npm install @transak/wdk-protocol-fiat-transak

import TransakProtocol from '@transak/wdk-protocol-fiat-transak';

function requiredEnvironmentVariable(name: string): string {
  const value = process.env[name];
  if (!value) throw new Error(`${name} is required`);
  return value;
}

const partnerApiKey = requiredEnvironmentVariable('TRANSAK_API_KEY');
const partnerApiSecret = requiredEnvironmentVariable('TRANSAK_API_SECRET');
const environment = process.env.TRANSAK_ENVIRONMENT === 'PRODUCTION'
  ? 'PRODUCTION'
  : 'STAGING';

const transakApiOrigin = environment === 'STAGING'
  ? 'https://api-stg.transak.com'
  : 'https://api.transak.com';
const transakGatewayOrigin = environment === 'STAGING'
  ? 'https://api-gateway-stg.transak.com'
  : 'https://api-gateway.transak.com';

// Call this inside your authenticated backend handler. `userIp` must come from
// trusted request or CDN context, never a browser-provided request body/header.
function createTransakProtocol(userIp: string) {
  return new TransakProtocol(undefined, {
    apiKey: partnerApiKey,
    widgetUrl: (widgetParams) => createWidgetUrl(widgetParams, userIp),
    getOrder,
    environment,
  });
}

// Recommended backend default. Pass `recipient` to buy(), or let the widget ask.
const transak = new TransakProtocol(undefined, config);

// Optional read-only account, used only as the fallback buy recipient.
const transak = new TransakProtocol(readOnlyAccount, config);

// Accepted, but TransakProtocol only reads its address and never signs with it.
const transak = new TransakProtocol(walletAccount, config);

type CachedAccessToken = { token: string; exp: number };

let cached: CachedAccessToken | undefined;
let refreshInFlight: Promise<CachedAccessToken> | undefined;

async function refreshAccessToken(): Promise<CachedAccessToken> {
  const res = await fetch(`${transakApiOrigin}/partners/api/v2/refresh-token`, {
    method: 'POST',
    headers: {
      'x-api-key': partnerApiKey,
      'api-secret': partnerApiSecret,
      'content-type': 'application/json',
    },
    body: JSON.stringify({ apiKey: partnerApiKey }),
  });

  if (!res.ok) {
    throw new Error(`Failed to refresh Transak access token: ${res.status}`);
  }

  const body = await res.json();
  const token = body?.data?.accessToken;
  const expiresAt = body?.data?.expiresAt;
  if (typeof token !== 'string' || typeof expiresAt !== 'number') {
    throw new Error('Transak refresh-token response is missing accessToken or expiresAt');
  }

  cached = { token, exp: expiresAt };
  return cached;
}

async function accessToken() {
  const now = Math.floor(Date.now() / 1000);
  if (cached && cached.exp > now) return cached.token;

  const refresh = refreshInFlight ??= refreshAccessToken();
  try {
    return (await refresh).token;
  } finally {
    if (refreshInFlight === refresh) refreshInFlight = undefined;
  }
}

// Runs on your backend. Never ship the API secret to the client.
// `userIp` is the end user's IP derived from trusted request or CDN context.
async function createWidgetUrl(widgetParams, userIp) {
  const token = await accessToken();

  const sessionRes = await fetch(`${transakGatewayOrigin}/api/v2/auth/session`, {
    method: 'POST',
    headers: {
      'x-api-key': partnerApiKey,
      'access-token': token,
      'content-type': 'application/json',
      'x-user-ip': userIp,
    },
    body: JSON.stringify({ widgetParams }),
  });

  if (!sessionRes.ok) {
    throw new Error(`Failed to create Transak widget URL: ${sessionRes.status}`);
  }

  const body = await sessionRes.json();
  const widgetUrl = body?.data?.widgetUrl;
  if (typeof widgetUrl !== 'string') {
    throw new Error('Transak widget response is missing widgetUrl');
  }

  return widgetUrl; // valid for 5 minutes, single use
}

async function getOrder(txId) {
  const token = await accessToken(); // reuse the same one as the widget URL flow
  const res = await fetch(`${transakApiOrigin}/partners/api/v2/order/${encodeURIComponent(txId)}`, {
    headers: { 'x-api-key': partnerApiKey, 'access-token': token },
  });

  if (!res.ok) {
    throw new Error(`Failed to fetch Transak order: ${res.status}`);
  }

  const body = await res.json();
  const order = body?.data;
  if (
    !order ||
    typeof order !== 'object' ||
    Array.isArray(order) ||
    typeof order.status !== 'string' ||
    typeof order.cryptoCurrency !== 'string' ||
    typeof order.fiatCurrency !== 'string' ||
    !['BUY', 'SELL'].includes(order.isBuyOrSell)
  ) {
    throw new Error('Transak order response is missing required order fields');
  }

  return order; // Get Order responses are wrapped in { data }
}

TRANSAK_ENVIRONMENT=STAGING

TRANSAK_ENVIRONMENT=PRODUCTION

const result = await transak.buy({
  cryptoAsset: 'ETH',
  fiatCurrency: 'EUR',
  fiatAmount: 10_000n, // €100.00 in cents
  config: {
    network: 'ethereum',
    paymentMethod: 'credit_debit_card',
    referrerDomain: 'yourdomain.com', // required, see below
    colorMode: 'DARK',
    themeColor: '3B82F6',
  },
});