An API that respects your afternoon.

// Your server: start a checkout for a plan
const res = await fetch('https://api.usemonthly.app/v1/checkout-sessions', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.MONTHLY_KEY}`, // mk_test_…
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    planId: '7c1f…',
    successUrl: 'https://streamgh.com/welcome?session={CHECKOUT_SESSION_ID}',
    cancelUrl: 'https://streamgh.com/',
    clientReferenceId: user.id,
  }),
});

const { url } = await res.json();
// Send the customer to url, or open it in the pop-up

<!-- Your page: the same checkout, over your site -->
<script src="https://checkout.usemonthly.app/v1/monthly.js"></script>
<script>
  button.addEventListener('click', async () => {
    const { url } = await fetch('/checkout-session', { method: 'POST' })
      .then((r) => r.json());

    Monthly.openCheckout({
      url,
      onSuccess: (result) => location.assign('/welcome?session=' + result.sessionId),
      onCancel: () => {},
    });
  });
</script>

// Your server: check Monthly-Signature before trusting an event
import { createHmac, timingSafeEqual } from 'node:crypto';

function verify(rawBody, header, secret) { // secret: whsec_…
  const { t, v1 } = Object.fromEntries(header.split(',').map((p) => p.split('=')));
  if (Math.abs(Date.now() / 1000 - t) > 300) return false;
  const expected = createHmac('sha256', secret).update(`${t}.${rawBody}`).digest();
  return timingSafeEqual(expected, Buffer.from(v1, 'hex'));
}

// Then act on event.type, once per event.id:
// subscription.renewed, .payment_failed, .paused, .resumed, .cancelled …

# Create a plan: GHS 45 a month, 7 days free
curl https://api.usemonthly.app/v1/plans \
  -H "Authorization: Bearer $MONTHLY_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Premium",
    "pricePesewas": 4500,
    "billingCycle": "monthly",
    "trialDays": 7
  }'