Headless checkout

checkout confirmed
  │
  ├─ POST /api/v1/payment                          → reference_id
  │     store it against the order
  │
  ├─ GET  /api/v1/blockchain-currency/reference/:reference_id
  │     → the coins and chains this payment can take
  │     render your picker from this, not from a hard-coded list
  │
  ├─ customer picks a coin
  │
  ├─ POST /api/v1/deposit-address/reference/:reference_id
  │     { "blockchain_code": "BASE" }              → Address
  │     render address + QR + amount + countdown
  │
  └─ wait
        webhook  →  status FILLED  →  release the order
        (a "check now" button can GET the payment instead)

curl -X POST https://pay.peptiport.com/api/v1/payment \
  -H "API-Key: $PEPTIPORT_PAY_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "customerEmail": "buyer@example.com",
    "customerID": "cus_8814",
    "amountInUSD": 240.00,
    "invoiceID": "ORD-10432"
  }'

{
  "host": "https://pay.peptiport.com",
  "reference_id": "c80f5363-0397-4761-aa1a-3155c3a21470",
  "url": "https://pay.peptiport.com/payments?reference_id=c80f5363-0397-4761-aa1a-3155c3a21470&host=https://pay.peptiport.com"
}

curl https://pay.peptiport.com/api/v1/blockchain-currency/reference/c80f5363-0397-4761-aa1a-3155c3a21470 \
  -H "API-Key: $PEPTIPORT_PAY_KEY"

[
  {
    "id": 7,
    "blockchainCode": "BASE",
    "network": "Base",
    "currencyCode": "USDC",
    "currency": "USDC",
    "customerAddress": "",
    "tokenAddress": "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913",
    "standard": "ERC20",
    "walletPrecision": 6,
    "family": "ETH_Family",
    "recommended": true,
    "mostUsed": true,
    "blockchainID": 4,
    "currencyID": 2
  }
]

curl -X POST https://pay.peptiport.com/api/v1/deposit-address/reference/c80f5363-0397-4761-aa1a-3155c3a21470 \
  -H "API-Key: $PEPTIPORT_PAY_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "blockchain_code": "BASE" }'

{
  "id": 324,
  "createdAt": "2026-09-02T06:53:42.419556Z",
  "Address": "0xCb12499d865271D1FfFf16308E523e0BB624a779",
  "Family": "ETH_Family",
  "Status": "active",
  "MemberID": 271
}

Bitcoin      bitcoin:<address>?amount=<btc>
Ethereum,    ethereum:<token>@<chainId>/transfer?address=<to>&uint256=<units>
Base,          chainId  1 Ethereum   8453 Base   137 Polygon
Polygon        units    integer, scaled by walletPrecision
Tron         tron:<address>?amount=<units>&token=<tokenAddress>

// POST /api/checkout/:orderId/address  { blockchainCode }
export async function assignAddress(orderId, blockchainCode) {
  const order = await db.orders.find(orderId);           // your session, your order
  if (!order.payReference) throw new Error("No payment on this order");

  const res = await fetch(
    `${process.env.PEPTIPORT_PAY_URL}/api/v1/deposit-address/reference/${order.payReference}`,
    {
      method: "POST",
      headers: {
        "API-Key": process.env.PEPTIPORT_PAY_KEY,        // server-side only
        "Content-Type": "application/json",
      },
      body: JSON.stringify({ blockchain_code: blockchainCode }),
      signal: AbortSignal.timeout(10_000),
    },
  );
  if (!res.ok) throw new Error("Could not assign an address: " + res.status);

  const { Address } = await res.json();
  // Only what the screen needs. The reference stays server-side.
  return { address: Address, amountUsd: order.totalUsd };
}

curl https://pay.peptiport.com/api/v1/ticker

[
  {
    "blockchainCode": "TRX",
    "currencyCode": "TRX",
    "tokenAddress": "T9yD14Nj9j7xAB4dbGeiX9h8unkKHxuWwb",
    "standard": "TRX",
    "walletPrecision": 6,
    "family": "TRX_Family",
    "price": "0.2796"
  }
]

// $240.00 of an asset at 0.2796, with 6 decimals.
function units(amountUsd, price, precision) {
  const scale = 10n ** BigInt(precision);
  // Integers throughout: cents in, whole units out, no float in between.
  const cents = BigInt(Math.round(amountUsd * 100));
  const priceMicro = BigInt(Math.round(Number(price) * 1e6));
  // Round up. Asking for a hair more never stalls a payment; asking for a
  // hair less does, and the customer has already left the tab.
  return (cents * scale * 10000n + priceMicro - 1n) / priceMicro;
}

{
  "reference_id": "c80f5363-0397-4761-aa1a-3155c3a21470",
  "invoice_id": "ORD-10432",
  "customer_id": "cus_8814",
  "status": "FILLED",
  "amount": "240.00",
  "currency": "USDC",
  "filled_amount": "240.00",
  "filled_amount_in_usd": "240.00",
  "sponsored_amount": "0",
  "sponsored_amount_in_usd": "0",
  "confirmation_current": 12,
  "confirmation_required": 12,
  "timestamp": 1756819200,
  "payment_info": [
    {
      "source_address": "0x3fb9...de14",
      "destination_address": "0x21d4...a8d4",
      "transaction_hash": "0x7c1f...9ab3",
      "block_number": 21897412
    }
  ]
}

import { createHmac, timingSafeEqual } from "node:crypto";

// Raw body, not the parsed object. In Express:
//   app.post("/webhooks/peptiport", express.raw({ type: "application/json" }), handler)
function genuine(rawBody, header) {
  if (!header) return false;
  const expected =
    "sha256=" +
    createHmac("sha256", process.env.PEPTIPORT_PAY_KEY)
      .update(rawBody)
      .digest("hex");
  const a = Buffer.from(header.trim());
  const b = Buffer.from(expected);
  // Lengths must agree before timingSafeEqual, which throws otherwise.
  return a.length === b.length && timingSafeEqual(a, b);
}

export function handler(req, res) {
  if (!genuine(req.body, req.get("x-peptiport-signature"))) {
    return res.status(401).json({ error: "Bad signature" });
  }

  const event = JSON.parse(req.body.toString("utf8"));

  // Idempotency: the same event can arrive more than once, and a partial
  // payment sends several. Key on reference + status + confirmation count.
  const key = [event.reference_id, event.status, event.confirmation_current ?? 0].join(":");
  if (!claim(key)) return res.json({ ok: true });

  if (event.status === "FILLED" || event.status === "OVER_FILLED") {
    // Amounts arrive as strings. Compare in cents; never trust a float here.
    const paidCents = Math.round(Number(event.filled_amount_in_usd) * 100);
    markPaid(event.invoice_id, paidCents);
  }

  // Anything non-2xx is retried, so acknowledge a verified event even when
  // your own side failed to apply it. A retry storm will not fix your bug.
  res.json({ ok: true });
}

curl https://pay.peptiport.com/api/v1/payment/reference/c80f5363-0397-4761-aa1a-3155c3a21470 \
  -H "API-Key: $PEPTIPORT_PAY_KEY"

{
  "referenceID": "c80f5363-0397-4761-aa1a-3155c3a21470",
  "invoiceID": "ORD-10432",
  "customerID": "cus_8814",
  "amountInUSD": "240.00",
  "paymentState": "FILLED",
  "createdAt": "2026-09-02T14:11:03Z"
}