API Pix em Go

// xflow/xflow.go
package xflow

import (
	"bytes"
	"encoding/json"
	"fmt"
	"io"
	"net/http"
	"os"
	"strconv"
	"time"
)

const base = "https://app.xflowpayments.com/api/v1"

var httpClient = &http.Client{Timeout: 30 * time.Second}

type Erro struct {
	Status     int           `json:"-"`
	Code       string        `json:"error"`
	Message    string        `json:"message"`
	RequestID  string        `json:"request_id"`
	RetryAfter time.Duration `json:"-"`
}

func (e *Erro) Error() string {
	return fmt.Sprintf("%d %s: %s (%s)", e.Status, e.Code, e.Message, e.RequestID)
}

func Chamar(metodo, caminho string, corpo any, idempotencyKey string, saida any) error {
	var leitor io.Reader
	if corpo != nil {
		b, err := json.Marshal(corpo)
		if err != nil {
			return err
		}
		leitor = bytes.NewReader(b)
	}
	req, err := http.NewRequest(metodo, base+caminho, leitor)
	if err != nil {
		return err
	}
	req.SetBasicAuth(os.Getenv("XFLOW_PUBLIC_KEY"), os.Getenv("XFLOW_SECRET_KEY"))
	if corpo != nil {
		req.Header.Set("Content-Type", "application/json")
	}
	if idempotencyKey != "" {
		req.Header.Set("Idempotency-Key", idempotencyKey)
	}

	resp, err := httpClient.Do(req)
	if err != nil {
		return err
	}
	defer resp.Body.Close()
	dados, err := io.ReadAll(resp.Body)
	if err != nil {
		return err
	}
	if resp.StatusCode >= 400 {
		e := &Erro{Status: resp.StatusCode}
		_ = json.Unmarshal(dados, e)
		if s, err := strconv.Atoi(resp.Header.Get("Retry-After")); err == nil {
			e.RetryAfter = time.Duration(s) * time.Second
		}
		return e
	}
	if saida == nil || len(dados) == 0 {
		return nil
	}
	return json.Unmarshal(dados, saida)
}

// xflow/tipos.go (package xflow)
type Customer struct {
	Name     string `json:"name"`
	Email    string `json:"email"`
	Document string `json:"document"` // CPF ou CNPJ, só dígitos
}

type NovaCobranca struct {
	AmountCents       int64    `json:"amountCents"`
	Customer          Customer `json:"customer"`
	Description       string   `json:"description,omitempty"`
	ExternalReference string   `json:"external_reference,omitempty"`
}

type Cobranca struct {
	ID                string `json:"id"`
	Livemode          bool   `json:"livemode"`
	Status            string `json:"status"`
	AmountCents       int64  `json:"amountCents"`
	ExternalReference string `json:"external_reference"`
	Pix               struct {
		CopyPaste    string `json:"copyPaste"`
		QRCodeBase64 string `json:"qrCodeBase64"`
		EndToEnd     string `json:"endToEnd"`
	} `json:"pix"`
}

pedidoID := "1234"
var cobranca xflow.Cobranca
err := xflow.Chamar("POST", "/charges", xflow.NovaCobranca{
	AmountCents:       1990, // R$ 19,90
	Customer:          xflow.Customer{Name: "Cliente Exemplo", Email: "cliente@exemplo.com", Document: "00000000000"},
	Description:       "Pedido #" + pedidoID,
	ExternalReference: "pedido-" + pedidoID,
}, "pedido-"+pedidoID, &cobranca)
if err != nil {
	log.Fatal(err)
}
fmt.Println(cobranca.ID, cobranca.Status) // clx... pending

var pagina = template.Must(template.New("pix").Parse(`
<img src="{{.QRCode}}" alt="QR Code Pix" width="240" height="240">
<textarea readonly>{{.CopiaECola}}</textarea>`))

pagina.Execute(w, map[string]any{
	"QRCode":     template.URL(cobranca.Pix.QRCodeBase64),
	"CopiaECola": cobranca.Pix.CopyPaste,
})

var segredo = []byte(os.Getenv("XFLOW_WEBHOOK_SECRET"))

func assinaturaValida(corpo []byte, header string) bool {
	mac := hmac.New(sha256.New, segredo)
	mac.Write(corpo)
	esperado := "sha256=" + hex.EncodeToString(mac.Sum(nil))
	return hmac.Equal([]byte(esperado), []byte(header))
}

type Evento struct {
	Event string `json:"event"`
	Data  struct {
		Livemode          bool   `json:"livemode"`
		ExternalReference string `json:"external_reference"`
		Pix               struct {
			EndToEnd string `json:"endToEnd"`
		} `json:"pix"`
	} `json:"data"`
}

func webhook(w http.ResponseWriter, r *http.Request) {
	corpo, err := io.ReadAll(http.MaxBytesReader(w, r.Body, 1<<20))
	if err != nil {
		http.Error(w, "corpo inválido", http.StatusBadRequest)
		return
	}
	if !assinaturaValida(corpo, r.Header.Get("X-Webhook-Signature")) {
		w.WriteHeader(http.StatusUnauthorized)
		return
	}
	var ev Evento
	if err := json.Unmarshal(corpo, &ev); err != nil {
		w.WriteHeader(http.StatusBadRequest)
		return
	}
	if ev.Event == "transaction.paid" && ev.Data.Livemode {
		if err := darBaixaNoPedido(r.Context(), ev.Data.ExternalReference, ev.Data.Pix.EndToEnd); err != nil {
			w.WriteHeader(http.StatusInternalServerError) // sem 2xx, a entrega é reenviada
			return
		}
	}
	w.WriteHeader(http.StatusOK)
}

func main() {
	mux := http.NewServeMux()
	mux.HandleFunc("POST /webhooks/xflow", webhook)
	log.Fatal(http.ListenAndServe(":8080", mux))
}

var teste xflow.Cobranca
err := xflow.Chamar("POST", "/charges", xflow.NovaCobranca{
	AmountCents: 1990,
	Customer:    xflow.Customer{Name: "Cliente", Email: "c@exemplo.com", Document: "00000000000"},
}, "", &teste)
if err == nil {
	err = xflow.Chamar("POST", "/test/charges/"+teste.ID+"/pay", nil, "", nil)
}
var paga xflow.Cobranca
if err == nil {
	err = xflow.Chamar("GET", "/charges/"+teste.ID, nil, "", &paga)
}
fmt.Println(paga.Status, paga.Livemode, err) // paid false <nil>

func comRetentativa(chamada func() error) error {
	for tentativa := 1; ; tentativa++ {
		err := chamada()
		var e *xflow.Erro
		if err == nil || !errors.As(err, &e) || e.Status != http.StatusTooManyRequests || tentativa == 3 {
			return err
		}
		espera := e.RetryAfter
		if espera == 0 {
			espera = time.Duration(1<<tentativa) * time.Second
		}
		time.Sleep(espera)
	}
}