Security: Remove integration_key from client bundle

[Copilot]

The integration_key was being passed to the React component and bundled into client JavaScript, exposing it to anyone inspecting the application.

Solution

Implemented server-side proxy pattern. Client now calls user's backend API, which handles Paynow interactions with the integration_key securely.

[React App] → [User's Server] → [Paynow API]
              (holds integration_key)

Changes

API (Breaking)

• Removed integration_key from PaynowReactProps
• Added apiEndpoint: string for user's backend URL
• Created PaynowClient class for server communication

React Components

• PaynowContext: Stores config instead of instantiating Paynow
• Payment: Uses PaynowClient to call backend endpoints

Server Implementation

• server-example.js: Complete Express.js reference implementation
• Required endpoints: /init, /init-mobile, /poll

Documentation

• MIGRATION-GUIDE.md: Step-by-step migration with framework examples
• Updated README with security warnings and new setup flow

Usage

Before:

<PaynowReactWrapper
  integration_id="..."
  integration_key="secret" // ❌ Exposed in bundle
  {...urls}
/>

After:

<PaynowReactWrapper
  integration_id="..."
  apiEndpoint="https://api.yourdomain.com/paynow" // ✅ Calls your backend
  {...urls}
/>

Users must implement backend endpoints using the provided server-example.js as reference.

Test Coverage

• Added 6 tests for PaynowClient
• All 22 tests passing
• CodeQL: 0 alerts

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[bug]: integration_key should not be bundled into the app</issue_title>
<issue_description>I generally think that the integration_key should not be bundled into the client side code. I didn't think about that when I initially built this. Its a fork of the paynow package which is meant to be used at the server side hence this wasn't a concern for them.</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes [bug]: integration_key should not be bundled into the app #2

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.