​

Dodo Payments

​

Dodo Payments Setup

​

1. Account and dashboard

1. Sign up at Dodo Payments and open the Dashboard.
2. Create products and set prices (e.g. one product per platform: Website, Web Application, Android, iOS) or use a single product and pass metadata for platform.

​

2. Environment variables

DODO_API_KEY=your_dodo_api_key
DODO_WEBHOOK_SECRET=your_webhook_secret
DODO_PRODUCT_ID=your_default_product_id
NEXT_PUBLIC_APP_URL=https://your-domain

• DODO_API_KEY — Used for Create Checkout and any other server-side Dodo API calls. Required for POST /api/dodo/create-checkout.
• DODO_WEBHOOK_SECRET — Used to verify x-dodo-signature (or dodo-signature) on POST /api/dodo/webhook. If unset, verification is skipped (unsafe in production).
• DODO_PRODUCT_ID — Default product when the selected platform is not in the internal PRODUCT_MAP in create-checkout.
• NEXT_PUBLIC_APP_URL — Base URL for return_url (e.g. https://your-domain or http://localhost:3000). Must match how users reach the app.

​

3. Product mapping (create-checkout)

​

Card Payment Flow

​

1. Create checkout

• sessionId required; platform defaults to Website.
• Builds Dodo payload:
  • product_cart: [{ product_id, quantity: 1 }]
  • return_url: {NEXT_PUBLIC_APP_URL}/payment/success?sessionId=...&platform=...
  • metadata: { session_id: sessionId, platform }
  • customization.redirect_immediately: true
• Calls https://live.dodopayments.com/checkouts with Authorization: Bearer DODO_API_KEY.
• Response: { status: 'success', checkout_url, payment_link } (both same URL). On error: { status: 'error', error, debug? }.

​

2. User pays

• Frontend redirects the user to checkout_url.
• User completes card/UPI on Dodo’s page.
• Dodo redirects to return_url (success or failure).

​

3. Webhook (payment.succeeded)

• Dodo sends POST to your Webhook URL (e.g. https://your-domain/api/dodo/webhook) with payment.succeeded (or payment_succeeded, payment.completed).
• Payload includes metadata.session_id and metadata.platform; data.payment_id or data.id as the Dodo payment ID.
• Scriptonia updates Workflow: paymentMethod: 'dodo', dodoPaymentId, currentStage: 'payment_processing', selectedPlatform from metadata.
• The user can then go to Execute; POST /api/execute does not require transactionSignature when dodoPaymentId / paymentMethod: 'dodo' are set.

​

4. Confirm payment (optional)

• Used when the client needs to persist payment context (e.g. after redirect from return_url) before the webhook has run or if the webhook is delayed.
• Ensures a Workflow exists for sessionId (creates if missing).
• Updates: currentStage: 'payment_processing', selectedPlatform (default Web Application), paymentDetails: { amountScript: UNIFIED_PRICE_SCRIPT, paymentMethod: 'dodo', dodoPaymentId }.
• Response: { status: 'success', message } or { status: 'error', error }.

​

5. Execute

• User opens Execution with the same sessionId (and optionally platform in the URL).
• POST /api/execute with { sessionId } (no transactionSignature for Dodo).
• Server loads workflow; sees paymentMethod: 'dodo' and/or dodoPaymentId and skips Solana verifyTransaction. Execution runs as for Solana-paid sessions.

​

Webhook Configuration

​

URL

https://your-domain/api/dodo/webhook

​

Signature verification

• Header: x-dodo-signature or dodo-signature (single string; arrays are rejected).
• Secret: DODO_WEBHOOK_SECRET.
• Algorithm: HMAC-SHA256 of the raw body (bytes as received), hex-encoded. The handler uses crypto.timingSafeEqual to compare with the header.
• Body parsing: bodyParser: false for /api/dodo/webhook so the raw body can be used for HMAC. The same raw string is then JSON.parse’d for type/data/metadata.

​

Handled events

​

Testing

​

1. Local webhook

• Run a tunnel: ngrok http 3000 (or your dev port).
• In Dodo, set webhook URL to https://<ngrok-host>/api/dodo/webhook.
• Use Dodo test cards (see Dodo docs) and trigger a payment. Check:
  • Your server logs for Dodo webhook received: payment.succeeded and any errors.
  • DB: Workflow row for sessionId has paymentMethod: 'dodo', dodoPaymentId, selectedPlatform.

​

2. Create checkout

curl -X POST http://localhost:3000/api/dodo/create-checkout \
  -H "Content-Type: application/json" \
  -d '{"sessionId":"test-session-1","platform":"Web Application"}'

​

3. Confirm payment (without webhook)

curl -X POST http://localhost:3000/api/dodo/confirm-payment \
  -H "Content-Type: application/json" \
  -d '{"sessionId":"test-session-1","platform":"Web Application","paymentId":"pay_xxx"}'

​

4. End-to-end

1. Idea → Intent → Platform (choose any; Dodo product mapping may vary).
2. On Payment, choose “Buy with Card” (or equivalent) → create-checkout → redirect to Dodo.
3. Pay with a test card.
4. Redirect to return_url (/payment/success?sessionId=...&platform=...). Optionally call confirm-payment from the success page.
5. When the webhook has run (or after confirm-payment), go to Execute and run. Execution should complete without transactionSignature.

​

5. Webhook signature