API Withdrawal / Disbursement — TROLOOPAY

import crypto from "crypto";

// ── Credentials (variables d'environnement recommandées) ──────────
const WAPI_KEY      = process.env.TROLOOPAY_WAPI_KEY      ?? "VOTRE_WAPI_KEY";
const WAPI_SECRET   = process.env.TROLOOPAY_WAPI_SECRET   ?? "VOTRE_WAPI_SECRET";
const WAPI_PASSWORD = process.env.TROLOOPAY_PASSWORD      ?? "VOTRE_MOT_DE_PASSE";

// ── Paramètres du retrait ─────────────────────────────────────────
const SENDER_USER_ID  = "email_ou_phone_du_titulaire_de_la_cle";
const RECIPIENT_PHONE = "229xxxxxxxx";
const AMOUNT          = "1000";
const PAYMENT_METHOD  = "MTN-MOMO-BENIN";
const OPERATION_TYPE  = "USER_OPERATION";
const CALLBACK_URL    = ""; // optionnel

// ── Chiffrement AES-256-CBC ───────────────────────────────────────
function encryptAes256(data, key) {
  const iv     = crypto.randomBytes(16);
  const cipher = crypto.createCipheriv("aes-256-cbc",
                   Buffer.from(key.padEnd(32).slice(0, 32)), iv);
  const enc    = Buffer.concat([cipher.update(data, "utf8"), cipher.final()]);
  return Buffer.from(enc.toString("base64") + "::" + iv.toString("base64")).toString("base64");
}

// ── Étape 1 : Générer le token ────────────────────────────────────
const authHeader = "Basic " + Buffer.from(
  WAPI_KEY + ":" + encryptAes256(WAPI_SECRET, WAPI_PASSWORD)
).toString("base64");

const tokenRes = await fetch("https://troloo.com/generate-withdrawal-token", {
  method: "POST",
  headers: {
    "Authorization": authHeader,
    "Ehopay-Withdrawal-Type": OPERATION_TYPE,
    "Accept": "application/json",
    "Content-Length": "0",
  },
  body: "",
});
const tokenData = await tokenRes.json();
if (!tokenData.access_token) {
  console.error("Erreur token:", tokenData); process.exit(1);
}
console.log(`✓ Token généré (expire dans ${tokenData.expires_in}s)`);

// ── Étape 2 : Initier le retrait ──────────────────────────────────
const referenceId = crypto.randomUUID();
const headers = {
  "Authorization": `Bearer ${tokenData.access_token}`,
  "Operation-Type": OPERATION_TYPE,
  "Reference-Id": referenceId,
  "Content-Type": "application/json",
  "Accept": "application/json",
  ...(CALLBACK_URL ? { "Custom-Callback-url": CALLBACK_URL } : {}),
};

const res = await fetch("https://troloo.com/initiate-withdrawal-api", {
  method: "POST",
  headers,
  body: JSON.stringify({
    user_id: SENDER_USER_ID,
    currency: "XOF",
    payment_method: PAYMENT_METHOD,
    payment_method_reference: { momoformattedPhone: RECIPIENT_PHONE },
    amount: AMOUNT,
    external_reference: "retrait-" + Date.now(),
  }),
});
const data = await res.json();
console.log(`${res.status === 202 ? "✓" : "✗"} HTTP ${res.status} —`, data.message);
if (data.transaction_id) {
  console.log("  transaction_id :", data.transaction_id);
  console.log("  withdrawal_id  :", data.withdrawal_id);
  console.log("  gateway_ref    :", data.gateway_reference);
}

import os, uuid, base64, requests
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad
from Crypto.Random import get_random_bytes

# ── Credentials (variables d'environnement recommandées) ──────────
WAPI_KEY      = os.environ.get("TROLOOPAY_WAPI_KEY",    "VOTRE_WAPI_KEY")
WAPI_SECRET   = os.environ.get("TROLOOPAY_WAPI_SECRET", "VOTRE_WAPI_SECRET")
WAPI_PASSWORD = os.environ.get("TROLOOPAY_PASSWORD",    "VOTRE_MOT_DE_PASSE")

# ── Paramètres du retrait ─────────────────────────────────────────
SENDER_USER_ID  = "email_ou_phone_du_titulaire_de_la_cle"
RECIPIENT_PHONE = "229xxxxxxxx"
AMOUNT          = "1000"
PAYMENT_METHOD  = "MTN-MOMO-BENIN"
OPERATION_TYPE  = "USER_OPERATION"
CALLBACK_URL    = ""  # optionnel

# ── Chiffrement AES-256-CBC ───────────────────────────────────────
def encrypt_aes256(data: str, key: str) -> str:
    key_bytes = key.encode().ljust(32)[:32]
    iv        = get_random_bytes(16)
    cipher    = AES.new(key_bytes, AES.MODE_CBC, iv)
    encrypted = cipher.encrypt(pad(data.encode(), AES.block_size))
    combined  = base64.b64encode(encrypted).decode() + "::" + base64.b64encode(iv).decode()
    return base64.b64encode(combined.encode()).decode()

# ── Étape 1 : Générer le token ────────────────────────────────────
enc_secret  = encrypt_aes256(WAPI_SECRET, WAPI_PASSWORD)
auth_string = base64.b64encode(f"{WAPI_KEY}:{enc_secret}".encode()).decode()

token_resp = requests.post(
    "https://troloo.com/generate-withdrawal-token",
    headers={
        "Authorization": f"Basic {auth_string}",
        "Ehopay-Withdrawal-Type": OPERATION_TYPE,
        "Accept": "application/json",
        "Content-Length": "0",
    },
    data="",
    timeout=15,
)
token_data = token_resp.json()
if "access_token" not in token_data:
    print(f"Erreur token ({token_resp.status_code}):", token_data)
    exit(1)
print(f"✓ Token généré (expire dans {token_data['expires_in']}s)")

# ── Étape 2 : Initier le retrait ──────────────────────────────────
reference_id = str(uuid.uuid4())
headers = {
    "Authorization": f"Bearer {token_data['access_token']}",
    "Operation-Type": OPERATION_TYPE,
    "Reference-Id": reference_id,
    "Content-Type": "application/json",
    "Accept": "application/json",
}
if CALLBACK_URL:
    headers["Custom-Callback-url"] = CALLBACK_URL

resp = requests.post(
    "https://troloo.com/initiate-withdrawal-api",
    headers=headers,
    json={
        "user_id": SENDER_USER_ID,
        "currency": "XOF",
        "payment_method": PAYMENT_METHOD,
        "payment_method_reference": {"momoformattedPhone": RECIPIENT_PHONE},
        "amount": AMOUNT,
        "external_reference": "retrait-test",
    },
    timeout=20,
)
data = resp.json()
icon = "✓" if resp.status_code == 202 else "✗"
print(f"{icon} HTTP {resp.status_code} — {data.get('message', 'N/A')}")
if data.get("transaction_id"):
    print(f"  transaction_id : {data['transaction_id']}")
    print(f"  withdrawal_id  : {data['withdrawal_id']}")
    print(f"  gateway_ref    : {data['gateway_reference']}")

$token = getenv('TROLOOPAY_TOKEN');
$referenceId = trim(file_get_contents('/proc/sys/kernel/random/uuid'));

$payload = [
  "user_id" => "229xxxxxxxx",
  "currency" => "XOF",
  "payment_method" => "MTN-MOMO-BENIN",
  "payment_method_reference" => ["momoformattedPhone" => "229xxxxxxxx"],
  "amount" => "100",
  "external_reference" => "order-123",
];

$ch = curl_init("https://troloo.com/initiate-withdrawal-api");
curl_setopt_array($ch, [
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer {$token}",
    "Operation-Type: USER_OPERATION",
    "Reference-Id: {$referenceId}",
    "Custom-Callback-url: https://votre-domaine.com/ipn/withdrawal",
    "Content-Type: application/json",
  ],
  CURLOPT_POSTFIELDS => json_encode($payload),
  CURLOPT_TIMEOUT => 15,
]);
$resp = curl_exec($ch);
curl_close($ch);

echo $resp;

import crypto from "crypto";

const token = process.env.TROLOOPAY_TOKEN;
const referenceId = crypto.randomUUID();

const res = await fetch("https://troloo.com/initiate-withdrawal-api", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${token}`,
    "Operation-Type": "USER_OPERATION",
    "Reference-Id": referenceId,
    "Custom-Callback-url": "https://votre-domaine.com/ipn/withdrawal",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    user_id: "229xxxxxxxx",
    currency: "XOF",
    payment_method: "MTN-MOMO-BENIN",
    payment_method_reference: { momoformattedPhone: "229xxxxxxxx" },
    amount: "100",
    external_reference: "order-123",
  }),
});

console.log(await res.json());

<script setup>
import { ref } from "vue";

const token = import.meta.env.VITE_TROLOOPAY_TOKEN; // ou votre backend
const result = ref(null);

async function initiateWithdrawal() {
  const referenceId = crypto.randomUUID();
  const res = await fetch("https://troloo.com/initiate-withdrawal-api", {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${token}`,
      "Operation-Type": "USER_OPERATION",
      "Reference-Id": referenceId,
      "Custom-Callback-url": "https://votre-domaine.com/ipn/withdrawal",
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      user_id: "229xxxxxxxx",
      currency: "XOF",
      payment_method: "MTN-MOMO-BENIN",
      payment_method_reference: { momoformattedPhone: "229xxxxxxxx" },
      amount: "100",
      external_reference: "order-123",
    }),
  });
  result.value = await res.json();
}
</script>

<template>
  <button class="btn-troloo-primary" @click="initiateWithdrawal">
    Initier un retrait
  </button>
  <pre class="mt-4">{{ result }}</pre>
</template>

import os, uuid, requests

token = os.environ["TROLOOPAY_TOKEN"]
reference_id = str(uuid.uuid4())

resp = requests.post(
  "https://troloo.com/initiate-withdrawal-api",
  headers={
    "Authorization": f"Bearer {token}",
    "Operation-Type": "USER_OPERATION",
    "Reference-Id": reference_id,
    "Custom-Callback-url": "https://votre-domaine.com/ipn/withdrawal",
    "Content-Type": "application/json",
  },
  json={
    "user_id": "229xxxxxxxx",
    "currency": "XOF",
    "payment_method": "MTN-MOMO-BENIN",
    "payment_method_reference": {"momoformattedPhone": "229xxxxxxxx"},
    "amount": "100",
    "external_reference": "order-123",
  },
  timeout=15,
)

print(resp.status_code, resp.text)