Hosted checkout

PEPTIPORT_PAY_URL=https://pay.peptiport.com
PEPTIPORT_PAY_KEY=your_api_key_here

curl -X POST https://pay.peptiport.com/api/v1/payment \
  -H "API-Key: $PEPTIPORT_PAY_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "customerEmail": "buyer@example.com",
    "customerID": "cus_8814",
    "amountInUSD": 240.00,
    "invoiceID": "ORD-10432"
  }'

{
  "host": "https://pay.peptiport.com",
  "reference_id": "c80f5363-0397-4761-aa1a-3155c3a21470",
  "url": "https://pay.peptiport.com/payments?reference_id=c80f5363-0397-4761-aa1a-3155c3a21470&host=https://pay.peptiport.com"
}

const res = await fetch(process.env.PEPTIPORT_PAY_URL + "/api/v1/payment", {
  method: "POST",
  headers: {
    "API-Key": process.env.PEPTIPORT_PAY_KEY,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    customerEmail: order.email,
    customerID: String(order.customerId),
    amountInUSD: Math.round(order.totalCents) / 100,
    invoiceID: order.number,
  }),
  signal: AbortSignal.timeout(10_000),
});

if (!res.ok) throw new Error("Payment could not be created: " + res.status);
const { reference_id, url } = await res.json();

await db.orders.update(order.id, { payReference: reference_id });
return url;

{
  "reference_id": "c80f5363-0397-4761-aa1a-3155c3a21470",
  "invoice_id": "ORD-10432",
  "customer_id": "cus_8814",
  "status": "FILLED",
  "amount": "240.00",
  "currency": "USDC",
  "filled_amount": "240.00",
  "filled_amount_in_usd": "240.00",
  "sponsored_amount": "0",
  "sponsored_amount_in_usd": "0",
  "confirmation_current": 12,
  "confirmation_required": 12,
  "timestamp": 1756819200,
  "payment_info": [
    {
      "source_address": "0x3fb9...de14",
      "destination_address": "0x21d4...a8d4",
      "transaction_hash": "0x7c1f...9ab3",
      "block_number": 21897412
    }
  ]
}

import { createHmac, timingSafeEqual } from "node:crypto";

// Raw body, not the parsed object. In Express:
//   app.post("/webhooks/peptiport", express.raw({ type: "application/json" }), handler)
function genuine(rawBody, header) {
  if (!header) return false;
  const expected =
    "sha256=" +
    createHmac("sha256", process.env.PEPTIPORT_PAY_KEY)
      .update(rawBody)
      .digest("hex");
  const a = Buffer.from(header.trim());
  const b = Buffer.from(expected);
  // Lengths must agree before timingSafeEqual, which throws otherwise.
  return a.length === b.length && timingSafeEqual(a, b);
}

export function handler(req, res) {
  if (!genuine(req.body, req.get("x-peptiport-signature"))) {
    return res.status(401).json({ error: "Bad signature" });
  }

  const event = JSON.parse(req.body.toString("utf8"));

  // Idempotency: the same event can arrive more than once, and a partial
  // payment sends several. Key on reference + status + confirmation count.
  const key = [event.reference_id, event.status, event.confirmation_current ?? 0].join(":");
  if (!claim(key)) return res.json({ ok: true });

  if (event.status === "FILLED" || event.status === "OVER_FILLED") {
    // Amounts arrive as strings. Compare in cents; never trust a float here.
    const paidCents = Math.round(Number(event.filled_amount_in_usd) * 100);
    markPaid(event.invoice_id, paidCents);
  }

  // Anything non-2xx is retried, so acknowledge a verified event even when
  // your own side failed to apply it. A retry storm will not fix your bug.
  res.json({ ok: true });
}

curl https://pay.peptiport.com/api/v1/payment/reference/c80f5363-0397-4761-aa1a-3155c3a21470 \
  -H "API-Key: $PEPTIPORT_PAY_KEY"

{
  "referenceID": "c80f5363-0397-4761-aa1a-3155c3a21470",
  "invoiceID": "ORD-10432",
  "customerID": "cus_8814",
  "amountInUSD": "240.00",
  "paymentState": "FILLED",
  "createdAt": "2026-09-02T14:11:03Z"
}