Leroy Merlin Foundation — online donations with confirmed payments

The brief

The Leroy Merlin Foundation collects donations online on its Webflow site, with payments handled by Tpay. The task: move all of the payment handling to a server. The site was to look after the form’s design only, while the Tpay keys, creating transactions and confirming payments stay where the browser can’t see them.

How it works

A donor picks an amount and accepts the terms. The browser sends the Worker on Cloudflare only the amount and a verification token. The Worker checks the amount, records the donation, creates a Tpay transaction and sends the page back the payment address. The donor pays at Tpay: by BLIK, card, bank transfer or a wallet.

After the payment, Tpay sends a digitally signed confirmation. The Worker checks the signature against Tpay’s certificate, and that the transaction number and amount match its own records. Only then is the donation marked as paid.

The form

The form stays in Webflow, so the foundation’s team still changes its design itself. A script on the page handles choosing the amount, the messages and the way to the payment.

The amount is checked right away and again on the server: from 5 to 10,000 zł, in whole złoty. Messages are in Polish and screen readers announce them.

The button turns on only once an amount is chosen and the terms are accepted. When clicked, it shows “Redirecting to payment…” at once, and coming back from Tpay with the Back button doesn’t lock the form.

Protection against abuse

Cloudflare Turnstile checks that a person is sending the form. The check starts in the background as soon as the donor begins filling in the form, and usually needs no click at all. The server accepts requests from the foundation’s site only, and at most 10 attempts a minute from one address.

A record of donations

Every donation goes into a Cloudflare D1 database with its status: created, pending, paid, refunded or failed. The database holds no personal data: the payer’s details stay with Tpay. Every verified confirmation is logged, and one sent again doesn’t change a donation already booked.

Tests

The system has two environments: a test one on Tpay Sandbox and production, with separate databases and keys. The code is TypeScript with 87 automated tests, including attempts to forge Tpay’s signature.

The result

The foundation knows which donations were actually paid, and the payment credentials never leave the server. The site and the form stay in Webflow, in the hands of the foundation’s team.