show the checkout
`<script src="https://walley.pay.veracity.se/walley-checkout-loader.js" data-token="<publicToken>" data-lang="sv-SE"></script>` – the iframe is inserted where the script is (or in data-container-id). The event `walleyCheckoutPurchaseCompleted` fires on the page, and the top window goes to redirectPageUri.

## 4. After the purchase
Walley GETs notificationUri; then read `GET /checkouts/{privateId}`: status PurchaseCompleted, purchase.result (Preliminary for invoice, Completed for card and Swish) and order.orderId. Webhooks (register an endpoint with `veracity_format=walley`): walley:order:created/captured/refunded/canceled, signed `Walley-Signature = hex(HMAC_SHA256(key, "v0;" + Walley-Timestamp + ";" + body))`.

## 5. Order management
`GET /manage/orders/{orderId}`, `POST /manage/orders/{orderId}/capture` ({amount}), `/refund` ({amount, description}), `/cancel`, `/extend` → 202 with Location. Without a browser: `POST https://pay.veracity.se/v1/test_helpers/checkout/sessions/{privateId}/complete` with `outcome` and `payment_method_type`.

## Going live and deviations from the original

Original documentation: [Walley Checkout API](https://dev.walleypay.com/docs/checkout/endpoints), [Walley Management API](https://dev.walleypay.com/docs/manage/orders/get), [Walley webhooks](https://dev.walleypay.com/docs/webhooks/receiving).

To go live, change only the host and the keys: UAT: `https://api.uat.walleydev.com`; Production: `https://api.walleypay.com`. Replace client_id, client_secret, storeId and the webhook key with those from Walley Merchant Hub, and the loader script's host with Walley's.

Deviations in Veracity Pay:
- Business errors answer HTTP 409 with error.code 900; Walley uses HTTP status 900, which cannot be sent from here.
- validationUri and callback (ValidateOrder, PaymentFailed) are not called. reauthorize, customer tokens, B2B and pay links are missing.
- Order operations are applied at once (the answer is still 202 with Location), and orders do not expire on their own.
- The loader script is Veracity's: the same data attributes and events (walleyCheckout…/collectorCheckout…), but only PurchaseCompleted is sent.