Dokumentasi API

Alur: buat invoice → arahkan pelanggan ke halaman pembayaran → terima webhook bertanda tangan. Prefix /v1. Autentikasi melalui header X-Api-Key.

Spesifikasi OpenAPI 3 (JSON) Dapatkan kunci

Jaringan yang didukung

Pindah dari payment processor lain — tanpa menulis ulang kode

Sudah terintegrasi dengan Cryptomus / NOWPayments / Coinbase Commerce? Cukup ganti base URL dan key di SDK Anda — kami menerima format create-invoice mereka, mengembalikan halaman pembayaran kami dalam format respons mereka, dan mengirim webhook dalam skema mereka lengkap dengan tanda tangan, sehingga kode verifikasi Anda tetap jalan apa adanya. Dicocokkan lewat order_id.

# sebelum:  https://api.cryptomus.com/v1/payment
# sesudah:  https://paygate.love/compat/cryptomus/v1/payment
# key: API key paygate Anda; secret webhook = apiSecret paygate Anda

Butuh processor lain? Hubungi kami — adaptor baru hanya satu modul.

Terima pembayaran di dalam bot Telegram Anda sendiri

Merchant Anda berupa bot? Jangan alihkan pengguna ke situs atau bot dompet pihak ketiga. Bot Anda memanggil API kami, menampilkan alamat + jumlah + QR langsung di chat, dan mengubah pesan menjadi «✅ Lunas» begitu pembayaran terkonfirmasi on-chain. UX in-bot yang sama seperti CryptoBot, tapi kripto masuk langsung ke Anda, kunci milik Anda, dan biayanya sangat kecil.

1. POST /v1/invoices               # API key Anda → { id, pay_address, pay_uri, amount_expected }
2. bot.sendPhoto( https://paygate.love/i/<id>/qr.png )   # QR publik, Telegram mengambilnya sendiri
   + tombol «Buka dompet» → pay_uri
3. webhook invoice.paid kami → bot.editMessage → «✅ Lunas»

Pengguna sama sekali tidak meninggalkan bot merchant. Endpoint QR /i/<id>/qr.png bersifat publik (hanya meng-encode alamat). Contoh siap copy-paste (grammy/telegraf) ada di docs/BOT-INTEGRATION.md.

Untuk streamer: notifikasi donasi, bar target, papan peringkat

Semua endpoint streamer di bawah memakai token alert — sudah tertanam di URL overlay dan papan peringkat pada halaman «Alert» di kabinet. Ini kemampuan baca-saja: tidak pernah menggantikan kunci API Anda, tapi jangan publikasikan URL widget. Di baliknya, sebuah donasi hanyalah invoice dengan nama dan pesan donatur.

Cara memasang donasi di stream Anda — langkah demi langkah

1. Daftar sebagai streamer: di halaman pendaftaran pilih tipe akun «Streamer / kreator» — kabinet akan disesuaikan untuk donasi.
2. Buka Kabinet → «Alert»: di sana ada URL overlay (/alerts/widget?token=…), pengaturan tampilan alert, dan editor target. Salin URL overlay.
3. Di OBS/Streamlabs: Sources → «+» → Browser Source → tempel URL, atur ukurannya sesuai kanvas (mis. 1920×1080) → OK. Notifikasi dan bar target kini tampil di stream; cek dengan tombol donasi uji.
4. Atur target penggalangan dana di halaman «Alert» yang sama — judul, jumlah target, dan mata uang. Bar progres muncul di overlay dan lewat GET /alerts/goal.
5. Buat tautan donasi (Kabinet → «Tautan»), bagikan tautan/QR ke penonton, dan unggah papan peringkat publik /d/<token> di channel Anda.
6. Lanjutan: dorong donasi dari platform lain lewat POST /v1/donations/external, atau suplai bar progres pihak ketiga dari GET /alerts/goal — detail di bawah.

Overlay OBS (Browser Source)

Halaman HTML siap pakai dengan notifikasi donasi langsung dan bar target — tambahkan ke OBS/Streamlabs sebagai Browser Source:

https://paygate.love/alerts/widget?token=<alertToken>

Target penggalangan dana — JSON untuk bar progres apa pun (pull)

JSON publik dari target saat ini (token adalah kuncinya; cache ~5 dtk). Widget bar progres eksternal mana pun bisa mem-poll-nya untuk menampilkan total gabungan di tempat lain — begitulah cara menghubungkan penggalangan dana paygate ke bar lain.

curl "https://paygate.love/alerts/goal?token=<alertToken>"
→ { "active": true, "title": "New PC", "target": 1000,
    "current": 337.5, "currency": "USD" }
# target belum diatur → { "active": false }

Donasi eksternal — gabungkan sumber lain ke bar yang sama (push)

Catat donasi yang terjadi di tempat lain (PayPal, DonationAlerts, manual) agar dihitung ke bar target YANG SAMA dan, opsional, memicu alert OBS yang sama. Satu bar, semua sumber — kripto plus apa pun yang Anda dorong ke sini. Autentikasi: kunci API Anda.

curl -X POST https://paygate.love/v1/donations/external \
  -H "X-Api-Key: pk_..." -H "Content-Type: application/json" \
  -d '{ "amount": 5, "currency": "USD", "name": "Alice",
        "message": "gg!", "source": "paypal", "fire_alert": true }'
→ 201 { "ok": true, "amount_usd": 5 }

Kolom: amount (>0, wajib), currency (default USD), name (≤60), message (≤300), source (≤40, default "api"), fire_alert (default true). Jumlah dikonversi ke USD untuk total target.

Aliran alert langsung (SSE)

Server-Sent Events untuk setiap donasi — bangun overlay yang sepenuhnya kustom sebagai pengganti widget kami:

const es = new EventSource(
  "https://paygate.love/alerts/stream?token=<alertToken>");
es.onmessage = (e) => {
  const d = JSON.parse(e.data); // { name, amount, currency, asset, message }
  showAlert(d);
};

Papan peringkat publik

Halaman publik yang bisa dibagikan berisi donatur teratas (pendukung teratas, donasi terbaru, target) — pasang di deskripsi channel atau di chat:

https://paygate.love/d/<alertToken>

Pencairan: secara default donasi bersifat kustodial — tarik dari kabinet kapan saja. Atau tambahkan xpub dompet Anda di kabinet (non-custodial) dan donasi langsung masuk ke dompet Anda di EVM / TRON / BTC / LTC / DOGE.

Program referral

Undang toko dan streamer — dan dapatkan bagian dari komisi kami atas setiap pembayaran mereka, seumur hidup. Tarif default 20%, dan bisa ditetapkan secara individual untuk tiap mitra.

https://paygate.love/?ref=<yourCode>

Tautan unik Anda ada di Kabinet → «Referral». Siapa pun yang mendaftar lewat tautan itu (kode ?ref= ditangkap lewat cookie, atau diisi di kolom opsional pada formulir pendaftaran) akan terhubung dengan Anda secara permanen.

Pendapatan tercatat otomatis untuk setiap invoice terkonfirmasi (terbayar) dari merchant yang Anda referensikan, dalam USD; statistik dan jumlahnya ada di Kabinet → «Referral».

💸 Dompet prabayar donatur (donasi instan)

Penonton mengisi saldo sekali (crypto terkonfirmasi sekali), lalu mengirim donasi instan ke streamer Paygate mana pun dari saldo internal — alert langsung muncul, tanpa menunggu jaringan di setiap donasi. Donasi masuk ke saldo normal Anda; tarik seperti biasa. Halaman dompet: /w (tautan pembawa, token ada di #fragment — tidak pernah masuk ke log).

🧩 Plugin setup guides

Before you start, grab your API key and secret from your store's Settings page. ⚙️

🛒 WooCommerce — setup

1. Download the plugin zip (the “Download” button on the Plugins page or in your dashboard).
2. WP Admin → Plugins → Add New → Upload Plugin → choose the zip → Install → Activate.
3. WooCommerce → Settings → Payments → enable “Paygate (crypto)” and click Manage.
4. Paste your API key and secret, save. The webhook is wired automatically.
5. Place a test order: pick “Paygate” at checkout, pay, and the order flips to Paid on the signed webhook.

🖥️ WHMCS — setup

1. Download and unzip. Inside you'll find a modules/gateways/ folder.
2. Upload the contents of modules/gateways/ into your WHMCS root (it merges with the existing structure).
3. WHMCS Admin → Setup → Payments → Payment Gateways → “All Payment Gateways” tab → activate “Paygate”.
4. Enter your API key and secret, save. Verify with a test invoice — status updates via the callback.

🛍️ OpenCart — setup

1. Download the zip. Copy the contents of upload/ into your OpenCart root (merges with admin/ and catalog/), or install the zip via Extensions → Installer.
2. Extensions → Extensions → Payments → find “Paygate — Crypto Payments” → “+” (Install) → pencil (Edit).
3. Status = Enabled, paste your API key and secret, pick the order statuses, save. The webhook is wired automatically (callback_url).
4. Test order: pick “Pay with Crypto” at checkout, pay, and the status updates via the signed webhook.

🧿 PrestaShop — setup

1. Download the module zip. Back office → Modules → Module Manager → “Upload a module” → choose the zip → install.
2. Click “Configure”, paste your API key and secret (leave base URL as https://paygate.love), save.
3. The webhook is wired automatically (callback_url) and shown on the settings page.
4. Test order: pick “Pay with Crypto”, pay, and the order moves to “Payment accepted” on the signed webhook.

🅜 Magento 2 — setup

1. Copy the Paygate folder into app/code/ (module lives at app/code/Paygate/Crypto).
2. From the Magento root: bin/magento module:enable Paygate_Crypto && bin/magento setup:upgrade && setup:di:compile && cache:flush.
3. Admin → Stores → Configuration → Sales → Payment Methods → “Paygate — Crypto Payments”: Enabled = Yes, paste your API key and secret, save.
4. Webhook: https://your-store/paygate/webhook (sent automatically as callback_url). Verify with a test order.

🛒 CS-Cart — setup

1. Download the zip. Administration → Add-ons → Manage add-ons → “+” (Upload & install) → choose the zip.
2. Administration → Payment methods → Add: Processor = “Paygate (crypto)”.
3. On the Configure tab paste your API key and secret (leave base URL as https://paygate.love), save and activate.
4. The webhook is wired automatically (callback_url). Verify with a test order — the status updates via the signed webhook.

🅱️ Blesta — setup

1. Download the zip. Copy components/gateways/nonmerchant/paygate/ into your Blesta install at the same path.
2. Settings → Company → Payment Gateways → Available → install “Paygate — Crypto Payments”.
3. Click “Manage”, enter your API key and secret (leave base URL as https://paygate.love), save.
4. The callback URL is Blesta's standard gateway callback, sent automatically. Verify with a test invoice.

🧾 FOSSBilling — setup

1. Download the zip and extract library/Payment/Adapter/Paygate.php into your FOSSBilling root (paths merge).
2. Admin → System → Payment gateways → New payment gateway → activate “Paygate”.
3. Paste your API key and secret (leave base URL as https://paygate.love), save.
4. The webhook (IPN) is wired automatically as callback_url. Verify with a test invoice — payment applies via the signed webhook.

💬 XenForo — setup

1. Download the zip and copy the contents of upload/ into your forum root (creates src/addons/Paygate/Crypto).
2. Admin → Add-ons → install “Paygate — Crypto Payments”.
3. Admin → Setup → Payment profiles → Add payment profile → Paygate: paste your API key and secret, save.
4. Attach the profile to your User upgrades. Payment confirms via the signed webhook through payment_callback.php.

📦 BoxBilling — setup

1. Download the zip and extract bb-library/Payment/Adapter/Paygate.php into your BoxBilling root.
2. Admin → Configuration → Payment gateways → New payment gateway → activate “Paygate”.
3. Paste your API key and secret (base URL https://paygate.love), save. The webhook (IPN) wires automatically.
4. Verify with a test invoice — payment applies via the signed webhook.

🎮 Paymenter — setup

1. Download the zip and extract extensions/Gateways/Paygate into your Paymenter root.
2. Admin → Extensions → Gateways → enable “Paygate”.
3. Paste your API key and secret (base URL https://paygate.love), save.
4. Webhook: /extensions/gateways/paygate/webhook (sent automatically as callback_url). Verify with a test invoice.

👥 Invision Community — setup

1. Download the zip and install the paygate application (AdminCP → System → Applications; see README for dev-mode / tar build).
2. AdminCP → Commerce → Payments → Payment Methods → Create New → Paygate.
3. Paste your API key and secret (base URL https://paygate.love), save.
4. Payment confirms via the signed webhook; underpaid goes to Held for manual review.

📋 vBulletin — setup (vB4 / vB5)

1. Pick your archive: vB4 (4.2.x) → includes/paymentapi/class_paygate.php; vB5 → core/includes/paymentapi/class_paygate.php.
2. Copy the class file to the right path and run install.sql from the archive (registers the method in the paymentapi table).
3. AdminCP → Paid Subscriptions → Payment API Manager → Paygate: enable, paste your API key and secret (base URL https://paygate.love).
4. The subscription activates via the signed webhook (payment_gateway.php); duplicates bounce on the transaction id.

🎮 Azuriom — setup

1. Download the zip and add PaygateMethod to the Shop plugin (see README: patch PaymentManager or register via registerPaymentMethod).
2. Admin → Shop → Settings → Payment gateways → Paygate: paste your API key and secret (base URL https://paygate.love).
3. Payment confirms via the signed webhook (shop.payments.notification); completed payments are idempotent.

🏬 Webasyst / Shop-Script — setup

1. Download the zip and extract wa-plugins/payment/paygate into your Webasyst root.
2. Store → Settings → Payment → add method → Paygate: paste your API key and secret (base URL https://paygate.love).
3. Payment confirms via the signed webhook (waPayment relay URL); dedup via native_id.

🛒 X-Cart — setup

1. Download the zip and extract classes/ and skins/ into your X-Cart root, then rebuild the cache (Re-deploy).
2. Admin → Store setup → Payment methods → enable “Paygate”.
3. Paste your API key and secret (base URL https://paygate.love), save. Payment confirms via the signed webhook.

🛍️ Zen Cart — setup

1. Download the zip: module file to includes/modules/payment/, language to includes/languages/english/modules/payment/, and ipn_paygate.php to the store root.
2. Admin → Modules → Payment → Paygate → Install; paste your API key and secret (base URL https://paygate.love).
3. The order is created as pending; status updates via the signed webhook (ipn_paygate.php).

🏪 osCommerce — setup

1. Download the zip (targets osCommerce 2.3.x): module file to includes/modules/payment/, callback.php to ext/modules/payment/paygate/, language to includes/languages/english/….
2. Admin → Modules → Payment → Paygate → Install; paste your API key and secret (base URL https://paygate.love).
3. Order status updates via the signed webhook (ext/…/callback.php); the webhook retries until the order is found.

🛒 VirtueMart (Joomla) — setup

1. Joomla → Extensions → Install: upload the zip (or copy to plugins/vmpayment/paygate/ and click Discover).
2. Enable the “VM Payment - Paygate” plugin, then VirtueMart → Payment Methods → create a method using it.
3. Paste your API key and secret (base URL https://paygate.love), save. Payment confirms via the signed webhook.

💧 Drupal Commerce — setup

1. Extract the module to modules/custom/paygate (or via composer), enable it on Extend.
2. Commerce → Configuration → Payment gateways → Add: choose Paygate (off-site redirect).
3. Paste your API key and secret (base URL https://paygate.love), save. The notify webhook is the source of truth.

⬇️ Easy Digital Downloads — setup

1. WP Admin → Plugins → Add New → Upload → choose the zip → Install → Activate.
2. Downloads → Settings → Payment Gateways → enable “Paygate” and open its settings.
3. Paste your API key and secret (base URL https://paygate.love), save. Payment confirms via the signed webhook (edd-listener).

🧾 HostBill — setup (free bridge)

1. This is a lightweight bridge, not the paid SDK module: unzip it into a web-accessible folder, e.g. https://your-billing/paygate/.
2. HostBill → Settings → API: create an API user, whitelist this server's IP. Copy config.sample.php → config.php and fill in the HostBill + Paygate keys and a random link_secret.
3. In your Paygate store settings set the webhook/callback → https://your-billing/paygate/callback.php. A payment closes the invoice automatically via the Admin API (addInvoicePayment).
4. Add the “Pay with Crypto” button to invoices via the hooks/paygate_button.php hook (into includes/hooks/) or a ready signed link pay.php?invoice_id=…&token=… — see the README.

🖥️ WISECP — setup

1. Copy the coremio/ folder from the zip over your WISECP root (the module lands in coremio/modules/Payment/Paygate/).
2. Admin → Settings → Payment Gateways → enable “Paygate — Crypto Payments” and paste your API key and secret (base URL https://paygate.love).
3. No webhook setup needed: the module passes its callback link with every checkout. Payment confirms via the signed webhook.

🧾 ClientExec — setup

1. Unzip the archive into plugins/gateways/paygate/ of your ClientExec install.
2. Settings → Plugins → Payment Processors → activate Paygate and paste your API key and secret (base URL https://paygate.love).
3. Webhook: https://your-domain/plugins/gateways/paygate/callback.php — set it in your Paygate store settings.

🎨 Tilda — setup (universal payment system)

1. This is a self-hosted bridge: unzip it onto your PHP hosting (e.g. https://your-domain/paygate/) and fill in config.php from the sample.
2. In Tilda: Site Settings → Payment Systems → Universal payment system → API URL = https://your-domain/paygate/receive.php; field mapping and signature per the README.
3. Paygate webhook: https://your-domain/paygate/callback.php. On payment the bridge sends Tilda a signed notification — the order flips to paid.

🛒 BigCommerce — setup (bridge)

1. BigCommerce's native payment list is partner-gated, so this is a bridge: unzip onto your PHP hosting and fill in config.php.
2. In BigCommerce create a store-level API account (Orders scope), enable the offline method “Cryptocurrency (Paygate)” and add the pay button per the README (Script Manager).
3. Paygate webhook: https://your-domain/paygate/callback.php — on payment the order moves to Awaiting Fulfillment automatically.

🛍️ Zid — setup (private bridge)

1. Zid's App Store won't list crypto (SAMA), so the bridge runs privately with your own partner credentials. Deploy the Node service from the zip (npm i && npm run build).
2. Fill in .env (Zid tokens, Paygate keys) and register the order-created webhook per the README.
3. The buyer pays via the /pay/:orderId link; on confirmation the bridge marks the order paid through the Zid API.

1. Buat invoice

POST /v1/invoices
X-Api-Key: pk_...
Idempotency-Key: order-1042        # opsional, mencegah duplikat
Content-Type: application/json

{ "network": "ton", "asset": "USDT", "amount": "25.00", "order_id": "1042" }

Respons berisi id, pay_address, pay_uri, expires_at. Arahkan pembeli ke /pay/.

Field permintaan opsional: quote_currency (mata uang jumlah, default USD), order_id, callback_url (webhook per invoice), success_url (ke mana pembeli dikembalikan), test (sandbox). Respons lengkap juga mencakup status, network, asset, amount_expected, rate_locked, fee_percent, telegram_url.

Sandbox: tambahkan "test": true — invoice tidak dipantau di blockchain dan tidak pernah memengaruhi saldo Anda; simulasikan pembayarannya di dasbor untuk memvalidasi webhook. Webhook-nya ditandatangani dengan cara yang sama tetapi memuat "test": true — proses pesanan hanya jika test === false.

1b. Live rate — price a USD amount in BTC/LTC

GET /v1/quote?asset=BTC&quote_currency=USD
X-Api-Key: pk_...
→ { "asset": "BTC", "quote_currency": "USD", "rate": "63022.25" }

# price a $12.99 item in BTC:
#   amount = 12.99 / 63022.25 = 0.00020612  → send as "amount" to /v1/invoices
# optional: pass &amount=12.99 to get "quote_amount" back too

The amount is denominated in quote_currency (default USD) — the gateway converts it to the coin at the live rate, no manual math needed. For USDT/USDC quoted in USD that's 1:1. To price directly in the coin, set quote_currency to the coin symbol (e.g. quote_currency=BTC) — then no conversion happens. The rate comes from CoinGecko/Coinbase, refreshes every ~45s and is locked into the invoice (rate_locked), so the buyer always pays the correct up-to-the-minute amount. The response returns quote_amount (as you sent it) and amount_expected (the final coin amount).

Don't want to do the math? Use POST /v1/checkouts with a USD amount — the buyer picks the coin and we handle the live conversion.

Tautan pembayaran (pembeli memilih koin)

POST /v1/checkouts
X-Api-Key: pk_...
Content-Type: application/json

{ "amount": "25.00", "quote_currency": "USD", "order_id": "1042" }
→ { "checkout_url": "https://…/checkout/…", "short_url": "https://…/c/…",
    "telegram_url": "https://t.me/…", "expires_at": "…" }

POST /v1/checkouts dengan jumlah tertentu membuat tautan tempat pembeli memilih jaringan dan koin — ideal tanpa integrasi. Respons: checkout_url, short_url, telegram_url, expires_at. Mendukung order_id, callback_url, dan success_url yang sama seperti pada invoice.

🤖 Terima pembayaran di bot / toko Telegram

Berjualan langsung di Telegram? Tidak perlu situs web. Bot Anda membuat checkout melalui API dan menerima telegram_url — deep link yang membuka alur pembayaran di dalam bot Telegram kami: pembeli memilih koin/jaringan, melihat alamat dan QR, lalu membayar. Anda menerima webhook bertanda tangan dan menyerahkan barangnya.

1. Pembeli menekan «Beli» di bot Anda → bot Anda memanggil POST /v1/checkouts (dengan order_id dan callback_url).
2. Bot Anda membalas dengan tombol inline yang menautkan ke telegram_url (atau short_url untuk membayar di halaman web).
3. Pembeli membayar tanpa keluar dari Telegram → Anda menerima webhook invoice.paid → bot menyerahkan produk/akses.

// Telegram bot (grammY/Telegraf) — sell for crypto
bot.callbackQuery("buy", async (ctx) => {
  const r = await fetch("https://paygate.love/v1/checkouts", {
    method: "POST",
    headers: { "X-Api-Key": PK, "Content-Type": "application/json" },
    body: JSON.stringify({ amount: "9.99", quote_currency: "USD",
      order_id: ctx.from.id + ":" + Date.now(),
      callback_url: "https://my-bot.example/paygate-webhook" }),
  }).then((x) => x.json());
  // r.telegram_url opens the pay flow INSIDE Telegram (coin choice + address + QR)
  await ctx.reply("Оплатить криптой:", {
    reply_markup: { inline_keyboard: [[{ text: "💳 Pay", url: r.telegram_url }]] },
  });
});

// Deliver the goods on the signed webhook (see "Webhooks" below)
app.post("/paygate-webhook", (req, res) => {
  if (verifySignature(req) && req.body.event === "invoice.paid" && !req.body.test)
    deliverOrder(req.body.order_id);   // ship / grant access
  res.sendStatus(200);
});

Tips: gunakan telegram_url untuk membayar di dalam Telegram, atau short_url jika ingin halaman pembayaran web biasa. Kaitkan order_id dengan pembeli (chat id) dan pesanan agar webhook terpetakan secara pasti. Jangan pernah menyerahkan barang selama test belum false.

2. Status invoice

GET /v1/invoices/<id>
X-Api-Key: pk_...
→ { "status": "paid", "amount_received": "25",
    "settlement": { "gross": "25", "fee": "…", "spread": "…", "net": "…", "revenue": "…" } }

Status: pending → detected → paid (ditambah underpaid, overpaid, expired, cancelled, settled).

Endpoint lainnya

GET /v1/invoices — daftar invoice dengan paginasi (limit hingga 200, offset, filter status).
POST /v1/invoices/<id>/cancel — membatalkan invoice pending/detected (memicu invoice.cancelled).
GET /v1/quote?asset=&quote_currency=&amount= — pratinjau kurs dan jumlah hasil konversi.
GET /v1/networks — daftar jaringan dan koin (tanpa perlu key).
GET /v1/reconciliation?from=&to= — rekonsiliasi tertagih-vs-diterima (limit 30 req/menit).

Rekonsiliasi: GET /v1/reconciliation?from=&to= — jumlah yang ditagih vs diterima (setelah dikurangi biaya) + selisih per pesanan (kurang/lebih bayar, belum dibayar). Kami adalah sumber kebenaran atas dana yang masuk; untuk non-kustodial, rekonsiliasikan dengan dompet Anda sendiri. Alat ini memberikan data — keputusan (pengiriman, sengketa) ada di tangan Anda.

3. Webhook

Saat status berubah, kami POST ke URL webhook Anda. Header X-Signature = HMAC-SHA256(body, api_secret). Verifikasi tanda tangan dan kesegaran (timestamp) sebelum memproses.

Payload webhook

{
  "event": "invoice.paid",
  "invoice_id": "inv_…", "order_id": "1042",
  "status": "paid", "test": false,
  "asset": "USDT", "network": "ton",
  "quote_currency": "USD",
  "amount_expected": "25", "amount_received": "25",
  "tx_hash": "…", "timestamp": "2026-07-12T20:00:00.000Z",
  "invoice": { "id": "inv_…", "order_id": "1042", "status": "paid",
               "quote_currency": "USD",
               "amount_expected": "25", "amount_received": "25" }
}

Event: invoice.detected, invoice.paid, invoice.underpaid, invoice.overpaid, invoice.expired, invoice.cancelled. Header: X-Signature, X-Webhook-Id, X-Event.

// Node — verify signature (constant-time), dedupe, gate on test
import crypto from "node:crypto";
const expected = crypto.createHmac("sha256", API_SECRET).update(rawBody).digest("hex");
const sig = String(req.headers["x-signature"] ?? "");
if (sig.length !== expected.length ||
    !crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected)))
  return res.sendStatus(401);
const evt = JSON.parse(rawBody);
if (Date.now() - new Date(evt.timestamp) > 5*60_000) return res.sendStatus(400); // anti-replay
if (seen(req.headers["x-webhook-id"])) return res.sendStatus(200);               // idempotency
if (evt.event === "invoice.paid" && evt.test === false) fulfil(evt.order_id);   // only real payments

Pengiriman: 3 percobaan cepat, lalu antrean durable hingga 12 percobaan dengan backoff sampai 1 jam. Deduplikasi berdasarkan X-Webhook-Id. URL webhook harus http(s) publik — localhost/host privat dan redirect ditolak. Jangan pernah memproses pesanan selama test belum bernilai false.

Pengamanan

• Idempotency-Key saat pembuatan invoice — percobaan ulang tidak membuat duplikat.
• Rate limit: 120 permintaan/menit per alamat IP.
• Webhook: X-Signature (HMAC), X-Webhook-Id (idempotensi), timestamp (anti-replay).