Best UPI Payment Gateway for Discord Bots & Gaming Communities (Zero GST & Instant Roles)

+--------------------+ +---------------------+ +------------------------+ | Discord Member | | Discord Bot Backend | | FamGateway Cluster | +--------------------+ +---------------------+ +------------------------+ | | | | 1. /buy vip | | |----------------------------->| | | | 2. POST /api/create-order | | | Headers: X-Api-Key | | | Body: amount, custom_id | | |------------------------------->| | | | 3. Generate Session | | | TTL: Exactly 300s | | 4. Return checkout_url & QR | Unique dynamic QR | |<-------------------------------| | 5. Ephemeral Button: | | | [Pay INR 199 via UPI] | | |<-----------------------------| | | | | 6. Click link, scan QR, or tap UPI Intent (GPay/PhonePe/FamPay)| |-------------------------------------------------------------->| | | 7. Real-Time Bank Ingestion | | Extract 12-Digit UTR | | 8. Signed Webhook Callback | Acquire Mutex Lock | | Header: Signature (HMAC) | | |<-------------------------------| | | | | | 9. Validate HMAC with API Key | | | Enforce UTR Uniqueness | | | member.roles.add(VIP_ROLE) | | | Optional: Execute RCON cmd | | 10. Role assigned & VIP | | | Welcome notification | | |<-----------------------------| |

// bot.js - Discord.js v14 + FamGateway Webhook Integration
const { 
    Client, 
    GatewayIntentBits, 
    ActionRowBuilder, 
    ButtonBuilder, 
    ButtonStyle, 
    EmbedBuilder 
} = require('discord.js');
const express = require('express');
const axios = require('axios');
const crypto = require('crypto');
const Database = require('better-sqlite3');

// Configuration
const DISCORD_TOKEN = process.env.DISCORD_TOKEN;
const GUILD_ID = process.env.GUILD_ID;
const VIP_ROLE_ID = process.env.VIP_ROLE_ID;
const FAMGATEWAY_API_KEY = process.env.FAMGATEWAY_API_KEY;
const WEBHOOK_PORT = process.env.PORT || 4000;

// Initialize Database
const db = new Database('discord_orders.db');
db.prepare(`
    CREATE TABLE IF NOT EXISTS orders (
        order_id TEXT PRIMARY KEY,
        user_id TEXT NOT NULL,
        guild_id TEXT NOT NULL,
        amount REAL NOT NULL,
        utr TEXT DEFAULT NULL,
        status TEXT NOT NULL DEFAULT 'pending',
        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
    )
`).run();

const client = new Client({
    intents: [
        GatewayIntentBits.Guilds,
        GatewayIntentBits.GuildMembers
    ]
});

const app = express();

// Preserve raw body buffer for authentic cryptographic HMAC verification
app.use(express.json({
    verify: (req, res, buf) => {
        req.rawBody = buf;
    }
}));

// 1. Slash Command Handler
client.on('interactionCreate', async (interaction) => {
    if (!interaction.isChatInputCommand()) return;

    if (interaction.commandName === 'buy') {
        await interaction.deferReply({ ephemeral: true });

        const amount = 199.00;
        const endpoint = 'https://famgateway.in/api/create-order';

        try {
            const res = await axios.post(endpoint, {
                amount: amount.toFixed(2),
                customer_name: interaction.user.username,
                redirect_url: `https://discord.com/channels/${interaction.guildId}`,
                webhook_url: 'https://your-bot-server.com/api/famgateway-webhook',
                custom_id: `DISCORD_${interaction.user.id}`
            }, {
                headers: {
                    'Content-Type': 'application/json',
                    'X-Api-Key': FAMGATEWAY_API_KEY
                },
                timeout: 10000
            });

            const data = res.data;
            const checkoutUrl = data.checkout_url || data.payment_url;
            const orderId = data.order_id;

            if (res.status === 200 && checkoutUrl && orderId) {
                // Save order to SQLite
                db.prepare(`
                    INSERT INTO orders (order_id, user_id, guild_id, amount, status)
                    VALUES (?, ?, ?, ?, 'pending')
                `).run(orderId, interaction.user.id, interaction.guildId, amount);

                const embed = new EmbedBuilder()
                    .setTitle('VIP Membership Upgrade')
                    .setDescription(`Your payment session has been generated!\n\n**Amount:** INR ${amount.toFixed(2)}\n**Order ID:** \`${orderId}\`\n**Validity:** Strictly 5 Minutes (300s)\n\nClick the button below to complete payment via Google Pay, PhonePe, Paytm, or FamPay. Your VIP role will be assigned automatically upon completion!`)
                    .setColor(0x3b82f6)
                    .setFooter({ text: 'Powered by FamGateway UPI' });

                const row = new ActionRowBuilder().addComponents(
                    new ButtonBuilder()
                        .setLabel('Pay INR 199 via UPI')
                        .setStyle(ButtonStyle.Link)
                        .setURL(checkoutUrl)
                );

                await interaction.editReply({ embeds: [embed], components: [row] });
            } else {
                await interaction.editReply({ content: 'Unable to initialize checkout. Please contact an administrator.' });
            }
        } catch (err) {
            await interaction.editReply({ content: 'Temporary gateway connection failure. Please retry in a few moments.' });
        }
    }
});

// 2. Webhook Listener for Instant Automated Role Assignment
app.post('/api/famgateway-webhook', async (req, res) => {
    const receivedSignature = req.headers['x-famgateway-signature'] || '';
    if (!receivedSignature || !req.rawBody) {
        return res.status(401).json({ error: 'Missing signature header or body' });
    }

    // Verify HMAC-SHA256 signature against your FamGateway API Key
    const expectedSignature = crypto.createHmac('sha256', FAMGATEWAY_API_KEY)
                                    .update(req.rawBody)
                                    .digest('hex');

    if (!crypto.timingSafeEqual(Buffer.from(receivedSignature), Buffer.from(expectedSignature))) {
        return res.status(401).json({ error: 'Cryptographic signature mismatch' });
    }

    const { status, order_id, utr, amount } = req.body;

    if (status === 'success') {
        const order = db.prepare('SELECT * FROM orders WHERE order_id = ? FOR UPDATE').get(order_id);

        if (order && order.status === 'pending') {
            // Verify Bank UTR Uniqueness to prevent replay attacks
            const utrConflict = db.prepare('SELECT order_id FROM orders WHERE utr = ? AND status = "completed"').get(utr);
            if (utrConflict) {
                return res.status(409).json({ error: 'Duplicate UTR detected' });
            }

            // Update order record
            db.prepare('UPDATE orders SET status = "completed", utr = ? WHERE order_id = ?').run(utr, order_id);

            try {
                const guild = await client.guilds.fetch(order.guild_id);
                const member = await guild.members.fetch(order.user_id);

                // Assign the VIP Role
                await member.roles.add(VIP_ROLE_ID);

                // Send DM confirmation to the user
                await member.send({
                    content: `Your payment of INR ${amount} has been confirmed! Bank UTR: \`${utr}\`. Your VIP perks have been activated in ${guild.name}.`
                });

                console.log(`Assigned VIP role to ${member.user.tag} for order ${order_id}`);
            } catch (roleError) {
                console.error('Failed to assign Discord role:', roleError);
            }
        }
    }

    res.status(200).json({ status: 'ok' });
});

client.login(DISCORD_TOKEN);
app.listen(WEBHOOK_PORT, () => console.log(`Discord Webhook Server active on port ${WEBHOOK_PORT}`));

# bot.py (discord.py + aiohttp)
import os
import hmac
import hashlib
import sqlite3
import discord
from discord import app_commands
from discord.ext import commands
from aiohttp import web

DISCORD_TOKEN = os.getenv("DISCORD_TOKEN")
GUILD_ID = int(os.getenv("GUILD_ID", "0"))
VIP_ROLE_ID = int(os.getenv("VIP_ROLE_ID", "0"))
FAMGATEWAY_API_KEY = os.getenv("FAMGATEWAY_API_KEY")

intents = discord.Intents.default()
intents.members = True
bot = commands.Bot(command_prefix="!", intents=intents)

@bot.tree.command(name="buy_vip", description="Purchase VIP Server Membership via UPI")
async def buy_vip(interaction: discord.Interaction):
    await interaction.response.defer(ephemeral=True)

    amount = 199.00
    endpoint = "https://famgateway.in/api/create-order"
    payload = {
        "amount": f"{amount:.2f}",
        "customer_name": interaction.user.name,
        "redirect_url": f"https://discord.com/channels/{interaction.guild_id}",
        "webhook_url": "https://your-bot-server.com/api/webhook",
        "custom_id": f"DISCORD_{interaction.user.id}"
    }

    import httpx
    async with httpx.AsyncClient(timeout=10.0) as client:
        resp = await client.post(
            endpoint, 
            json=payload, 
            headers={"X-Api-Key": FAMGATEWAY_API_KEY, "Content-Type": "application/json"}
        )
        data = resp.json()

    checkout_url = data.get("checkout_url") or data.get("payment_url")
    order_id = data.get("order_id")

    if resp.status_code == 200 and checkout_url:
        view = discord.ui.View()
        view.add_item(discord.ui.Button(label="Pay INR 199 via UPI", url=checkout_url))
        await interaction.followup.send(
            f"Your VIP Order `{order_id}` is ready!\nClick below to pay via any UPI app. Your role will be assigned automatically upon completion.",
            view=view,
            ephemeral=True
        )
    else:
        await interaction.followup.send("Could not create payment order. Try again later.", ephemeral=True)

# Webhook Server via aiohttp
async def webhook_handler(request):
    raw_body = await request.read()
    sig = request.headers.get("X-FamGateway-Signature", "")

    expected = hmac.new(FAMGATEWAY_API_KEY.encode(), raw_body, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, sig):
        return web.Response(status=401, text="Signature mismatch")

    data = await request.json()
    if data.get("status") == "success":
        custom_id = data.get("custom_id", "")
        if custom_id.startswith("DISCORD_"):
            user_id = int(custom_id.replace("DISCORD_", ""))
            guild = bot.get_guild(GUILD_ID)
            if guild:
                member = guild.get_member(user_id)
                role = guild.get_role(VIP_ROLE_ID)
                if member and role:
                    await member.add_roles(role)
                    print(f"Assigned role to {member.name}")

    return web.json_response({"status": "ok"})

async def run_web():
    app = web.Application()
    app.router.add_post('/api/webhook', webhook_handler)
    runner = web.AppRunner(app)
    await runner.setup()
    site = web.TCPSite(runner, '0.0.0.0', 4000)
    await site.start()

@bot.event
async def on_ready():
    await bot.tree.sync()
    bot.loop.create_task(run_web())
    print(f"Logged in as {bot.user}")

bot.run(DISCORD_TOKEN)

// Minecraft RCON Example (Node.js)
const { Rcon } = require('rcon-client');

async function grantMinecraftRank(playerName, rankName) {
    const rcon = await Rcon.connect({
        host: '127.0.0.1', port: 25575, password: process.env.RCON_PASSWORD
    });
    // LuckPerms command to grant rank
    const response = await rcon.send(`lp user ${playerName} parent add ${rankName}`);
    console.log('RCON Response:', response);
    rcon.end();
}