# Python Examples

Complete Python integration examples for AuxCORE API.

> **Note:** AuxCORE does not publish a Python SDK package. These examples call the REST API directly with `requests`.

---

## Installation

```bash
pip install requests
```

---

## Setup

```python
import os
import requests

BASE_URL = os.getenv('AUXCORE_API_BASE', 'https://uat.auxcore.net/api/v1/public')
API_KEY = os.getenv('AUXCORE_API_KEY')

session = requests.Session()
session.headers.update({
    'x-api-key': API_KEY,
    'Content-Type': 'application/json',
})
```

Tenant-wide ERP keys (`lv_erp_…`) must also send `X-Merchant-ID: <merchant uuid>`.

---

## Process Payment

Raw card numbers are rejected on Sandbox and Production. Tokenize first (`POST /tokenize-card` with a server-side key, or the PCI SDK in the browser) and charge the `pci_tok_…` token.

```python
# 1. Tokenize (server-side key only)
tok = session.post(f'{BASE_URL}/tokenize-card', json={
    'cardNumber': '4111111111111111',
    'expiryMonth': '12',
    'expiryYear': '2027',
    'cvv': '123',
    'cardHolderName': 'John Doe',
}).json()
pci_token = tok['data']['pciToken']

# 2. Charge
res = session.post(f'{BASE_URL}/transaction', json={
    'Amount': 100.00,
    'pciToken': pci_token,
    'BillingCustomerName': 'John Doe',
    'BillingEmail': 'john@example.com',
    'BillingAddress': '123 Main St',
    'BillingCity': 'New York',
    'BillingState': 'NY',
    'BillingPostalCode': '10001',
    'BillingCountry': 'US',
    'OrderId': 'ORD-1001',
})
body = res.json()

if res.status_code == 200 and body.get('requires_action'):
    print(f"Redirect payer to: {body['data']['RedirectUrl']}")
elif res.status_code == 200 and body.get('success'):
    print(f"Transaction approved: {body['data']['TransactionId']}")
elif res.status_code == 402:
    print(f"Payment declined: {body.get('message')} (code {body['data'].get('ResponseCode')})")
else:
    print(f"Error {res.status_code}: {body}")
```

---

## Webhook Handler (Flask)

The `X-Webhook-Signature` header is `t=<unix>,v1=<hex>`, where `v1` is HMAC-SHA256 of `"<t>.<raw body>"` keyed with the endpoint secret.

```python
import hashlib
import hmac
import json
import time
from flask import Flask, request

app = Flask(__name__)
WEBHOOK_SECRET = os.getenv('AUXCORE_WEBHOOK_SECRET')

def verify_signature(raw_body: bytes, header: str, secret: str, tolerance: int = 300) -> bool:
    parts = dict(p.split('=', 1) for p in (header or '').split(',') if '=' in p)
    try:
        t = int(parts['t'])
    except (KeyError, ValueError):
        return False
    if abs(time.time() - t) > tolerance or 'v1' not in parts:
        return False
    expected = hmac.new(secret.encode(), f'{t}.'.encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, parts['v1'])

@app.route('/webhooks/auxcore', methods=['POST'])
def handle_webhook():
    payload = request.get_data()
    signature = request.headers.get('X-Webhook-Signature')

    if not verify_signature(payload, signature, WEBHOOK_SECRET):
        return 'Invalid signature', 401

    event = json.loads(payload)  # { id, type, created, data, metadata }

    if event['type'] == 'transaction.approved':
        handle_transaction_approved(event['data'])
    elif event['type'] == 'transaction.declined':
        handle_transaction_declined(event['data'])

    return '', 200

def handle_transaction_approved(data):
    print(f"Transaction approved: {data['transactionId']}")

def handle_transaction_declined(data):
    print(f"Transaction declined: {data['transactionId']} {data.get('responseText')}")

if __name__ == '__main__':
    app.run(port=3000)
```

---

**Next:** [Postman collection →](./postman.md)