Create a hosted checkout

#!/usr/bin/env bash
set -euo pipefail

: "${SKINLOOP_API_BASE_URL:?Set SKINLOOP_API_BASE_URL}"
: "${SKINLOOP_API_KEY:?Set SKINLOOP_API_KEY}"

merchant_order_id="order_123"
customer_email="[email protected]"
idempotency_key="skinloop:checkout:v1:order_123:1"
response_file="$(mktemp)"
trap 'rm -f "$response_file"' EXIT

# jq encodes every value as JSON; no variable is interpolated into JSON text.
payload="$(jq -n \
  --arg merchantOrderId "$merchant_order_id" \
  --arg customerEmail "$customer_email" \
  --arg successUrl "https://merchant.example/paid" \
  --arg cancelUrl "https://merchant.example/canceled" \
  '{
    merchantOrderId: $merchantOrderId,
    customerEmail: $customerEmail,
    amount: {value: 4999, currency: "USD"},
    allowedGames: ["cs2"],
    successUrl: $successUrl,
    cancelUrl: $cancelUrl,
    metadata: {cart: "cart_123"},
    expiresInSeconds: 3600
  }')"

set +e
http_status="$(curl --silent --show-error \
  --connect-timeout 5 \
  --max-time 30 \
  --output "$response_file" \
  --write-out "%{http_code}" \
  "$SKINLOOP_API_BASE_URL/v1/merchant-api/checkouts" \
  -H "Authorization: Bearer $SKINLOOP_API_KEY" \
  -H "Idempotency-Key: $idempotency_key" \
  -H "Content-Type: application/json" \
  --data-binary "$payload")"
curl_exit=$?
set -e

if (( curl_exit != 0 )); then
  echo "Transport failure; checkout result is unknown." >&2
  echo "Retry this exact payload with the same idempotency key." >&2
  exit 75
fi

if [[ "$http_status" != 2* ]]; then
  error_code="$(jq -r '.error.code // "unknown_error"' "$response_file" 2>/dev/null)"
  request_id="$(jq -r '.error.request_id // "missing"' "$response_file" 2>/dev/null)"
  echo "Skinloop rejected the request: HTTP $http_status, code $error_code, request $request_id" >&2
  exit 1
fi

jq '{id, merchantOrderId, hostedUrl, status, expiresAt}' "$response_file"