Le catalogue et les commandes Menu, dans votre produit.

# pip install requests
import hashlib
import hmac
import json
import os
import time

import requests

BASE_URL = "https://menu.cambus.cm"
API_KEY = os.environ["MENU_API_KEY"]
SECRET = os.environ["MENU_SECRET"]


def appel(method, path, payload=None):
    """path inclut la query string, ex. "/api/partners/v1/plats?restaurant=12"."""
    body = b"" if payload is None else json.dumps(payload, separators=(",", ":")).encode()
    ts = str(int(time.time()))
    message = f"{ts}|{method}|{path}|{hashlib.sha256(body).hexdigest()}"
    signature = hmac.new(SECRET.encode(), message.encode(), hashlib.sha256).hexdigest()
    headers = {"X-Menu-Key": API_KEY, "X-Menu-Timestamp": ts, "X-Menu-Signature": signature}
    if body:
        headers["Content-Type"] = "application/json"
    r = requests.request(method, BASE_URL + path, data=body or None, headers=headers, timeout=15)
    r.raise_for_status()
    return r.json()


restaurants = appel("GET", "/api/partners/v1/restaurants")
print(len(restaurants), "restaurants ouverts")

// Node.js 18+ (fetch natif) — fichier menu.mjs
import crypto from "node:crypto";

const BASE_URL = "https://menu.cambus.cm";
const API_KEY = process.env.MENU_API_KEY;
const SECRET = process.env.MENU_SECRET;

export async function appel(method, path, payload) {
  const body = payload === undefined ? "" : JSON.stringify(payload);
  const ts = Math.floor(Date.now() / 1000).toString();
  const bodyHash = crypto.createHash("sha256").update(body).digest("hex");
  const signature = crypto
    .createHmac("sha256", SECRET)
    .update(`${ts}|${method}|${path}|${bodyHash}`)
    .digest("hex");

  const headers = { "X-Menu-Key": API_KEY, "X-Menu-Timestamp": ts, "X-Menu-Signature": signature };
  if (body) headers["Content-Type"] = "application/json";

  const res = await fetch(BASE_URL + path, { method, headers, body: body || undefined });
  const data = await res.json();
  if (!res.ok) throw Object.assign(new Error(data.error || data.detail), { status: res.status, data });
  return data;
}

const restaurants = await appel("GET", "/api/partners/v1/restaurants");
console.log(restaurants.length, "restaurants ouverts");

<?php
// PHP 7.4+ avec l'extension curl
function menu_appel(string $method, string $path, ?array $payload = null): array
{
    $body = $payload === null ? "" : json_encode($payload, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
    $ts = (string) time();
    $message = $ts . "|" . $method . "|" . $path . "|" . hash("sha256", $body);
    $signature = hash_hmac("sha256", $message, getenv("MENU_SECRET"));

    $headers = [
        "X-Menu-Key: " . getenv("MENU_API_KEY"),
        "X-Menu-Timestamp: " . $ts,
        "X-Menu-Signature: " . $signature,
    ];
    if ($body !== "") $headers[] = "Content-Type: application/json";

    $ch = curl_init("https://menu.cambus.cm" . $path);
    curl_setopt_array($ch, [
        CURLOPT_CUSTOMREQUEST => $method,
        CURLOPT_HTTPHEADER => $headers,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT => 15,
    ]);
    if ($body !== "") curl_setopt($ch, CURLOPT_POSTFIELDS, $body);
    $reponse = curl_exec($ch);
    $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);

    $data = json_decode($reponse, true);
    if ($code >= 400) throw new RuntimeException("HTTP $code : " . $reponse);
    return $data;
}

$restaurants = menu_appel("GET", "/api/partners/v1/restaurants");
echo count($restaurants) . " restaurants ouverts\n";

async function creerCommandeSure(payload, essais = 4) {
  for (let i = 0; i < essais; i++) {
    try {
      return await appel("POST", "/api/partners/v1/commandes", payload);
    } catch (e) {
      if (e.status && e.status < 500) throw e;          // erreur métier : ne pas relancer
      await new Promise((r) => setTimeout(r, 1000 * 2 ** i));
    }
  }
  throw new Error("Menu injoignable — réessayer plus tard");
}

// Express
import crypto from "node:crypto";
import express from "express";

const app = express();

app.post("/webhooks/menu", express.json(), (req, res) => {
  const { commande_id, reference_externe, statut, timestamp } = req.body;
  const attendu = crypto
    .createHmac("sha256", process.env.MENU_WEBHOOK_SECRET)
    .update(`${commande_id}|${reference_externe}|${statut}|${timestamp}`)
    .digest("hex");
  const recu = req.get("X-Menu-Signature") || "";
  const valide = recu.length === attendu.length &&
    crypto.timingSafeEqual(Buffer.from(recu), Buffer.from(attendu));
  if (!valide || Math.abs(Date.now() / 1000 - timestamp) > 300) return res.sendStatus(401);

  mettreAJourCommande(reference_externe, statut);
  res.sendStatus(204);
});

<?php
$evt = json_decode(file_get_contents("php://input"), true);
$message = $evt["commande_id"] . "|" . $evt["reference_externe"] . "|" . $evt["statut"] . "|" . $evt["timestamp"];
$attendu = hash_hmac("sha256", $message, getenv("MENU_WEBHOOK_SECRET"));
$recu = $_SERVER["HTTP_X_Menu_SIGNATURE"] ?? "";

if (!hash_equals($attendu, $recu) || abs(time() - $evt["timestamp"]) > 300) {
    http_response_code(401);
    exit;
}
mettre_a_jour_commande($evt["reference_externe"], $evt["statut"]);
http_response_code(204);